More importantly than the technical issues, CAPTCHA completion is already big business. Where the common scripts are known to fail, malware developers just feed the CAPTCHAs over to call centres in Africa or somewhere else cheap.

Everyone wants CAPTCHAs that minimise the annoyance to end users, and that are hard for a machine to crack. But the above business model means that, as a service designer, you either need to accept some degree of CAPTCHA fail, or somehow not annoy your valid users whilst also make solving them take unprofitably long for a remote worker to do.