Support Portal Adds CAPTCHA Only at Signup and Risky Logins, Not Every Return Visit

An architecture decision record proposes placing CAPTCHA challenges at account signup and at login attempts flagged by risk policy, leaving ordinary returning-customer logins unchallenged. The author argues signup is the costliest point for an abuser, so friction there is more targeted than challenging every returning customer. The design requires the server to verify CAPTCHA results and treats a failed or indeterminate challenge as a hard stop, separate from the phone-code verification and session authorization decisions. Measurement is split across signup, ordinary login, and challenged login populations so that conversion trade-offs are not hidden in a combined rate. The approach trades simplicity for a more explicit risk policy and careful metrics design.