The Digital Goondas

How OTPs & CAPTCHAs Turned the Internet into a Digital Hafta Vasooli

Every era produces its own goondas. The seventies had men in safari suits collecting hafta. Today’s goondas don’t wear gold chains, carry hockey sticks or even bother issuing threats. They simply send an OTP and smile. Somewhere along the way, the neighbourhood extortionist quietly evolved into a software engineer.

The arrangement is beautifully simple. You want to enter your own bank account? Produce today’s OTP. Want to book a railway ticket? Bow before CAPTCHA. Logging into an app you’ve been using for years on the same phone? Kindly establish your identity once again. Apparently, the machine has trust issues.

The undisputed don, however, is the OTP. It has absolutely no respect for time. Sometimes it arrives before you’ve even picked up your phone. At other times it disappears into witness protection, leaving you staring helplessly at the countdown timer. Like every Indian, you eventually surrender to temptation and press Resend OTP. Nothing happens. A few more anxious seconds pass and you press it again. That is precisely when the original OTP decides to arrive.

Now you’re trapped in a dilemma worthy of a Christopher Nolan film. Is the first OTP still valid or has pressing Resend OTP already killed it? You type it anyway, convinced you’ve finally outsmarted the system. The website disagrees. Invalid OTP. Apparently, pressing Resend OTP a few seconds earlier had quietly retired the previous code without bothering to inform the only person who actually needed that information.

On particularly cruel days, the original OTP remains perfectly valid, but your impatience gets the better of you. You press Resend OTP, and as if out of spite, the very first OTP arrives instantly. You triumphantly type it in, only to discover that it has already been disowned because, in a moment of weakness, you had dared to ask for another one. The fresh OTP then lands with the swagger of a don making a late entry, by which time your session has conveniently expired because, according to the website, waiting forty-five seconds for a message is entirely your fault.

Just when you think you’ve understood the rules, the website reminds you that you have only three attempts. It feels suspiciously like Kaun Banega Crorepati, except Amitabh Bachchan isn’t smiling reassuringly across the screen and there are no lifelines. Three wrong attempts later, the digital don calmly pronounces, “Your account has been locked.” The punishment, however, has only just begun.

To prove that you are indeed yourself, you must now answer a security question you probably created sometime during the UPA government. “What was your first job?” Wonderful. But did I write Tata Motors or TELCO? In 1986 it was still TELCO. Did I write the full name because I was feeling particularly scholarly that day? Did I use capitals? Leave a space? Add a full stop? Suddenly my own employment history feels like a UPSC examination.

If that hurdle is somehow crossed, the website asks for the passcode of the debit card that you’ve never actually used. Naturally, you have no recollection of ever creating one. By now the software senses fear. One OTP is dispatched to your phone. Another, completely different one, arrives in your email. The countdown has already begun. You’re frantically hopping between Messages, Gmail and the banking app, trying to remember which OTP belongs to which screen. Meanwhile, the stock you wanted to buy has already climbed five percent and the one you desperately wanted to sell has gracefully hit the lower circuit. The market has moved on. The digital goondas haven’t.

And then, just when you think the ordeal is finally over, in walks CAPTCHA—the don’s favourite henchman.

The first challenge is simply reading the thing. Who designs these letters? It looks as though someone emptied a Scrabble box into a washing machine. Half the letters are capitals, the rest are lowercase. Some are twisted, some have mysterious lines running through them and a few appear to have been handwritten during an earthquake. You instinctively rub your eyes. Surely your eyesight couldn’t have deteriorated this dramatically in the last thirty seconds. Then self-doubt creeps in. Is age catching up? Are my cognitive abilities quietly packing their bags? Why does reading five characters suddenly feel harder than deciphering an ancient manuscript?

Then come the look-alikes. Is it an “O” or a zero? A capital “I”, a lowercase “l” or the number “1”? Is that an “S” or a “5”? A “G” or a “6”? My personal nightmare is the lowercase “j”, or the artistic collaboration between “v” and “w”, which often look like they’ve merged into an entirely new alphabet. Just when you think the torture can’t possibly get any worse, the website magnanimously offers help. “Can’t read it? Generate a new CAPTCHA.” You click it with renewed optimism. The new one is even more illegible than the previous masterpiece.

Then the circus changes format. “Select all the squares containing traffic lights.” You confidently identify every traffic light, only to discover that two microscopic pixels of the signal had apparently wandered into the neighbouring square. Next comes bicycles. Does half a bicycle count? What about only the front wheel? Is the shadow also part of the bicycle? Is that tiny sliver of tyre in the corner enough to qualify? Somewhere, an algorithm is judging not merely your eyesight but also your honesty and perhaps even your moral character.

My personal nemesis is the zebra crossing. There is always one tiny square in the bottom-right corner containing what appears to be the faintest trace of a white stripe. Is that still part of the crossing or merely a reflection? I tick it. Wrong. The next time I leave it unticked. Wrong again. By this stage I’m convinced even the software doesn’t know the answer and is merely conducting a psychological experiment to measure human frustration.

I’ve noticed there is an audio CAPTCHA too. I have never had the courage to click it. Given everything else these people have designed, I’m convinced it involves someone reciting the alphabet through a ceiling fan while a pressure cooker whistles in the background.

The irony is delicious. Computers were invented to make life easier. Instead, every important online task now begins by convincing another computer that you’re not a computer. The old goondas demanded your wallet. The digital goondas demand your patience, your eyesight and, occasionally, your sanity. The only difference is that the old ones occasionally negotiated. These fellows simply smile and say, “Your session has expired. Please try again.”