CAPTCHA (Completely Automated Public Turing Test to tell Computers and Humans Apart) have been a common tool for preventing unauthorized access to websites for over a decade, but increasingly sophisticated optical character recognition algorithms and attack strategies have rendered traditional CAPTCHAs insecure. In this paper, we propose a new CAPTCHA incorporating multiple biometric modalities. Users are asked to identify faces, eyes, and fingerprints in a complex composite image. With over 1,900 volunteers and 30,000+ attempts, the proposed approach achieves high human accuracy while being resistant to existing attacks on CAPTCHAs and to detection by state-of-the-art software. © 2016 IEEE.