The trade offs of simplicity to encourage adoption and the CyberSecurity component is always a pickle...

Suggestions:

Mobile: Using the sensors, asking the user during sign in to perform a shake could help. **"shake - to - proof - humanity"**, the downside is that desktop users would need a different approach and we have many but it will help to reduce some of the spammers.

Desktop: a small game to sign in would help, making the bots less efficient.