My local mobile carrier (Play, Poland) and its paid SMS gate is the first example, that I recall in my entire Internet history, that forces users to fill out dully CAPTCHAs even on pages, which are secured by HTTPS protocol and user login.
Is there any reason for doing so in this situation? Is there any increased security or anti-spam effects?
In this particular case, user accounts are only half-self-registered. Anyone can create an account, but as long as he/she will not provide a valid, in-network mobile number, that is further verified by sending text message with unique code, then such account is unable to fully register and use SMS gateway.
I can't imagine spam-bot (or its author) creating an account in this situation or, even if that would be possible, a percentage of such cases would be minimal and -- in my opinion -- would not judge annoying a majority of normal, legal users with CAPTCHAs on pages available only after login.
Is this a common technique at all? I have the feeling that I was seeing CAPTCHAs only on free-access pages, i.e. without login required. I have real problems imagining Facebook, Twitter or any other service forcing user to fill out CAPTCHA once that user is validated and logged in. On registration or password-recall pages, yes. But, after login?