CAPTCHAs are not fraud detection and not an ongoing effort