BREAKING AND SECURING TEXT-BASED CAPTCHAS: AN EMPIRICAL STUDY ON BANKS' ONLINE AUTHENTICATION SYSTEMS

Abstract

Digital transformation has made online banking services essential, increasing the need for strong security to protect sensitive user data. To distinguish human users from automated bots, banks often use CAPTCHA systems. This study evaluates the security of text-based CAPTCHAs used by Turkish banks in their online authentication processes, recognizing that user-friendliness is crucial for customer satisfaction in e-banking, alongside robust security. We analyzed 360 CAPTCHAs collected from 18 banks, assessing their security and vulnerability features using Optical Character Recognition (OCR)-based attack techniques. A custom-built CAPTCHA Resolver application was developed to automate CAPTCHA solving through systematic image filtering and processing prior to OCR. Experimental results reveal significant variation in security effectiveness across banks, with average OCR success rates ranging approximately from 53% to 98%, and the number of fully solved CAPTCHAs (100% accuracy) varying between 0 and 18 out of 20 samples per bank. The findings demonstrate that security features such as overlapping or connected characters, distortion, warping, rotation, and noisy or textured backgrounds are the most effective mechanisms for reducing OCR success. In contrast, vulnerability features, including single-type character usage (only uppercase, only lowercase, or only numbers), aligned characters, constant backgrounds, and binary color schemes, were identified as the dominant factors facilitating automated decoding. Overall, the results show that the presence of vulnerability features can outweigh the effect of multiple security mechanisms, indicating that increasing the number of security features alone does not necessarily guarantee CAPTCHA robustness. These findings underscore the critical need to balance strong security measures with usability and provide practical recommendations for improving text-based CAPTCHA design in banking applications to better protect against automated bot attacks while maintaining a user-friendly e-banking experience.