Update: We have a system where legitimate users watch the traffic using Network Sniffer like Fiddler to capture their fingerprints and they can use the same HTTP traffic to replay which makes them automatically logged in without using fingerprint. We wanna force users to use a fingerprint every time instead of allowing them to replay.
You can't - not without elements from trusted computing. And not over HTTP. A basic tenant of web development is that you can't trust what the client sends you. Furthermore; you have no control over how the client chooses to gather what he sends you. It could be a fingerprint reader, a keyboard, or whatever.
A good fingerprint reader will have a deterministic output. Equal fingerprints should produce equal output. Otherwise you can't use it to authenticate users.
There's a few ways to solve this. For instance, you can use a embedded, trusted, computer, that can certify (possibly via PKI) that the fingerprint was captured, and attest it by including a nonce sent from the server. But in this case, you need a custom reader with which you can communicate - and you have to trust the reader. This is basically what U2F does; it trusts a dedicated piece of hardware, and has a protocol to communicate securily with this piece of hardware.
As you describe your solution, you don't have that; you get some number from the device, and if this matches what's stored in the database, you authenticate the user. And it happens over HTTP.
Adding a captcha wouldn't improve security of the solution. It would require solving a captcha, which is trivial. Anyone with access to the valid fingerprint string would be able to authenticate at will, without using the fingerprint reader.
In short: you have a x-y problem. Go back to the drawing board.