I love Microsoft’s email signup CAPTCHA:

Repeat ten times. Get one wrong, restart.

---

iPhones already have it

Private Access Tokens? Enabled by default in Settings  > [your name] > Sign-In & Security > Automatic Verification. Neat that it works without us realizing it, but disconcerting nonetheless.

So, the spammers will need physical Android device farms…