Seatext library / BotRefund evidence
How Ad Fraud Detection Companies Work: The Technical Process Behind Catching Invalid Traffic
Ad fraud detection companies use client-side behavioral analysis, device fingerprinting, and machine learning to identify bot traffic in real time. They capture evidence like mouse movements, click timing, and session patterns, then package that...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Ad fraud detection companies install lightweight scripts on your website that watch every paid visit from the moment the ad click lands. They measure whether the behavior matches a real human — mouse tremor, scroll depth, form typing speed, session length — and flag anything that falls outside normal ranges. The output is a log of flagged sessions with video replays and click IDs (GCLID, FBCLID) that you can submit to ad platforms for refunds.
What ad fraud detection actually does
Most ad platforms run server-side filters that look at IP reputation and click frequency. Those filters miss bots that use residential proxies, headless browsers, or AI-generated mouse curves. Detection companies add a client-side layer that runs in the visitor's browser. It records the full interaction: pointer path, click timestamps, scroll events, focus changes, and form inputs. That data stays on your domain until you export it for a dispute.
The goal is not just to block traffic. It is to produce evidence that Google's Click Quality team and Meta's billing reviewers accept. A blocked bot saves future spend; a documented bot recovers past spend.
Core detection signals
Detection engines break behavior into categories. Each category catches a different automation technique.
Click behavior — ghost clicks
Catches click activity that happens without the natural sequence of human intent. A real click follows a hover, a pause, a decision. Bots often fire the click event directly.
Trap behavior — honeypot interactions
Watches for bots that respond to hidden or intentionally deceptive page elements. Humans never see these elements; scripts that scrape the DOM do.
Pointer behavior — robotic linear movements
Flags unnaturally straight pointer paths that rarely appear in real user sessions. Human hands produce micro-curves and corrections.
Motion behavior — absence of humanlike mouse tremor
Looks for the tiny imperfections and jitter typical of human movement. Perfectly smooth motion is a strong bot indicator.
Speed behavior — superhuman input speed
Identifies interactions that happen faster than a person could realistically perform, such as form fills in under one millisecond.
Path behavior — grid-aligned movement patterns
Detects movement that snaps to precise lines or blocks instead of natural curves. This shows coordinate-based automation.
Engagement behavior — absence of clicks or scrolling
Highlights sessions that stay too static to match a real browsing journey. No scroll, no secondary clicks, no focus changes.
Session behavior — unnatural durations
Catches visit lengths that are too short, too long, or too uniform to be human. Bots often hit a page for a fixed dwell time.
How the detection process works step by step
- Install the script. Add a single JavaScript snippet to your site. Typical setup takes about one minute and requires no credit card.
- Tag paid traffic. The script reads GCLID and FBCLID parameters from ad clicks and binds them to the session.
- Record behavior. As the visitor moves, clicks, scrolls, and types, the script streams telemetry to the detection engine.
- Score in real time. Each session gets a risk score based on the signal categories above. High-risk sessions are flagged immediately.
- Generate evidence. For every flagged session, the system creates a video replay, a JSON log of events, and a summary report tied to the click ID.
- Export for refund. You download a dispute package — CSV of click IDs, video links, and behavioral annotations — and submit it to Google or Meta.
- Track outcomes. The platform logs each claim's status: submitted, under review, approved, denied. Historical data goes back to 2017 for Google Ads.
Common fraud types these companies catch
- Competitor click activity. Manual or automated clicks from rival firms trying to exhaust daily budgets.
- Publisher click fraud. Search partner sites generating clicks to boost their own AdSense revenue.
- Bot traffic and web scrapers. Headless Chrome, Puppeteer, Selenium, Playwright scripts indexing paid listings.
- Affiliate lead fraud. Partners using botnets to fill forms, request demos, or register fake accounts for CPL payouts.
- Residential proxy networks. Clicks routed through hijacked IoT devices so IPs look like legitimate home users.
- AI-powered behavioral emulation. Bots that add random mouse curvature and scroll variance to fool simple rule sets.
What happens after detection: refunds and protection
Detection is only half the job. The second half is turning flags into money back and cleaner data.
Refund recovery
Teams compile the evidence dossier and file formal disputes with Google's Click Quality team or Meta's billing support. The source pack notes an 83% approval rate across client claims submitted to ad platforms. Refunds can reach back to 2017 for Google Ads spend.
Pixel protection
Flagged sessions are excluded from conversion pixels in real time. This stops poisoned data from retraining bidding algorithms on bot behavior.
Ongoing monitoring
The script stays active. New fraud patterns — new proxy ranges, new headless versions, new AI telemetry — are caught as they appear without manual rule updates.
Limitations and what detection cannot do
- Cannot stop the click. The ad platform charges for the click before the visitor reaches your site. Detection works post-click.
- Cannot guarantee refund approval. Google and Meta make the final decision. Approval rates vary by traffic quality and evidence strength.
- Cannot detect view-through fraud. Impression-only fraud (ad stacking, pixel stuffing) leaves no click to tag.
- Requires JavaScript execution. Bots that strip scripts or render in non-browser environments may leave no client-side trace.
- Does not fix campaign strategy. Clean traffic still needs good offers, landing pages, and targeting to convert.
Key facts
| Metric | Detail | Source |
|---|---|---|
| Bot click share of budget | Up to 20% of Google and Meta ad spend | S1 |
| Refund approval rate | 83% across client claims submitted to ad platforms | S1 |
| Setup time | About one minute to add script to website | S1 |
| Historical refund reach | Google Ads spend dating back to 2017 | S1 |
| Click IDs captured | GCLID (Google) and FBCLID (Meta) logged automatically | S5 |
| Evidence format | Video proof per bot click, JSON logs, CSV dispute packages | S1, S5 |
| Detection categories | Click, trap, pointer, motion, speed, path, engagement, session | S1, S3, S8 |
| Fraud types covered | Competitor clicks, publisher fraud, bots/scrapers, affiliate lead fraud, residential proxies, AI emulation | S5, S6, S7 |
Terminology
- GCLID
- Google Click Identifier. A unique parameter appended to ad destination URLs. Used to tie a click to a session for refund claims.
- FBCLID
- Facebook Click Identifier. Meta's equivalent of GCLID for Instagram and Facebook ads.
- Headless browser
- A browser running without a graphical interface, controlled programmatically (e.g., Puppeteer, Playwright). Common in automation.
- Residential proxy
- An IP address assigned to a real home device, often hijacked via malware, used to mask bot traffic as legitimate users.
- Pixel poisoning
- When fraudulent conversions feed back into ad platform algorithms, training them to optimize for bot-like behavior.
- CPL
- Cost per lead. Affiliate model where partners are paid for form submissions, making it a target for fake signups.
- Click Quality team
- Google's internal group that reviews invalid click disputes and issues billing credits.
FAQ
How long does a refund claim take?
Google typically responds in 2–4 weeks. Meta can take longer. The detection platform tracks status so you know where each claim stands.
Do I need to change my ad campaigns?
No. The script runs on your site independently. You keep your current targeting, creatives, and bidding.
Will this slow down my page?
The script is lightweight and loads asynchronously. Core Web Vitals impact is negligible.
What if Google already filtered some clicks?
Platform filters catch basic patterns. They miss residential proxies, AI emulation, and competitor clicks. Client-side detection fills that gap.
Can I use this on Meta lead forms that stay on Facebook?
No. Detection requires the visitor to land on your domain. On-platform lead forms never reach your site.
Is there a minimum spend to make this worthwhile?
The source pack shows pricing tiers starting under $10,000/mo ad spend. Even smaller accounts recover enough to cover the cost.
What happens to flagged sessions in my analytics?
You can exclude them via segments or send a custom dimension. The platform also blocks them from conversion pixels automatically.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.