Fake “I’m not a robot” check · plain-English help
A website told you to press Windows + R and paste? It's a scam — here's what to do
No real “I’m not a robot” check ever asks you to press keys or paste anything. If you haven’t done it, close the page and you’re fine. If you already did, don’t panic — work through the steps below, and change your passwords from your phone, not this computer. Rated 4.9 on Google.
- ● Real checks never ask you to paste
- ● We phone first — never pop-ups
- ● Family-run since 1995
// HOW THE TRICK WORKS
How the fake “I’m not a robot” check works
You reach a website — from a search result, an advert or a link — and it shows what looks like the familiar “I’m not a robot” or “Verify you are human” box, sometimes dressed up to look like Google or Cloudflare. When you tick it, the page quietly copies a command to your clipboard, then shows some “verification steps”:
- Press the Windows key and R together.
- Press Ctrl and V.
- Press Enter.
Those three steps open Windows’ Run box, paste the scammer’s command into it and run it. The command downloads a program from the internet and starts it. Most often it is one that steals the passwords saved in your web browser and the “stay signed in” logins for your email and shopping sites. Nothing seems to happen on screen, which is why people carry on as normal.
The rule that protects you: a real “I’m not a robot” check only ever asks you to tick a box or pick out pictures. It never asks you to press keys, open anything or paste anything. If a website asks you to, close it.
// OTHER DISGUISES
The same trick in other disguises
The wording changes every few weeks. These are the versions doing the rounds:
- “Press Windows + X, then I”. This opens Windows’ Terminal instead of the Run box, then asks you to paste and press Enter. Same scam.
- A “code” for File Explorer. The page asks you to open File Explorer, click in the address bar at the top and paste a “file path” or “verification code”. What you paste is a command, not a path.
- A fake Windows Update screen. A full-screen page in your browser that looks like Windows updating, then asks you to press keys to “finish”. Real Windows updates never ask you to paste anything.
- A “fix” to copy and paste. A message says a page won’t load or your browser needs fixing, and offers a fix you copy into Windows.
Whatever the wording, the warning sign is the same: a web page asking you to paste something into Windows. Nothing genuine works that way. If it asked you to click “Allow” instead, that is a different trick: it lets the site send pop-up warnings — see scam pop-ups.
// NEW IN AUTUMN 2026
Fake ChatGPT adverts that lead to the same trick
In September 2026 the security company Huntress reported a version that starts somewhere most people trust. Someone searches for ChatGPT, clicks a sponsored result at the top of Google, and lands on a genuine-looking ChatGPT page that criminals built with ChatGPT’s “Custom GPT” feature, which lets anyone publish their own version. It shows a fake “service availability” notice and sends you to a “backup” site, where a fake Cloudflare check asks you to copy a command and paste it into Windows Terminal. What it installed lets criminals control the PC, watch the screen and use its camera and microphone. Huntress dealt with at least 40 incidents linked to that one backup site (Huntress, 28 September 2026).
Three things worth taking from it. An advert at the top of Google can be bought by anyone — it is not a recommendation. A familiar address does not vouch for everything on it: chatgpt.com and sites.google.com both host pages that anyone can make. And no genuine check, anywhere, asks you to paste something into Terminal, PowerShell or the Run box. If ChatGPT is what you want, type chatgpt.com yourself or use the official app.
What matters is how far you got. Clicking the advert or opening the page on its own is very unlikely to have done harm. Typing a password into a page it led to means changing that password, from another device. Downloading a file means deleting it and running a full scan. Pasting a command and pressing Enter means the steps below, straight away.
// ALREADY DID IT?
Already pressed Enter? Do these steps now, in order
Steps 1 to 4 need no technical skill and don’t need us — start straight away, whatever the time of day.
- Disconnect the computer from the internet. Turn off the Wi-Fi or unplug the cable. Leave it off until the computer has been checked.
- Change your passwords from your phone or another device — never this computer. Your email first (whoever has your email can reset everything else), then online banking, shopping sites and anything else you were signed in to on this computer.
- Sign out everywhere. These programs take the “stay signed in” logins as well as passwords, so a new password on its own may not shut them out. In your email and other important accounts, look under Security for “sign out of all devices” and use it after changing the password. Then switch on two-step verification.
- Ring your bank if you bank on this computer. Dial 159 — it connects you safely to most UK banks — and tell them a password-stealing program may have run. They can watch the account.
- Have the computer checked before you use it for anything important. Some of these programs stay and start again after a restart, and some leave others behind. You can’t tell by looking. Call us on 01202 775566 and we’ll take it from there.
// WHO TO TELL
Who to tell
- The scam website: report it to the National Cyber Security Centre’s Report a suspicious website page, so it can be taken down.
- A scam text that led you there: forward it free to 7726. A scam email: forward it to report@phishing.gov.uk.
- If money was taken or bank details were stolen: ring your bank on 159 first, then Report Fraud (formerly Action Fraud) on 0300 123 2040. That covers England, Wales and Northern Ireland — in Scotland, ring Police Scotland on 101.
For the full money-and-reporting side, see I’ve been scammed — what to do.
// HOW WE HELP
How we check the computer
When you call, a patient local person answers — the same familiar faces every time, never a call centre. Here’s what we do:
- Find what ran. We look for the program the command fetched and anything it set up to start again — start-up entries, scheduled tasks and extra browser add-ons — and remove it.
- Check your protection is really on. Some of these programs tell Windows Security to ignore the folder they hide in. We check nothing has been switched off or told to look away.
- Help you lock your accounts down. Passwords changed from your phone, in the right order, with “sign out everywhere” and two-step verification switched on.
- Explain it in plain English. What we found, what it means and what we did — no jargon, no lectures.
Most checks are done remotely in one session while you watch every move on your own screen. If you’d rather nobody connected remotely for now, we do home visits across Bournemouth, Christchurch, Poole and Dorset, priced before we come. If your bank wants evidence the computer has been checked, see our scam recovery service.
// RELATED
Related help: I've been scammed — what to do, scam pop-ups, I gave a scammer remote access, phishing and our free Spot the Scam quiz.
FAMILY-RUN SINCE 1995 · ★ 4.9 ON GOOGLE · 200+ COMPUTERS UNDER OUR CARE · NO FIX, NO FEE · SAME-DAY REMOTE SUPPORT
// GOOD QUESTIONS
Frequently asked
I clicked a ChatGPT advert and it asked me to paste a command. What now?
If you pasted it and pressed Enter, follow the steps above now: disconnect from the internet, change your important passwords from another device, and get the computer checked. If you only clicked the advert or looked at the page, you are very unlikely to have been harmed, but close it and run a full scan to be sure. Huntress reported this version in September 2026: Google adverts leading to fake ChatGPT pages, then a fake check asking for a command in Terminal.
I ticked the box but didn't press any keys — am I safe?
Yes, almost certainly. Ticking the box only copied some text to your clipboard. Nothing runs unless it is pasted into Windows and Enter is pressed. Close the page, and copy any ordinary word to replace what's on the clipboard. If the page asked you to click 'Allow', that lets it send pop-up warnings, which you can switch off in the browser.
I pasted it and pressed Enter but nothing happened — did it work?
Probably, yes. The command runs in the background and closes itself, so nothing seems to happen. Treat it as if it worked: disconnect from the internet, change your passwords from your phone, sign out everywhere, and have the computer checked.
Will my antivirus have stopped it?
Sometimes, but don't rely on it. The command uses programs that are built into Windows, and the scammers change it every few days, so new versions often get past antivirus at first. Some even tell Windows Security to ignore the folder they hide in. Have the computer checked before you bank or shop on it again.
Why would a website I trust show this?
It wouldn't on purpose. Scammers put the fake check on websites they have broken into, on adverts and on pages that turn up in search results, so it can appear on a site you've used before. The site isn't asking — the scammer is.
Can you check the computer remotely after this?
Yes. You call us (or we phone you at an agreed time — never out of the blue), and we can only connect when you read us the code shown on your own screen. You watch the whole session, you can end it at any moment, and our access ends when we're done. If you'd rather nobody connected for now, we'll visit instead.
Already pasted it? Ring us and we'll check the computer with you
A real local person answers, stays calm with you and checks the computer properly — remotely while you watch every move, or with a home visit across Bournemouth, Poole, Christchurch and Dorset (priced before we come, and we always call with an ETA first). Mon–Fri 9am–5pm, usually same day. Family-run since 1995.
01202 775566 · help@365techies.co.uk · MON–FRI 9AM–5PM