Sometimes users spam by creating tons of fake accounts from an IP address, or entering in a fraudulent credit card. In both cases, telling the spammer that the IP address or card is fraudulent will lead them to immediately try the next card/change IP addresses and exacerbate our problem.

What's an error message we can give to spammers in situations like this? Are there any examples from the Web of ways to handle this in a good way?

  • 1
    Are you looking for ways to try to eliminate spammers (e.g. through CAPTCHA) or how to provide messages that both provide good feedback to real users and don't give spammers any hints on how to "get better" at their job?
    – jcmeloni
    Feb 2, 2012 at 21:01
  • 1
    Your question presupposes that an actual human will see the error-message, but both answers below presuppose that it's not humans filling in the data. These suppositions are almost (though not entirely) contradictory. If you have evidence for yours, I think that would be a valuable addition to the question.
    – ruakh
    Feb 2, 2012 at 23:52

3 Answers 3


Prevent them from automating these kinds of input with a CAPTCHA or similar puzzle that requires the attention of a human. You want to catch them before they get as far as they are now, so you don't have to deal with all the superfluous nonsense data in your system in the first place. And then you won't have to show them an error message.

One solution that works quite well is showing them a few pictures of dogs and one of a cat and then asking them to identify the cat. If whoever it is is a robot, they'll fail this quickly. If they're a human, you can ramp up the complexity of this challenge by, for instance, including math problems like "what is 3*9".

If they fail the challenge, reload the page but increase the time it takes to load the page by a factor of two. So the first time they wait 1 second, then they wait 2, then they wait 4, etc. Eventually the page will take so long to load that continuing to fill in the form will be impractical and they'll move on.

Summary takeaway: make it incredibly unattractive for them to input this spam data. Spammers are running businesses too and they're not going to waste time and money on an unprofitable venture.

  • I like Rahul's answer but I wonder if there is a way to truly defeat dedicated spammers with Captcha or recognition based approaches. This link chris.pirillo.com/spammers-outsourcing-captchas is quite interesting since spammers now eliminate the robot and get a human to handle it
    – Mervin
    Feb 2, 2012 at 20:36
  • Which is why you should progressively increase the complexity of the puzzle from being a CAPTCHA to being something like a math puzzle. If you can identify that, for instance, the spammers are located in China, you could create US cultural puzzles that they would find tough to get right. Or something like that.
    – Rahul
    Feb 2, 2012 at 20:43
  • Captchas are a terrible user experience and can be solved easily by farming to a third party like Mechanical Turk or low-wage workers in India. Mar 22, 2012 at 0:38

As an alternative to CAPTCHAs, it might be worth considering variations around errorbanning spam users? Or even hellbanning [same link] so fraudulent transactions basically take them into a ghost-town version of your site where they can't interact with anything meaningfully, but it takes them a while to realise?

Seems like a lot of effort to go to, though ;-/


I just wanted to add another option in contrast to Rahul. I have never been a fan of CAPTCHA, most of the time it takes me a good 3 or 4 attempts before I can correctly identify the obscured characters it presents. It also provides a nasty, horrible user experience. Or, if it is more readable, and uses the math question tact, it just feels superfluous — why are we making regular folk jump through these crazy hoops?!

Another tactic is to have a form field that is not shown to the innocent user (hidden off screen in some fashion — remember to obscure from assisted devices for disabled users too), but is available for the wretched SPAM BOT to fill out, Muwahahahahaha! If they fill it out, they are not regular kind user folk. Then, take Rahul’s approach of incrementing the page load time by a factor of two each time, or some other devious rathole for them to fall down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.