How to Check If Your Ad Campaign Is Being Targeted by Bots: A Step-by-Step Investigation Process

Immediate answer: how to run a bot-targeting check today

If you suspect bots are clicking your ads, do not pause or restructure the campaign yet. Changing targeting destroys the click IDs and placement data you need to prove invalid traffic to Google or Meta. Instead, follow this ordered process:

1. Freeze the campaign structure. Keep every ad set, creative, and placement exactly as they ran during the suspicious period. This preserves the click identifiers (gclid, fbclid) that link a session to a paid click.
2. Export raw server logs and analytics. Pull at least 30 days of access logs, Google Analytics 4 events, and Meta Ads Manager placement reports. Look for sessions with <1 ms interaction speed, zero scroll depth, identical form-completion timestamps, or traffic spikes from a single placement or device type.
3. Match ad clicks to CRM outcomes. Join your ad-platform click data with your CRM by click ID. Flag any click that produced a lead but never resulted in a connected call, booked demo, or qualified opportunity.
4. Run a behavioral audit with a detection script. Deploy a client-side detector that records pointer paths, scroll behavior, click timing, browser fingerprint consistency, and iframe context checks. Let it collect 7–14 days of data across all paid landing pages.
5. Review the evidence report. The detector will cluster sessions into human, suspicious, and bot categories. Export the bot-cluster report—it should include session replays, signal breakdowns, and click IDs for each flagged visit.
6. File refund claims with platforms. Submit the exported report to Google Ads and Meta support. Reference the specific click IDs, campaign names, and date ranges. Platforms typically respond within 5–10 business days.

Verification step: After the first refund cycle, compare the refunded amount against the bot-cluster spend in your report. A match within 10–15 % confirms your detection baseline; adjust thresholds if the gap is wider.

Why the investigation order matters

Changing targeting before you preserve attribution is the single most common mistake. Once you edit an ad set, the original click IDs become orphaned—Google and Meta cannot tie a refund request to the exact paid clicks. The workflow above keeps the evidence chain intact from click to CRM outcome to platform dispute.

Key behavioral signals that separate bots from humans

BotRefund’s detection engine evaluates 106 independent checks. The most discriminating signals fall into nine families:

• Click behavior – Ghost click detection. Catches clicks that fire without the natural sequence of human intent (hover, pause, press, release).
• Trap behavior – Honeypot interactions. Watches for bots that respond to hidden or deceptive page elements real users never see.
• Pointer behavior – Robotic linear movements. Flags unnaturally straight mouse paths that rarely appear in genuine sessions.
• Motion behavior – Absence of humanlike tremor. Looks for the tiny imperfections and jitter typical of human movement.
• Speed behavior – Superhuman input speed (<1 ms). Identifies interactions faster than a person can physically perform.
• Path behavior – Grid-aligned patterns. Detects movement that snaps to precise lines or blocks instead of natural curves.
• Engagement behavior – Absence of clicks or scrolling. Highlights sessions that stay too static to match a real browsing journey.
• Session behavior – Unnatural durations. Catches visit lengths that are too short, too long, or too uniform to be human.
• Browser integrity checks. Includes Scrollbar Width Leak and Clean Context Iframe tests that reveal automation tools patching or hiding browser APIs.

No single signal is a verdict. Privacy tools, corporate networks, and unusual devices can create anomalies for real people. The engine keeps each signal as evidence and cross-checks it against independent browser, network, device, and behavior data before the AI model weighs the complete pattern.

How the detection layer works without replacing your edge stack

Many teams assume they need a WAF or CDN replacement to stop bot clicks. That is an infrastructure decision. Ad-quality investigation is a marketing-layer job: it observes the visitor journey after the paid click reaches the page, preserves attribution, and produces a report formatted for Google and Meta review. You can keep Cloudflare, Akamai, or your existing edge provider while adding the behavioral evidence layer on top.

The onsite script installs in about one minute—no credit card, no DNS changes. It begins a free audit immediately, capturing the 106 signals and building session replays tied to each click ID. When the audit finishes, you export a PDF or CSV that platforms accept as evidence.

Evidence standards Google and Meta actually accept

Both platforms require three things before they approve a refund:

1. Click-level traceability. Every disputed dollar must map to a gclid or fbclid.
2. Behavioral proof, not just IP lists. IP blocklists are easily spoofed; platforms want session replays showing non-human behavior.
3. Consistent methodology. The same detection logic must apply across the entire date range you claim.

BotRefund’s reports are structured to meet these standards. Case studies show refund approvals across industries—financial technology, neobanking, logistics SaaS, healthcare CRM, HR tech, DevOps, legal tech, education, real estate, agriculture, automotive, cybersecurity, wellness, construction, and solar—with recovered amounts ranging from $15,400 to $1,200,000 and average bot-click rates around 14–35 % of paid traffic.

Limitations and when this process does not apply

• Brand-new campaigns (< 7 days of data). The detector needs enough sessions to build a statistical baseline; wait until you have at least 500 paid clicks.
• Pure brand-awareness campaigns with no conversion events. Without form submissions or tracked actions, there is no CRM outcome to cross-reference.
• Traffic sourced entirely from non-Google/Meta networks. Refund mechanisms only exist on platforms that offer invalid-traffic disputes.
• Sites that block third-party scripts via strict CSP. The detection script must be allowed to load and send beacons.

Key facts

Terminology quick reference

Click ID (gclid / fbclid)

Unique parameter appended by Google or Meta when a user clicks an ad; ties the session to the paid click.

Invalid traffic (IVT)

Clicks or impressions generated by bots, scripts, or non-human actors that advertisers can dispute for refunds.

Attribution preservation

Keeping campaign structure unchanged so click IDs remain valid for platform disputes.

Session replay

Visual reconstruction of a visitor’s mouse movements, scrolls, clicks, and timing.

Honeypot

Hidden page element (link, field, button) that only automated scripts interact with.

FAQ

How long does a free bot audit take?

Typically 7–14 days to collect a statistically meaningful sample across all paid placements. High-volume accounts may see clear clusters in 3–5 days.

Can I run the detection alongside my existing WAF or Cloudflare?

Yes. The script runs in the browser after the edge layer passes the request. It does not interfere with DDoS mitigation, CDN caching, or WAF rules.

What if Google or Meta rejects the refund claim?

BotRefund’s team assists with escalation. The 83 % approval rate reflects cases where the evidence package meets platform standards; rejections usually stem from missing click IDs or date-range mismatches.

Does the detector slow down page load?

The script is ~30 KB gzipped, loads asynchronously, and adds < 50 ms to First Contentful Paint in typical deployments.

Can I use the evidence for platforms other than Google and Meta?

The report format is platform-agnostic, but refund mechanisms only exist where the ad platform offers an invalid-traffic dispute process (currently Google Ads, Meta Ads, and a few programmatic exchanges).

What happens after I get the first refund?

Most clients keep the detector running continuously. It suppresses bot conversion events in real time so Google and Meta optimization algorithms train only on verified human actions, improving ROAS on future spend.