I understand the importance of CAPTCHAs, but I wouldn't put anything that required a reasonable level of thought in between my users and something I wanted them to do (for example, buy something from me). The more complex CAPTCHAs get, the less likely users are to try to complete them.
It strikes me that the specific example of buying something is generally sufficient confirmation of identity even without a Captcha. Not that your point isn't valid.
