Click “Allow” to Verify You’re Human? Don’t Do It.
A Simple Browser Notification Scam Can Open the Door to Much Bigger Problems
Key Takeaways
- Clicking ‘Allow’ on suspicious websites grants permission to send notifications, not necessarily indicating you are human.
- Scammers use this feature to send convincing messages, tricking users into further interactions.
- If you clicked ‘Allow’, do not engage with notifications and remove the website’s permission in your browser settings.
- Prevent notifications by disabling the permission request in your browser settings for added security.
- Be cautious with any unexpected requests for permissions–take time to assess before clicking.
You click a link and arrive at a website that asks you to verify that you’re human.
Nothing unusual about that, right?
But instead of asking you to check a box or identify a few traffic lights, the website gives you instructions like:
“Click Allow to verify you are human.”
That should immediately raise a red flag.
The Allow button isn’t part of a CAPTCHA. In many cases, it’s your browser asking whether you want to give that website permission to send notifications to your computer.
Clicking it can give a questionable website an ongoing way to put messages directly on your desktop—even after you’ve left the website.
What Happens When You Click “Allow”?
Modern browsers such as Microsoft Edge and Google Chrome allow websites to send notifications. There are legitimate uses for this feature, but scammers have learned how to abuse it.
A malicious or deceptive website may display a fake verification screen while triggering your browser’s legitimate notification permission request.
When you click Allow, you’re not telling the CAPTCHA that you’re human. You’re telling your browser that this website has permission to send notifications.
That’s an important distinction.
The website hasn’t necessarily installed an application or infected the computer with malware. Instead, it has convinced you to give it a legitimate browser permission that it can now abuse.
Why Is That Dangerous?
Once permission has been granted, the website can potentially send notifications that look surprisingly convincing.
You might see messages claiming:
- Your computer is infected
- Microsoft Defender found a virus
- Your antivirus subscription has expired
- Your computer requires immediate attention
- Your account has been compromised
- Click here to remove a threat
These messages can appear as Windows notifications, which makes them seem more trustworthy than an ordinary website advertisement.
The goal is usually to get you to click again.
That second interaction may lead to a phishing website, fake technical support, credential theft, unwanted software or an actual malicious download.
Did the Website Gain Access to the Windows Registry?
Seeing a strange website listed under Windows Settings → System → Notifications can be particularly alarming.
It doesn’t necessarily mean the website gained direct access to your Windows Registry.
When you authorize website notifications, Edge or Chrome communicates with Windows’ legitimate notification system. Windows and the browser can create the registrations necessary to deliver those notifications.
In other words, the chain may look something like:
Website → Browser Permission → Windows Notification System
The browser and Windows are performing legitimate functions. The scammer simply tricked the user into authorizing them.
What Should You Do If You Clicked Allow?
First, don’t click any notifications from the suspicious website.
Then remove the website’s notification permission.
Microsoft Edge
Enter this into the Edge address bar:
edge://settings/content/notifications
Review the websites that are allowed to send notifications and remove or block anything you don’t recognize.
You can also review stored site permissions at:
edge://settings/content/all
Google Chrome
Enter:
chrome://settings/content/notifications
Review the sites under Allowed to send notifications and remove anything unfamiliar.
You can review other stored site permissions at:
chrome://settings/content/all
Afterward, we recommend running a Microsoft Defender Full Scan as an additional precaution.
Prevent Websites From Asking in the First Place
If you don’t use website notifications, there’s an even better solution: don’t allow websites to request notification permission at all.
In Microsoft Edge
Go to:
edge://settings/content/notifications
Turn off the setting that allows websites to ask before sending notifications.
In Google Chrome
Go to:
chrome://settings/content/notifications
Under Default behavior, select:
Don’t allow sites to send notifications.
This simple change removes one of the mechanisms these scams depend on.
There’s an Even More Dangerous Version
There’s another fake CAPTCHA technique that deserves special attention.
You may encounter a website that tells you to prove you’re human by doing something like:
Press Windows + R
Press Ctrl + V
Press Enter
Don’t do it.
Likewise, don’t follow verification instructions telling you to open PowerShell, Command Prompt, Windows Terminal or another Windows utility.
These instructions can be designed to trick you into executing a command that was silently copied to your clipboard. Unlike simply allowing browser notifications, this technique can potentially execute malicious software or commands on the computer.
A CAPTCHA should never require you to execute a Windows command to prove you’re human.
The Bigger Cybersecurity Lesson
Cybercriminals don’t always need to break into a computer.
Sometimes they simply convince the person sitting in front of it to give them permission.
That’s why one of the most effective cybersecurity habits is also one of the simplest:
When something unexpected asks for permission, stop before clicking Allow.
Take a few seconds and ask:
What am I actually giving permission to do?
That short pause can prevent a minor annoyance from becoming a major security incident.
Not Sure? Ask Before You Click.
If you’re a bizBLISS client and encounter a suspicious email, browser notification, security warning or website prompt, don’t guess.
Contact bizBLISS before you click.
A few minutes spent verifying something suspicious can save hours—or days—of recovery.
bizBLISS
Bringing People, Numbers, and Technology Together.