facebook doesn't use captcha's as much as it does other security features. if there is a log-in from an ip address that seems suspicious, it can ask you to identify your friends in photos to verify your identity.
Which is actually so much less annoying than captcha. Seems less secure (probably trivial for people you know to break in) but it's certainly a novel approach.