You don’t need a captcha if you’re willing to put some engineering resources at it. Check the IP reputation. Fingerprint the browser, they never bot from mobile devices. It’s always zombie windows boxes. Whitelist all your marketing traffic because that traffic is clean.
I guess you could script bots using an emulator but there are probably easier targets for carders.
For IP reputation, looking for IPs associated with proxies and also data center IPs though blacklisting all the big cloud providers will grab innocent users. EG: US military runs outbound proxies on azure.
This all for new traffic. Users that are known to be non fraudulent have a unique persistent cookie that allows them to bypass all the checks. So they could jump on a VPN and stuff would work.
Stuff we built for an online bank was even more advanced and looked at the incoming packets to detect proxies(tcp fingerprinting to determine OS). And we did shady stuff with fingerprinting internal networks with WebRTC. Our adversaries were 100 times better than simple carders running selenium scripts.
