How to Tell If Bots Are Targeting Your Trial Signups

If your trial signups jump overnight, that is not proof of growth. Check for bots by reviewing signup volume timing, behavioral signals, and the leads themselves. Bots leave traces: superhuman input speed, no mouse movement or scrolling, uniform click paths, and form submissions that happen in milliseconds. When you see these patterns alongside a spike, your trials are likely being targeted.

The diagnosis is not one single signal. A single anomaly is not a bot verdict; privacy tools, corporate networks, and unusual devices can mimic automated behavior. You need to corroborate several independent signals before acting.

Step 1: Review signup volume and timing

Start with your raw data. If you see a sudden spike in trial registrations, ask when it started and where it came from.

• Check if the spike aligns with a campaign launch, a social post, or an email blast. If nothing changed, the traffic is suspicious.
• Look at the time of day. Bots often submit forms at unusual hours, in tight bursts, or uniformly spread across a short window.
• Compare placement or channel performance. A sharp difference in lead quality by device, ad set, or landing page can indicate bot targeting.

This step is about anomalies. A steady flow of real users does not usually produce sudden, clustered signups.

Step 2: Examine on-page engagement

Open your analytics or session recording tool. For each trial signup, look at what the user did before converting.

• Did the visitor scroll, move the mouse, hover over elements, or pause between fields?
• Did they spend meaningful time on the offer page, or did they bounce immediately after submitting?
• Did they use natural, curved pointer paths, or did their mouse snap to straight lines and grids?

Real humans produce imperfect, varied movement. Bots often skip mouse physics altogether or generate robotic linear paths. If your sessions show no scroll, no clicks, and no movement, they are likely automated.

Step 3: Measure input speed and form behavior

Time how long it takes between field entries. A human takes seconds to type their name and email. Bots can autofill in sub-millisecond intervals.

• Superhuman input speed (<1ms) is a red flag. No human types that fast.
• Look for field correction behavior. Humans backspace, retype, and adjust. Bots rarely do.
• Check for copy-paste patterns. Bots often paste values from a prebuilt script, so fields appear instantly filled.

Some bots also fill hidden fields or interact with honeypots. If you have honeypot traps on your form and they get triggered, that is direct evidence of bot activity.

Step 4: Analyze device, network, and location data

Drill into the technical fingerprint of each submission. This includes user agent, IP address, timezone, and browser settings.

• Repeated use of the same device fingerprint across many signups?
• Signups from residential proxies that route through consumer IPs but all appear in one region?
• An unusual concentration of one country code, or a mismatch between IP location and the form's target audience?

Modern bots often use residential proxy routing to bypass geolocation blocks. If you see hundreds of signups from the same ISP or region without any campaign reason, treat it as suspicious.

Step 5: Check lead quality and CRM outcomes

The real test is follow-up. Do these trial signups ever engage with your product or answer contact attempts?

• Send a confirmation email. Bots rarely click through or respond.
• Check for disposable email domains, repeated addresses, or invalid formats.
• Monitor your CRM for leads that never activate, never log in, or never reply. A high lead count with zero qualified opportunities is a classic bot signature.

If your sales team reports unreachable contacts and no demos booked, the signups are likely fake, even if they look legitimate in your dashboard.

Step 6: Use a detection tool for a verdict

When manual checks are not enough, run a behavior-based detection script. Tools like BotRefund install a lightweight tracking script that captures behavioral signals, device data, and the full attribution path. They score each session and flag anomalies.

BotRefund uses 106 independent checks, including ghost click detection, honeypot interactions, robotic mouse movement, and unnatural session durations. It cross-checks each signal against browser, network, and device evidence before labeling a visit as bot or human. This corroboration reduces false positives.

You can start with a free audit and export the report. The tool also compares the signals to your payout CSVs if you run affiliate trials, so you only pay for real conversions.

Key facts about bot detection and BotRefund

Limitations and when this advice does not apply

One anomaly does not equal a bot. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. A single fast form fill or a missing scroll could be a legitimate user with a screen reader or a kiosk.

This diagnostic works best for high-volume signup funnels. If you run a low-traffic niche trial, a single suspicious session may just be a curious visitor.

Also, these steps do not catch every type of fraud. Some bots mimic human behavior closely and pass simple behavioral checks. For those, you need deeper attribution analysis that looks at the full click path and conversion timing, not just on-page signals.

Terminology you might encounter

• Ghost click: A click that happens without the natural sequence of human intent, often triggered by a script.
• Honeypot: A hidden field or link that only bots interact with. Humans never see it.
• Residential proxy: An IP address from a real consumer ISP, used by bots to appear geographically local.
• Headless browser: A browser without a graphical interface, used to automate form submissions.
• Session duration: The time between the first and last interaction on a page. Bots often have unusually short, long, or uniform durations.

Frequently asked questions

What is the most reliable single signal of bot activity?

There is no single signal. The most reliable sign is a combination: superhuman input speed plus lack of mouse movement plus a session that lasts just long enough to submit the form. Corroborate at least two independent signals before judging a session as bot traffic.

Can bots pass CAPTCHAs?

Yes. Modern bots use human-in-the-loop CAPTCHA solving, where cheap online services route the challenge to real workers. That means a passing CAPTCHA does not prove the user is human.

Why do bots target free trials?

Fake trial signups can earn affiliate commissions (CPL payouts), inflate a publisher's performance, scrape your offer details, or simply drain your sales team's time. Every fake signup costs you money and pollutes your pipeline.

How quickly can I detect bot activity?

You can see immediate signals like superhuman input speed or ghost clicks in real time. For a full picture, wait at least 48 hours to check whether leads engage or respond.

What should I do if I confirm bot activity on my trials?

Stop the fake signups by adding behavioral detection or CAPTCHA alternatives. Review which campaigns or affiliates are sending the bots, exclude them, and consider filing a refund claim with your ad platform if applicable. Export detailed evidence before requesting a refund.