CAPTCHA challenges require a human to complete a task that is easy for humans but expensive for automated systems. Place them at the points in a business flow where automated abuse causes the most harm:

• Before adding high-demand inventory to cart — prevents bots from instantly reserving all available stock

• During account registration — slows bulk account creation for referral farming

• Before referral code redemption — prevents automated referral cycling

• Before checkout on limited releases — adds human verification to the highest-value step

CAPTCHA is not a perfect defense. Commercial CAPTCHA-solving services (2captcha, Anti-Captcha) solve CAPTCHAs using human workers for $1–$3 per 1,000 solves. On a $200 sneaker with $500 resale value, paying $0.003 per CAPTCHA solve is trivially affordable. CAPTCHA raises costs and slows bots but doesn’t stop well-funded operators.

Google reCAPTCHA v3 and alternatives score requests invisibly using behavioral signals without showing users a challenge unless the score is low. Proof-of-work challenges (requiring the client to compute a hash) add CPU cost to each request without user friction. These are harder to solve at scale than image-based CAPTCHAs.