Login.gov uses Google reCAPTCHA to protect against automated abuse, specifically international revenue sharing fraud (IRSF) and credential stuffing attacks. This article explains where reCAPTCHA is used, how it affects users, and how to troubleshoot issues.
Where reCAPTCHA Is Used
International Phone Setup
When a user adds an international phone number (outside the U.S., its territories, Canada, or Mexico) during account creation or from their account management dashboard, reCAPTCHA runs an analysis. This addresses International Revenue Sharing Fraud (IRSF), where bad actors orchestrate repeated one-time code requests to generate fraudulent charges.
- If the user passes the confidence threshold, they receive their one-time code as usual.
- If not, they are presented with a reCAPTCHA challenge (see challenge types below).
reCAPTCHA is not triggered when adding a U.S.-based phone number.
Sign-In
reCAPTCHA runs during sign-in to deter credential stuffing — where attackers use stolen or guessed email/password pairs to attempt mass logins. This check runs invisibly with no user-facing challenge.
reCAPTCHA Challenge Types
At both phone setup and sign-in, the reCAPTCHA check is invisible — users do not see any challenge. Given that no challenge is presented, there is no associated accessibility impact with the challenge.
Troubleshooting
Users Stuck on reCAPTCHA at Phone Setup
If a user is blocked by reCAPTCHA during phone setup, they may try any of the following steps:
- Turn off any active VPN
- Clear browser cache and cookies
- Try a different browser or device
- Try again later
Users Blocked at Sign-In
If a user is blocked by reCAPTCHA during sign-in, Login.gov provides recommendations for resolving the issue:
- Turn off any active VPN
- Clear browser cache and cookies
- Try a different browser or device
- Government employees can try signing in with a PIV/CAC card
These recommendations appear in the Login.gov flow and in the Login.gov help center.
Reporting Blocked Legitimate Users
If you learn of legitimate users being blocked by reCAPTCHA, please report the issue so Login.gov can escalate to Google.