Illustrative case study

Stopping distributed fake account creation in an Azure SaaS environment

Replacing Google reCAPTCHA with SiARA Shield before OTP issuance to stop automated registrations before fake or disposable inboxes receive verification codes.

Request Demo
Azure SaaS registration protected against automated fake account creation
Illustrative Azure-hosted SaaS registration scenario — Microsoft Azure.

An Azure-hosted SaaS platform was experiencing thousands of automated registrations. Attackers bypassed the Google reCAPTCHA gate using CAPTCHA-solving services and AI-assisted automation, then used disposable or attacker-controlled inboxes to receive and replay email OTPs. Proxy, IP, session and virtual-machine rotation made reputation-based tracking unreliable. SiARA Shield replaced reCAPTCHA at the pre-OTP stage, using TSM-based human verification to stop automated sessions before OTP issuance. In this illustrative scenario, observed fake-registration activity attributable to this attack pattern fell to near zero, reducing service pressure, OTP abuse and downstream account fraud.

Key architectural change: the platform did not run SiARA Shield alongside Google reCAPTCHA. SiARA Shield replaced the CAPTCHA decision point and executed before OTP issuance, preventing automated sessions from progressing to email verification.

Registration control point

Stopping distributed fake account creation

1 Account details
Bot / user enters registration data
2 SiARA Shield
TSM-based human verification
3 Email OTP
Sent only after human verification
4 Account creation
Verified journey continues
Attack type
Automated fake account creation
Existing control
Google reCAPTCHA + email OTP
Evasion
CAPTCHA solvers / AI, disposable email, proxy + VM rotation
Primary impact
Service pressure, OTP abuse, cloud cost, fake identities
Measurable results

Automated fake registrations fell to near zero

Thousands / day

automated fake-registration attempts before SiARA Shield.

< 40 sec

potential end-to-end fake sign-up cycle once fully automated.

Near zero

observed fake-registration activity attributable to this attack pattern in the illustrative scenario.

SiARA Shield

replaces reCAPTCHA before OTP issuance.

Challenge & approach

Why CAPTCHA + OTP still allowed automated fake sign-ups

Control Failure Analysis

  1. 1. CAPTCHA was the first gate. Google reCAPTCHA was positioned before OTP issuance. Its job was to stop automation before the platform generated and sent a verification code.
  2. 2. The CAPTCHA gate was bypassed. Attackers could send the challenge to external CAPTCHA-solving services or use automated/AI-assisted techniques to obtain a valid response. Passing the CAPTCHA did not establish genuine human presence.
  3. 3. OTP was then triggered. Once the CAPTCHA was accepted, the application sent an email OTP to the supplied address. Attackers used large pools of disposable or temporary inboxes they could access programmatically.
  4. 4. OTP was automatically replayed. Automation read the mailbox, extracted the OTP and submitted it back to the website. The platform therefore verified mailbox access, not whether a legitimate human had created the account.
  5. 5. Infrastructure was rotated. Proxies, IP addresses, sessions and virtual machines were changed after a small number of attempts, weakening IP, device and session reputation as reliable long-term identifiers.

Before: reCAPTCHA + OTP

Registration submitted Google reCAPTCHA CAPTCHA solver / AI bypass OTP sent to disposable email Bot retrieves + submits OTP Fake account created

After: SiARA Shield replaces reCAPTCHA

Registration submitted SiARA Shield — TSM human verification
Automated session stopped — no OTP sent
Genuine human verified Email OTP sent Account created
How TSM breaks the automation loop

How TSM breaks the automation loop

Trans-Saccadic Memory (TSM) is the core human-verification mechanism used by SiARA Shield. Instead of asking whether a CAPTCHA challenge can be solved, SiARA Shield evaluates interaction that depends on genuine human visual processing. Rotating an IP address, changing a proxy, creating a new disposable inbox or launching another VM can change the technical identity of the session, but those changes do not provide the human visual-processing capability required to satisfy the TSM-based verification step. If the session cannot satisfy that verification, it is stopped before the OTP-generation step.

TSM human verification stopping automated sessions before OTP issuance
TSM verifies human visual processing. Rotating IP, proxy, inbox or VM identity does not satisfy the step.
Protected registration flow: Azure / Existing Web Security → SiARA Shield (replaces reCAPTCHA) → Email OTP → Account Creation
Measurable results

Automated fake registrations fell to near zero while OTP abuse and service pressure were reduced

In this anonymised illustrative scenario, the platform moved from thousands of automated registrations per day to near-zero observed fake-sign-up activity attributable to this attack pattern after SiARA Shield replaced Google reCAPTCHA at the pre-OTP control point.

Illustrative normalised trend showing the intended before/after pattern. This is scenario data and should not be interpreted as independently audited customer telemetry.
Security & business impact

Security & business impact

CAPTCHA completion and OTP possession are not proof of human presence. SiARA Shield replaces the CAPTCHA gate with TSM-based human verification and makes the human decision before OTP issuance.

Genuine users avoid a traditional CAPTCHA; OTP still validates mailbox possession after TSM verifies the human interaction.

Security & business impact

  • Service availability — reduced automated load helps protect registration and application performance.
  • Cloud cost control — fewer fake sign-ups mean less unnecessary compute, database, API and logging activity.
  • OTP abuse prevention — automated sessions are stopped before OTP issuance, reducing verification emails sent to disposable or fake accounts.
  • Cleaner identity data — far fewer fake accounts improve the integrity of customer, growth and conversion analytics.
  • Fraud reduction & SOC efficiency — stopping fake-account creation upstream reduces downstream abuse and the investigation burden from rotating proxies, emails and sessions.
  • Customer experience & control clarity — genuine users avoid a traditional CAPTCHA; OTP still validates mailbox possession after TSM verifies the human interaction.
Why it matters

CISO control principle

CAPTCHA completion and OTP possession are not proof of human presence.

SiARA Shield replaces the CAPTCHA gate with TSM-based human verification and makes the human decision before OTP issuance.

Publication note: anonymised illustrative scenario. Volumes, timing and outcome are scenario data, not independently audited claims for a named customer; actual results vary by environment.

See what is reaching your applications

SiARA Shield replaces reCAPTCHA before OTP issuance.

SiARA Shield replaces reCAPTCHA with TSM-based human verification before automated sessions can receive an email OTP.

Talk to a CyberSiARA Security Consultant All case studies