Please verify if you are using Ajax on your page. By default the security code is changed every time the page goes through its life cycle, which happens during an Ajax request as well. Note that if the RadCaptcha is not updated on an Ajax request, the displayed code will remain the same, but the actual code will be reloaded due to the page's lifecycle. You can avoid this effect by setting the property CaptchaImage-PersistCodeDuringAjax
in order to ensure that the captcha code will not be changed when the Ajax call is initiated.
If this is not the problem in your case, I have prepared two sample pages - the first demonstrating the default approach for image refresh and the second showing the method that you described. Please compare them with your actual project and let me know what changes should be made so that I can reproduce the problem on my end, as currently I am unable to do so.
All the best,
the Telerik team
If you want to get updates on new releases, tips and tricks and sneak peeks at our product labs directly from the developers working on the RadControls for ASP.NET AJAX, subscribe to their blog feed