A routine security step has become a doorway for cybercriminals. Here’s how the fake-CAPTCHA scam works, why it catches ...