Another alternative to CAPTCHA is the obvious three-factor authentication. Send a random code to your mobile number, if its really you, you can verify yourself by entering that number on the web-page.<p>Another way is to send the same using email which is a bit more convenient than sending it to cell-phone.<p>In other words, we need to keep inventing more sophisticated ways of telling the difference between humans and computers (and the great progress in the field of AI is certainly going to push us to do that more frequently)<p>Looking for atypical use of services is something that we should be already doing, but there are limits to those. The said users you are talking about keep churning new email addresses and hide behind dynamic IP ranges of countries like Mongolia or Kyrgyzstan over which we have no control. We can&#x27;t tell the difference between good&#x2F;bad IPs for traffic coming from there, otherwise there is no need for Google to keep re-inventing the CAPTCHA every few years.