How to Verify
a Human Online

In 2026, the cost to deploy a bot that can pass a CAPTCHA, create an account, post content, vote in a poll, and mimic human behavior is approximately $0.003 per bot per month. A motivated attacker can field 100,000 bots for $300. Meanwhile, the cost of a false positive — letting a bot pass as human — keeps rising. A Sybil attack on a DAO vote redirects millions in treasury funds. A bot farm claiming an airdrop dilutes real users to worthlessness. An AI agent executing trades without human continuity can drain a liquidity pool. Verifying that an online entity is human — not just "has a valid password," not just "passed a CAPTCHA," but "is a continuously present human" — is the single most important unsolved problem in digital infrastructure. This guide covers every method available in 2026, ranked from weakest to strongest.

TIER 1 — TRIVIALLY DEFEATED CAPTCHA / reCAPTCHA: AI solves CAPTCHAs faster and more accurately than humans. GPT-5 achieves 96% accuracy on reCAPTCHA v3. Cost to defeat: $0.0001/attempt. Email Verification: proves access to an inbox, not humanity. Gmail accounts cost $0.10 on darknet markets. Phone Verification: SIM-swap attacks, virtual numbers, and SMS interception make phone verification a speed bump, not a security control. TIER 2 — MODERATELY RESISTANT Knowledge-Based Authentication (KBA): "What was your first pet's name?" — answers are scrapable from social media or purchasable from data brokers. Social Graph Verification (BrightID): requires building a web of verified human connections. Resistant to isolated bots but vulnerable to coordinated social graph attacks. TIER 3 — STRONG BUT FLAWED Biometric Liveness Detection: checks for "liveness" in a face scan — blinking, head movement, texture analysis. Defeated by real-time deepfake video at >95% success rates. The fundamental flaw: it verifies that a face looks alive, not that the face belongs to the person operating the device. Proof of Personhood (Worldcoin/World): verifies unique human iris via hardware Orb. Strong against Sybil attacks. Weakness: iris is static and irreplaceable if compromised; requires specialized hardware; does not verify continuity. TIER 4 — THE STRONGEST Motion-Signature Verification (MyShape): verifies the continuous presence of a human through real-time motion analysis. Each verification is a fresh performance, not a replayed biometric. The entropy characteristics of human motion are mathematically impossible for AI to forge. No hardware required. No biometric data stored. Pure zero-knowledge proof. Proof of Continuity: not just "are you human?" but "are you still the same human?" The missing layer that makes every other verification method stronger.

The right verification method depends on your threat model: For a blog comment section: email verification is sufficient. The cost of a false positive is a spam comment. For a token airdrop: you need Proof of Personhood. Email verification alone will be Sybil-attacked if the airdrop value exceeds the cost of buying accounts (~$0.10/account). For a DAO governance vote: you need Proof of Personhood + Proof of Continuity. Ensure (a) each vote is from a unique human and (b) each human has maintained continuous sovereign control of their identity — preventing credential transfer attacks. For a DeFi protocol with autonomous agents: you need the full stack — DID for identification, VC for claims, PoP for uniqueness, and PoC for continuity. The combination of all four provides defense-in-depth against every known attack vector. The tier list above is not static. AI capabilities improve monthly. A method that is "moderately resistant" today may be "trivially defeated" in six months. Choose methods whose security properties are rooted in physics, not heuristics. Motion is the only signal that meets this bar.