Cybercriminals use convincing ‘verify you are human’ security checks to trick people into installing malware, but there are signs to look out for