BREAKING AND SECURING TEXT-BASED CAPTCHAS: AN EMPIRICAL STUDY ON BANKS' ONLINE AUTHENTICATION SYSTEMS

Abstract

Digital transformation has made online banking services essential, increasing the need for strong security to protect sensitive user data. To distinguish human users from automated bots, banks often use CAPTCHA systems. This study evaluates the security of text-based CAPTCHAs used by Turkish banks in their online authentication processes, recognizing that user-friendliness is crucial for customer satisfaction in e-banking, alongside robust security. We analyzed 360 CAPTCHAs collected from 18 banks, assessing their security and vulnerability features using Optical Character Recognition (OCR)-based attack techniques. A custom-built CAPTCHA Resolver application was developed to automate CAPTCHA solving through systematic image filtering and processing prior to OCR. Experimental results reveal significant variation in security effectiveness across banks, with average OCR success rates ranging approximately from 53% to 98%, and the number of fully solved CAPTCHAs (100% accuracy) varying between 0 and 18 out of 20 samples per bank. The findings demonstrate that security features such as overlapping or connected characters, distortion, warping, rotation, and noisy or textured backgrounds are the most effective mechanisms for reducing OCR success. In contrast, vulnerability features, including single-type character usage (only uppercase, only lowercase, or only numbers), aligned characters, constant backgrounds, and binary color schemes, were identified as the dominant factors facilitating automated decoding. Overall, the results show that the presence of vulnerability features can outweigh the effect of multiple security mechanisms, indicating that increasing the number of security features alone does not necessarily guarantee CAPTCHA robustness. These findings underscore the critical need to balance strong security measures with usability and provide practical recommendations for improving text-based CAPTCHA design in banking applications to better protect against automated bot attacks while maintaining a user-friendly e-banking experience.

Keywords

• Optical Character Recognition
• Security
• Text-based CAPTCHA
• Vulnerability

Supporting Institution

This research received no specific grant from funding agencies in the public, commercial, or not-for-profit sectors.

Ethical Statement

Authors follow all ethical guidelines including authorship, citation, data reporting, and publishing original research

References

1. L. Von Ahn, M. Blum, N. J. Hopper, and J. Langford, "CAPTCHA: Using Hard AI Problems for Security", in Proc. Advances in Cryptology — EUROCRYPT 2003, vol. 2656, E. Biham, Ed., in Lecture Notes in Computer Science, vol. 2656. Berlin, Heidelberg: Springer Berlin Heidelberg, 2003, pp. 294–311. doi: 10.1007/3-540-39200-9_18.
2. G. Mori and J. Malik, "Recognizing objects in adversarial clutter: breaking a visual CAPTCHA", in Proc. IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2003. Proceedings., Madison, WI, USA: IEEE Comput. Soc, 2003, p. I-134-I–141. doi: 10.1109/CVPR.2003.1211347.
3. J. Tam, J. Simsa, S. Hyde, and L. Ahn, "Breaking audio captchas", Advances in Neural Information Processing Systems, vol. 21, 2008, [Online]. Available: https://proceedings.neurips.cc/paper_files/paper/2008/hash/12092a75caa75e4644fd2869f0b6c45a-Abstract.html [Accessed: Mar. 24, 2025]
4. P. Wang, H. Gao, X. Guo, Z. Yuan, and J. Nian, ‘Improving the Security of Audio CAPTCHAs With Adversarial Examples’, IEEE Trans. Dependable and Secure Comput., vol. 21, no. 2, pp. 650–667, Mar. 2024, doi: 10.1109/TDSC.2023.3236367.
5. E. Bursztein, M. Martin, and J. Mitchell, ‘Text-based CAPTCHA strengths and weaknesses’, in Proceedings of the 18th ACM conference on Computer and communications security, Chicago Illinois USA: ACM, pp. 125–138, Oct. 2011. doi: 10.1145/2046707.2046724.
6. I. Goodfellow, Y. Bengio, A. Courville, and Y. Bengio, Deep learning, vol. 1, no. 2. MIT press Cambridge, 2016. A. Acien, A. Morales, J. Fierrez, R. Vera-Rodriguez, and O. Delgado-Mohatar, ‘BeCAPTCHA: Behavioral bot detection using touchscreen and mobile sensors benchmarked on HuMIdb’, Engineering Applications of Artificial Intelligence, vol. 98, p. 104058, Feb. 2021, doi: 10.1016/j.engappai.2020.104058.
7. S. A. Alsuhibany, ‘A Survey on Adversarial Perturbations and Attacks on CAPTCHAs’, Applied Sciences, vol. 13, no. 7, p. 4602, Apr. 2023, doi: 10.3390/app13074602.
8. J. Wang, J. Qin, X. Xiang, Y. Tan, N. Pan, , "CAPTCHA recognition based on deep convolutional neural network", Mathematical Biosciences and Engineering, vol. 16, no. 5, pp. 5851–5861, 2019, doi: 10.3934/mbe.2019292.

9. P. Wang, H. Gao, X. Guo, C. Xiao, F. Qi, and Z. Yan, ‘An Experimental Investigation of Text-based CAPTCHA Attacks and Their Robustness’, ACM Comput. Surv., vol. 55, no. 9, pp. 1–38, Sep. 2023, doi: 10.1145/3559754.
10. H. Yang, ‘Captcha Recognition using convolutional neural networks with low structural complexity’, J. Phys.: Conf. Ser., vol. 1693, no. 1, p. 012040, Dec. 2020, doi: 10.1088/1742-6596/1693/1/012040.
11. G. Ye et al., ‘Using Generative Adversarial Networks to Break and Protect Text Captchas’, ACM Trans. Priv. Secur., vol. 23, no. 2, pp. 1–29, May 2020, doi: 10.1145/3378446.
12. X. Wan, J. Johari, and F. A. Ruslan, ‘Adaptive CAPTCHA: A CRNN-Based Text CAPTCHA Solver with Adaptive Fusion Filter Networks’, Applied Sciences, vol. 14, no. 12, p. 5016, Jun. 2024, doi: 10.3390/app14125016.
13. D. Brodić and A. Amelio, ‘Exploring the usability of the text-based CAPTCHA on tablet computers’, Connection Science, vol. 31, no. 4, pp. 430–444, Oct. 2019, doi: 10.1080/09540091.2019.1609417.
14. Md. N. I. Shibbir, H. Rahman, M. S. Ferdous, and F. Chowdhury, ‘Evaluating the security of CAPTCHAs utilized on Bangladeshi websites’, Computers & Security, vol. 140, p. 103774, May 2024, doi: 10.1016/j.cose.2024.103774.
15. E. Bursztein, J. Aigrain, A. Moscicki, and J. C. Mitchell, ‘The end is nigh: Generic solving of text-based {CAPTCHAs}’, in 8th USENIX Workshop on Offensive Technologies (WOOT 14), 2014. [Online]. Available: https://www.usenix.org/conference/woot14/workshop-program/presentation/bursztein [Accessed: Mar. 24, 2025].
16. X. Yan, F. Liu, W. Q. Yan, and Y. Lu, ‘Applying visual cryptography to enhance text captchas’, Mathematics, vol. 8, no. 3, p. 332, 2020.
17. N. Tariq, F. A. Khan, S. A. Moqurrab, and G. Srivastava, ‘CAPTCHA Types and Breaking Techniques: Design Issues, Challenges, and Future Research Directions’, 2023, doi: 10.48550/ARXIV.2307.10239.
18. H. Gao, W. Wang, J. Qi, X. Wang, X. Liu, and J. Yan, ‘The robustness of hollow CAPTCHAs’, in Proc. Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS ’13, Berlin, Germany: ACM Press, 2013, pp. 1075–1086. doi: 10.1145/2508859.2516732.
19. E. Bursztein, A. Moscicki, C. Fabry, S. Bethard, J. C. Mitchell, and D. Jurafsky, ‘Easy does it: more usable CAPTCHAs’, in Proc. Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, Toronto Ontario Canada: ACM, Apr. 2014, pp. 2637–2646. doi: 10.1145/2556288.2557322.
20. Y.-W. Chow, W. Susilo, and P. Thorncharoensri, ‘CAPTCHA Design and Security Issues’, in Advances in Cyber Security: Principles, Techniques, and Applications, K.-C. Li, X. Chen, and W. Susilo, Eds., Singapore: Springer Singapore, 2019, pp. 69–92. doi: 10.1007/978-981-13-1483-4_4.
21. K. Chellapilla, K. Larson, P. Y. Simard, and M. Czerwinski, ‘Building Segmentation Based Human-Friendly Human Interaction Proofs (HIPs)’, in Human Interactive Proofs, vol. 3517,
22. H. S. Baird and D. P. Lopresti, Eds., in Lecture Notes in Computer Science, vol. 3517. , Berlin, Heidelberg: Springer Berlin Heidelberg, 2005, pp. 1–26. doi: 10.1007/11427896_1.
23. A. S. El Ahmad, J. Yan, and L. Marshall, ‘The robustness of a new CAPTCHA’, in Proc. Proceedings of the Third European Workshop on System Security, Paris France: ACM, Apr. 2010, pp. 36–41. doi: 10.1145/1752046.1752052.
24. T. Kumar, N. Goel, S. Roy, and C. Oswald, ‘Usability Evaluation of Novel Text CAPTCHA Schemes Based on Colors and Shapes’, in Proc. International Conference on Innovative Computing and Communications, vol. 1388,
25. A. Khanna, D. Gupta, S. Bhattacharyya, A. E. Hassanien, S. Anand, and A. Jaiswal, Eds., in Advances in Intelligent Systems and Computing, vol. 1388. , Singapore: Springer Singapore, 2022, pp. 355–363. doi: 10.1007/978-981-16-2597-8_30.
26. J. R. Smith, ‘Enhancing CAPTCHA security using hollow character designs’, M.S. thesis, California State University, USA, 2023.
27. M. Nari̇N, F. Davarcioğlu Özaktaş, and S. Akdemi̇R, ‘Cumhuriyetin Kuruluşunun Yüzüncü Yılında Türkiye Bankacılık Sistemi’, Fiscaoeconomia, vol. 7, no. Özel Sayı, pp. 359–397, Oct. 2023, doi: 10.25295/fsecon.1286943.
28. UAB, ‘Sektörel SOME Kurulum ve Yönetim Rehberi’, Ministry of Transportation and Infrastructure, Ankara, 2014.
29. S. Cakic, T. Popovic, S. Sandi, S. Krco, and A. Gazivoda, ‘The Use of Tesseract OCR Number Recognition for Food Tracking and Tracing’, in Proc. 2020 24th International Conference on Information Technology (IT), Zabljak, Montenegro: IEEE, Feb. 2020, pp. 1–4. doi: 10.1109/IT48810.2020.9070558.
30. B. Desai, U. Kushwaha, S. Jha, and M. NMIMS, ‘Image filtering-techniques algorithms and applications’, Applied GIS, vol. 7, no. 11, pp. 970–975, 2020.
31. G. Gupta and R. Chandel, ‘Image filtering algorithms and techniques: A review’, International Journal of Advanced Research in Computer Science and Software Engineering, vol. 3, no. 10, pp. 198–202, 2013.
32. A. A. Kumar, N. Lal, and R. N. Kumar, ‘A Comparative Study of Various Filtering Techniques’, in Proc. 5th International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India: IEEE, Jun. 2021, pp. 26–31. doi: 10.1109/ICOEI51242.2021.9453068.
33. M. M. Farhad, S. M. N. Hossain, A. S. Khan, and A. Islam, ‘An efficient Optical Character Recognition algorithm using artificial neural network by curvature properties of characters’, in Proc. International Conference on Informatics, Electronics & Vision (ICIEV), Dhaka, Bangladesh: IEEE, May 2014, pp. 1–5. doi: 10.1109/ICIEV.2014.6850844.
34. M. R. Gaikwad and N. Pardeshi, ‘Text extraction and recognition using median filter’, International Research Journal of Engineering and Technology, vol. 3, no. 1, pp. 717–721, 2016.
35. O. Nina, B. Morse, and W. Barrett, ‘A recursive Otsu thresholding method for scanned document binarization’, in Proc. IEEE Workshop on Applications of Computer Vision (WACV), Kona, HI, USA: IEEE, Jan. 2011, pp. 307–314. doi: 10.1109/WACV.2011.5711519.
36. I. Stirb, ‘Highlight image filter significantly improves optical character recognition on text images’, in Emerging Trends in Image Processing, Computer Vision and Pattern Recognition, Elsevier, 2015, pp. 131–147. doi: 10.1016/B978-0-12-802045-6.00009-0.
37. M. Kaya and Y. Çetin-Kaya, ‘Seamless computation offloading for mobile applications using an online learning algorithm’, Computing, vol. 103, no. 5, pp. 771–799, May 2021, doi: 10.1007/s00607-020-00873-y.
38. A. Tsimpiris, D. Varsamis, and G. Pavlidis, ‘Tesseract OCR evaluation on Greek food menus datasets’, ijco, vol. 9, no. 1, pp. 13–32, 2022, doi: 10.12988/ijco.2022.9829.
39. B. Desai, M. Paliwal, and K. K. Nagwanshi, ‘Study on Image Filtering -- Techniques, Algorithm and Applications’, 2022, doi: 10.48550/ARXIV.2207.06481.
40. V. E. Bugayong, J. Flores Villaverde, and N. B. Linsangan, ‘Google Tesseract: Optical Character Recognition (OCR) on HDD / SSD Labels Using Machine Vision’, in Proc. 14th International Conference on Computer and Automation Engineering (ICCAE), Brisbane, Australia: IEEE, Mar. 2022, pp. 56–60. doi: 10.1109/ICCAE55086.2022.9762440.