Seatext library / BotRefund evidence
How to Verify Leads in Real-Time Before They Enter Your Marketing Automation System
Use real-time email verification APIs and phone number validation services during form submission to block invalid and bot-generated contacts instantly. Combine these with behavioral checks that detect headless browsers and automated scripts before they...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Real-time lead verification means checking each form submission for validity before it reaches your marketing automation platform. The most direct approach is to use email verification APIs and phone number validation services that trigger during the submission process, rejecting entries that are malformed, disposable, or non-existent. For stronger protection, add behavioral auditing that spots headless browser signals and robotic input patterns, stopping bots even when they supply real-looking contact data.
How Real-Time Lead Verification Works
When a visitor submits a form, your system sends the email address to an API that checks syntax, domain validity, and mailbox existence. Phone validation services confirm number format, carrier, and reachability. These checks happen in under a second, so the user sees an error message or the form rejects silently. Behavioral verification runs on the client side before submission, analysing mouse movements, keystroke timing, and scroll behaviour to distinguish human from automated traffic.
The verification pipeline typically runs in this order: client-side behavioral telemetry collects interaction data while the user fills the form. On submit, the frontend sends the contact fields to your backend or directly to verification APIs. The backend aggregates results and decides whether to allow the lead into the CRM. If any check fails, the form shows a friendly error and the lead is dropped or quarantined for review.
Step-by-Step Implementation for Real-Time Lead Validation
1. Choose an Email Verification API
Pick a provider that offers real-time, low-latency checks. Look for services that verify domain, detect disposable email addresses, and confirm SMTP existence without queuing. Integrate the API into your form submission pipeline using a simple HTTP call.
Example request to a typical email verification endpoint:
POST https://api.emailverify.example/v1/verify
Content-Type: application/json
Authorization: Bearer YOUR_API_KEY
{
"email": "user@example.com",
"checks": ["syntax", "domain", "smtp", "disposable"]
}Typical response:
{
"valid": true,
"score": 0.92,
"checks": {
"syntax": true,
"domain": true,
"smtp": true,
"disposable": false
},
"details": {
"domain": "example.com",
"mx_records": ["mail.example.com"],
"provider": "Google Workspace"
}
}Set a threshold: reject if score < 0.7 or any critical check fails. Cache results for 24 hours to avoid re-checking the same address.
2. Add Phone Number Validation
Use a phone validation service that checks number format, country code, and line type (mobile, landline, VoIP). Some services also perform live call routing tests. Require validation for forms that ask for a phone number.
Example request:
POST https://api.phoneverify.example/v1/validate
Content-Type: application/json
Authorization: Bearer YOUR_API_KEY
{
"phone": "+15551234567",
"country": "US",
"checks": ["format", "carrier", "line_type", "reachability"]
}Response snippet:
{
"valid": true,
"line_type": "mobile",
"carrier": "Verizon Wireless",
"reachable": true,
"risk_score": 0.05
}Reject VoIP numbers for high-value forms. Allow landline and mobile. Set risk_score threshold at 0.3.
3. Implement Behavioral Bot Detection
Install a client-side script that collects telemetry on the user's interaction with the form. This should track mouse path smoothness, keypress intervals, focus events, and scroll depth. Services like BotRefund run continuous DOM-level behavioral telemetry and identify headless browsers instantly by checking millisecond keypress offsets and pointer jitter.
Minimal integration example:
<script src="https://cdn.botrefund.com/telemetry.js" async></script>
<script>
window.BotRefund = window.BotRefund || [];
BotRefund.push(['init', { siteId: 'YOUR_SITE_ID' }]);
BotRefund.push(['bindForm', '#lead-form', {
onScore: function(score, signals) {
// score 0-1, higher = more human
if (score < 0.4) {
document.getElementById('bot-flag').value = 'true';
}
}
}]);
</script>The script adds a hidden field bot-flag to your form. On submit, your backend reads this field. If true, reject or quarantine.
4. Set Up Suppression Rules
Define rules that stop submissions from proceeding to your CRM when they fail any verification check. For example, reject emails with syntax errors, phone numbers that don't match the expected pattern, or sessions that score below a human-likeness threshold. Ensure the user receives a clear, non-technical error message.
Sample suppression logic in pseudocode:
function evaluateLead(emailResult, phoneResult, behaviorScore) {
const reasons = [];
if (!emailResult.valid || emailResult.score < 0.7) {
reasons.push('Email address appears invalid or disposable.');
}
if (phoneResult && (!phoneResult.valid || phoneResult.risk_score > 0.3)) {
reasons.push('Phone number could not be verified.');
}
if (behaviorScore < 0.4) {
reasons.push('Automated behavior detected. Please try again.');
}
return {
allow: reasons.length === 0,
reasons: reasons
};
}Return HTTP 400 with the first reason. Log all rejections for audit.
5. Test and Monitor
Run test submissions with known bad data to confirm the checks fire correctly. Monitor your rejection rate and review flagged submissions periodically. Adjust thresholds to avoid false positives that block real leads.
Create a test matrix:
- Valid email + valid phone + human behavior → allow
- Disposable email + valid phone + human behavior → reject
- Valid email + VoIP phone + human behavior → reject (if policy)
- Valid email + valid phone + bot behavior (score 0.1) → reject
- Valid email + valid phone + accessibility user (score 0.35) → allow with review
Track daily: total submissions, rejection rate by reason, false positive reports from sales. Aim for < 0.5% false positive rate.
Key Facts About Real-Time Lead Verification
| Fact | Detail |
|---|---|
| Bot click rate in affected campaigns | Average bot click rate can reach 19% of total ad spend, as seen in the Digitopia case study. |
| Refund success rate | BotRefund reports an 83% refund success rate for high-volume advertisers. |
| Revenue recovered example | Digitopia recovered $18,200 in wasted ad spend after implementing behavioral auditing. |
| Conversion rate increase | After suppressing bot leads, the same client saw a 22% conversion rate increase. |
| Detection method | Behavioral auditing tracks mouse jitter, input speed, and pointer path to identify headless browsers. |
| Integration time | BotRefund can be added to a website in about one minute. |
Common Limitations of Real-Time Verification
Email and phone APIs can only verify the format and existence of the contact data. They cannot detect bots that use real, valid email addresses obtained from data breaches or temporary services. Behavioral detection catches these bots, but it requires a JavaScript snippet and may not work on all browsers or with ad blockers. Also, some legitimate users with disabilities or unusual browsing patterns may be flagged incorrectly, so you need a fallback mechanism like manual review or a CAPTCHA.
False-Positive Scenarios
- Users with motor impairments may have irregular mouse movements or long keypress intervals, triggering low behavior scores.
- Screen reader users often navigate forms via keyboard only, producing no mouse telemetry.
- Corporate networks with strict Content Security Policy may block the behavioral script, resulting in missing scores.
- Privacy-focused browsers (Brave, Tor) or extensions (Privacy Badger, uBlock) can strip or block third-party scripts.
Accessibility Considerations
WCAG 2.1 requires that verification does not create barriers. Do not rely solely on behavioral scores for rejection. Provide an accessible alternative: a simple honeypot field (hidden via CSS, not display:none) that bots fill but humans ignore. If the honeypot is filled, reject silently. If behavioral score is low but honeypot is empty, allow the lead and flag for manual review.
Fallback Workflows
- Primary: Real-time API checks + behavioral score. Reject on hard failures.
- Secondary: If APIs timeout or behavioral script fails to load, fall back to honeypot + basic regex validation.
- Tertiary: Quarantine leads that pass primary but have soft signals (score 0.4–0.6). Route to a review queue in your CRM with a "needs verification" tag.
- Manual review: Sales team calls or emails quarantined leads within 24 hours. Verified leads are promoted; confirmed bots are deleted.
Choosing Between Verification Providers
Different services excel at different layers. Email APIs specialize in deliverability checks. Phone validators focus on carrier data. Behavioral platforms detect automation at the browser level. Many teams combine two or three. The table below compares four representative options on criteria that matter for pre-submission validation.
| Provider | Latency (p95) | Price per 1k checks | Data Coverage | Integration Ease |
|---|---|---|---|---|
| ZeroBounce (email) | ~350 ms | $0.008–$0.03 | Global SMTP, disposable DB, catch-all detection | REST API, webhooks, Zapier, HubSpot native |
| AbstractAPI (phone) | ~280 ms | $0.01–$0.04 | 190+ countries, line type, carrier, porting status | REST API, SDKs for JS/Python/PHP |
| BotRefund (behavioral) | Client-side, no added latency | Flat monthly by traffic tier | Headless browser, emulator, click farm, residential proxy signals | One-line script tag, no backend code required |
| reCAPTCHA v3 (challenge) | ~150 ms (score only) | Free up to 1M/mo | Behavioral risk score only, no contact data verification | JS snippet + backend secret verification |
Who each fits: ZeroBounce fits teams that need deep email hygiene and already have a backend pipeline. AbstractAPI fits forms that collect international phone numbers. BotRefund fits marketers who want bot detection without managing API keys or backend logic — install the script, set a threshold, done. reCAPTCHA v3 fits low-budget sites that only need a risk score and can tolerate occasional CAPTCHA challenges for low-score users. Check with the vendor for current SLA, data residency, and volume discounts.
Frequently Asked Questions
What is the difference between email verification and email validation?
Email validation checks syntax and domain format. Email verification goes further by confirming the mailbox exists and can receive mail. For real-time lead verification, you need verification, not just validation.
Can real-time verification block all bots?
No. Simple bots that use random, invalid emails are blocked. Sophisticated bots that use real stolen emails or residential proxies can bypass email and phone checks. Behavioral detection is needed for those.
How fast do real-time checks need to be?
Most users expect form submission to complete in under two seconds. Email and phone APIs typically respond in 200–500 milliseconds. Behavioral analysis runs in the background and adds no visible delay.
Does real-time verification affect conversion rates?
It can improve conversion rates by removing fake leads from your statistics, allowing your marketing automation to optimize for real prospects. However, incorrect rejection of genuine users lowers conversion, so set thresholds carefully.
What is the cost of real-time verification?
Email verification APIs cost around $0.01–$0.05 per check. Phone validation is similar. Behavioral detection services often charge a flat monthly fee based on traffic volume. The total cost is usually a fraction of the ad spend saved.
Can I integrate real-time verification with my existing CRM?
Yes, most verification services offer API integrations with popular CRM platforms like HubSpot and Salesforce. You can also add a webhook in your form builder to call the verification service before the lead record is created.
How do I handle users with ad blockers or privacy tools?
Use a layered approach. If the behavioral script is blocked, fall back to honeypot fields and server-side IP reputation checks. Do not reject solely because telemetry is missing.
What data does behavioral telemetry collect?
Typical signals: mouse movement coordinates, click timestamps, keypress intervals, scroll depth, focus/blur events, device orientation, battery status (if permitted). No keystroke content, no PII. Data is processed client-side; only the risk score leaves the browser.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.