It strikes me that the specific example of buying something is generally sufficient confirmation of identity even without a Captcha. Not that your point isn't

It strikes me that the specific example of buying something is generally sufficient confirmation of identity even without a Captcha. Not that your point isn't valid.