Seatext library / BotRefund evidence
How Ad Fraud Detection Works from Start to Finish: A Step-by-Step Breakdown
Ad fraud detection starts with a lightweight script on your site that captures 106 independent behavioral signals — mouse movement, click timing, scroll patterns, and browser quirks. Those signals are cross-checked against network, device,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
If you run paid search or social campaigns, you already know that automated traffic — bots, scrapers, click farms, and residential proxy networks — can eat 10–20% of your budget before platform filters catch it. The detection process that actually recovers money works in five stages: install a client-side collector, gather behavioral evidence across every session, correlate signals into a bot-vs-human probability, export platform-ready proof, and file a formal dispute with the ad network's quality team. Below is the end-to-end workflow, the specific signals BotRefund checks, how the AI weighs them, and what you need to do to turn a detection into a refund.
Prerequisites before you start
- Active Google Ads or Meta campaigns with measurable spend — the process only pays off when there is budget to recover.
- Access to your website's
<head>or tag manager to paste a single JavaScript snippet (about one minute, no credit card). - Admin rights on the ad accounts so you can download GCLID/FBCLID reports and submit the official invalid-click forms.
- Historical spend data — BotRefund can pull refund-eligible clicks back to 2017 for Google Ads.
Step 1: Deploy the client-side collector
You add one script to your site (or via GTM). The script runs in every visitor's browser and starts recording 106 independent checks immediately — no server-side logs, no IP blocklists, no fingerprinting that breaks privacy rules. Because the collector lives on the page, it sees the actual browser environment: mouse tremors, tab-switch timing, window.open behavior, and whether the visitor ever scrolled or corrected a form field.
Step 2: Capture behavioral evidence across eight signal families
Each visit produces a vector of micro-behaviors. The main families, all documented in BotRefund's detection library, are:
- Click behavior — Ghost clicks that fire without the normal human intent sequence (move → hover → press → release).
- Trap behavior — Interactions with honeypot elements hidden from real users but visible to scrapers.
- Pointer behavior — Robotic linear mouse paths that lack the micro-curves of a hand.
- Motion behavior — Absence of the tiny tremor (≈10–20 Hz jitter) present in every human hand.
- Speed behavior — Input events faster than 1 ms, physically impossible for a person.
- Path behavior — Grid-aligned movement that snaps to pixel-perfect lines instead of natural arcs.
- Engagement behavior — Sessions with zero scrolls, zero focus changes, or zero corrections.
- Session behavior — Durations that are too short, too long, or suspiciously uniform across visits.
Two deeper examples: the Impossible Tab Speed check flags when a tab gains focus and fires clicks faster than a human can switch windows; the window.open Tamper check spots scripts that override window.open to suppress pop-ups — a classic headless-browser tell. Each check adds one objective fact; no single check is a verdict.
Step 3: Cross-verify signals across browser, network, device, and behavior layers
Raw signals are noisy. A corporate VPN, a privacy extension, or a motor-impairment aid can mimic bot-like patterns. BotRefund's engine therefore cross-checks every signal against three other contexts:
- Browser context — Canvas fingerprint, WebGL renderer, audio stack, permission states.
- Network context — ASN, IP reputation, residential-proxy likelihood, latency jitter.
- Device context — Screen resolution vs. viewport, battery API, touch support, hardware concurrency.
Only when multiple independent layers tell the same story does the visit move toward a bot classification. This corroboration approach is why the system claims 99% accuracy.
Step 4: AI prediction — weighing the complete pattern
The 106 checks feed a supervised model trained on labeled human and bot sessions. The model outputs a probability score per visit. Crucially, the score is not a hard block; it is evidence. You receive a dashboard showing:
- Visit-level bot probability
- Which specific checks fired
- GCLID (Google) or FBCLID (Meta) attached to each click
- Video replay of the session (mouse path, scrolls, keystrokes)
You can filter by campaign, date range, or probability threshold before exporting.
Step 5: Build the refund evidence package
Google's Click Quality team and Meta's Traffic Quality team require structured proof. The export gives you:
- A CSV of click IDs with timestamps, bot probabilities, and fired checks
- Session replays for the top-N suspicious clicks
- A summary report formatted for the platform's official dispute form
For Google Ads, you fill the Invalid Clicks Contact Form, attach the CSV, and reference the GCLIDs. For Meta, you use the Meta Ads Invalid Traffic Report with FBCLIDs. BotRefund's team can also negotiate on your behalf — they handle the back-and-forth with platform reps.
Step 6: Receive credits and close the loop
Once the platform approves, credits appear in your billing dashboard. BotRefund customers report an 83% approval rate across submitted claims. The cycle then repeats: the approved patterns retrain the model, the collector stays on-site, and new fraud variants (AI-generated mouse curves, residential IoT botnets, audience-network background scripts) are caught in the next wave.
Key facts at a glance
| Metric | Detail | Source |
|---|---|---|
| Independent checks per visit | 106 | S1, S4, S6, S8 |
| Claimed detection accuracy | 99% | S1, S6 |
| Refund approval rate (client claims) | 83% | S1 |
| Setup time | ~1 minute, no credit card | S1, S4 |
| Historical look-back for Google Ads | 2017 | S1 |
| Platforms supported for refunds | Google Ads, Meta (Facebook/Instagram) | S1, S2, S7 |
| Evidence exported per click | GCLID / FBCLID, probability, fired checks, video replay | S1, S6, S7 |
Limitations and when this workflow does not apply
- Display/video campaigns without click IDs — GCLID/FBCLID only exist on click-based search and social campaigns.
- Traffic from non-JavaScript environments — The collector needs a browser that executes JS; pure server-to-server API traffic is invisible.
- Privacy regulations that block client-side scripts — If your consent banner prevents the script from loading before consent, early-session data is lost.
- Low-spend accounts — The economics only make sense when monthly ad spend exceeds the service tier minimums (starts at $10k/mo).
- Platform policy changes — Google or Meta can tighten evidence requirements; the export format adapts, but past claims cannot be re-filed.
Terminology quick reference
- GCLID — Google Click Identifier, appended to landing-page URLs for Google Ads clicks.
- FBCLID — Facebook Click Identifier, the Meta equivalent.
- Honeypot — A hidden form field or link that humans never see but bots fill/click.
- Residential proxy — Traffic routed through real consumer devices (IoT, phones) to mimic legitimate IPs.
- Headless browser — Chrome/Firefox running without a UI, controlled by Puppeteer, Playwright, or Selenium.
- Pixel poisoning — Feeding fake conversion events to an ad platform's pixel so its optimization model learns to target bots.
FAQ
How long does a refund take once I submit the form?
Google typically responds in 2–4 weeks; Meta in 1–3 weeks. Complex cases with high volumes can take longer. BotRefund's team follows up weekly.
Can I run the detection without filing refunds?
Yes. The free bot audit shows you the bot percentage and top fraud sources. You decide whether to export evidence and file.
Does the script slow down my site?
The payload is < 30 KB gzipped, loads asynchronously, and runs after DOMContentLoaded. Core Web Vitals impact is negligible.
What if my traffic is mostly mobile app installs?
App-install campaigns use different attribution (SKAdNetwork, Google Play Referrer). The web collector only covers browser traffic.
Can I use this data to exclude bot audiences in-platform?
You can build IP or placement exclusion lists from the dashboard, but the primary value is refund recovery — exclusions are a secondary hygiene step.
Is there a contract or minimum term?
Month-to-month. Enterprise tiers have annual commitments with volume discounts.
How does BotRefund differ from Google's built-in invalid-click filters?
Google's filters run server-side on aggregated logs and miss residential-proxy and AI-emulated traffic. BotRefund runs client-side, sees the actual browser, and produces the evidence Google's own team asks for.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.