Learn more about this service

See how this page can help with your next step.

Learn more

How to Give Sales a Simple Lead-Disposition Process

A simple lead disposition process gives sales a clear way to tag each lead as qualified, unqualified, or needing nurture. It starts with defining disposition categories, then training reps to apply them consistently, and finally reviewing the tags to improve targeting.

Follow the steps below to set it up quickly and keep the process lightweight.

What a lead disposition process is

A lead disposition process is a set of labels that sales uses to mark the outcome of each lead interaction. Common labels include "Qualified", "Unqualified – Bad Fit", "Unqualified – No Budget", "Needs Nurture", and "Invalid – Bot or Spam". The goal is to create a shared language between marketing and sales so both teams know which leads are worth pursuing.

Why a simple process matters

When the process is simple, reps spend less time deciding how to tag a lead and more time selling. A simple process also produces clean data that marketing can use to refine targeting and reduce wasted ad spend. If the process is too complex, reps may skip it or apply tags inconsistently, which hurts data quality.

Core steps to build a simple lead disposition process

1. Define three to five disposition categories that cover all possible outcomes.
2. Write a one‑sentence description for each category so reps know when to use it.
3. Add the categories to your CRM as a pick‑list field on the lead record.
4. Run a short training session (15‑20 minutes) showing reps how to pick the right tag after each call or email.
5. Set a weekly review where a manager checks a sample of tagged leads and gives quick feedback.

Prerequisites before you start

• Access to edit lead fields in your CRM.
• A list of recent lead outcomes to inform your category names.
• 10‑15 minutes of a sales manager’s time to lead the training.

How to define each disposition category

Start with a workshop that lists every possible outcome a rep can encounter after a first touch. Group similar outcomes together. For each group write a concise rule: "Qualified – prospect matches ICP, has budget, and agreed to a discovery call." Keep the rule to one sentence. Avoid overlapping definitions; each lead should fit only one category.

Example: tagging a lead from first contact to follow‑up

1. Inbound form submission arrives. 2. Rep reviews the record, sees the prospect is a marketing director at a 200‑person SaaS company. 3. Rep calls, confirms budget and timeline. 4. Rep tags the lead "Qualified" and schedules a discovery call in the CRM. 5. If the prospect says they are only researching, rep tags "Needs Nurture" and adds the lead to a 30‑day email sequence. 6. If the phone number is disconnected, rep tags "Invalid – Bot or Spam" and suppresses the record from future outreach.

How to handle ambiguous leads

When a lead does not clearly fit a category, use a "Pending Review" tag. Assign the lead to a senior rep or manager for a second look within 24 hours. Document the reason for ambiguity in a note field so the team can refine definitions later. This prevents arbitrary tagging and keeps data clean.

What to do with each disposition

Measuring disposition accuracy

After one week, run a report that shows the percentage of leads in each disposition category. If the "Invalid – Bot or Spam" bucket is consistently above 5%, investigate your lead sources for fraud. If the "Qualified" bucket is stable or growing, the process is helping sales focus on real prospects. Track the conversion rate from "Qualified" to opportunity; a drop signals definition drift.

Common pitfalls and how to avoid them

• Too many categories: Keep the list short; more than six options cause hesitation.
• Vague definitions: Write each category in plain language with a concrete example.
• No follow‑up: Schedule a brief weekly check‑in to reinforce correct tagging.

Key facts about BotRefund (source‑pack data)

Using BotRefund to keep leads clean

BotRefund can automatically flag leads that show bot‑like behavior (e.g., super‑human form speed, no mouse movement). By sending those flags to your CRM, you can route suspicious leads to a "Bot or Spam" disposition before a sales rep sees them. This reduces wasted calls and keeps your disposition data accurate. Note that BotRefund works best when you install its client‑side script on all landing pages; it does not replace human review but adds an objective signal.

Limitations of a simple disposition process

A simple process works well when lead volume is moderate and traffic quality is high. It struggles when bot traffic is heavy, when reps disagree on tags, or when CRM data is incomplete. BotRefund’s 99% bot‑detection confidence helps keep invalid leads out of the pipeline before sales tags them. Its 83% client recovery rate shows that most advertisers can reclaim budget lost to bots, and the 20% budget‑loss figure highlights how much revenue can leak without automated filtering. In high‑bot environments, rely on BotRefund’s real‑time flags to pre‑tag leads as "Invalid – Bot or Spam" so the simple disposition list stays focused on genuine sales decisions.

FAQ

How many disposition categories should I use?

Three to five categories cover most B2B funnels. Add a sixth only if a distinct outcome (e.g., "Partner Referral") appears repeatedly.

What if two reps disagree on a tag?

Escalate to a manager for a quick decision, then update the category definition to prevent future conflict.

Can my CRM automate disposition?

Many CRMs allow workflow rules that set a disposition based on field values (e.g., lead score > 80 → Qualified). Use automation for clear‑cut cases; keep human review for edge cases.

How often should the process be reviewed?

Run a weekly spot‑check for the first month, then move to a monthly audit once tagging consistency exceeds 90%.

Does BotRefund replace the disposition process?

No. BotRefund supplies an objective bot‑flag that feeds into the "Invalid – Bot or Spam" category. Human reps still decide on qualified, nurture, or unqualified outcomes.

When two different devices produce the same hardware fingerprint, a binary match-or-block rule creates false positives for legitimate users and false negatives for sophisticated bots. The practical fix is to treat the fingerprint as one evidence layer among many: collect behavioral signals (input timing, pointer dynamics, scroll patterns), network reputation (IP history, proxy indicators, ASN consistency), and session context (page flow, referrer chain, conversion events), then feed the full set into a probabilistic model that weighs each layer against the others. BotRefund implements this by running 110+ independent checks — including WebGL texture constraints, canvas rendering, audio stack, and font enumeration — and cross-referencing every signal against live browser, network, and cursor behavior before scoring a session.

Why fingerprint collisions happen at scale

Device fingerprints compress dozens of hardware and software attributes into a single hash. Browsers update, users rotate devices, corporate images standardize builds, and privacy tools deliberately homogenize outputs. All of these shrink the entropy space, so distinct devices inevitably collide. The Arkose Labs analysis of fingerprinting at scale notes that static hashing produces "one device, dozens of conflicting IDs" and that the traditional approach becomes "increasingly fragile" as browsers and OSes evolve. Castle's documentation similarly highlights that reducing collisions is "of utmost importance for account security" to avoid locking out genuine users.

Collisions are not errors — they are expected when the signal space is smaller than the population. A fingerprint alone cannot distinguish a corporate laptop fleet from a botnet that mimics the same build. The solution is to stop treating the fingerprint as an identity and start treating it as a cluster hypothesis that must be confirmed or rejected by orthogonal evidence.

How BotRefund's multi-signal architecture resolves collisions

BotRefund does not rely on a single fingerprint. It runs 110+ independent checks — hardware and GPU fingerprinting, WebGL texture constraints, canvas rendering, audio context, font enumeration, battery status, and dozens of behavioral telemetry points — then feeds every signal into an edge AI model that evaluates the holistic pattern. As the WebGL Texture Constraint documentation states: "BotRefund feeds this signal into our prediction AI, evaluating the holistic picture across browser integrity, network origin, hardware fingerprints, and user telemetry. By corroborating all factors together, it identifies invalid clicks with 99% precision."

Each check is kept as evidence, not a verdict. The same documentation notes: "A single anomaly is not a bot verdict. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data." This design means a fingerprint collision on one layer (e.g., identical WebGL renderer strings) is automatically weighed against divergent signals on other layers (e.g., different pointer jitter, inconsistent IP reputation, or mismatched behavioral timing).

Step-by-step collision resolution process

1. Collect the raw fingerprint cluster. Hash the standard hardware attributes (GPU, canvas, fonts, audio, WebGL parameters). Group sessions that share the same hash.
2. Layer behavioral telemetry. For each session in the cluster, capture millisecond keypress offsets, pointer jitter, scroll velocity, focus/blur sequences, and DOM interaction order. BotRefund's SaaS funnel protection page describes this as "continuous, DOM-level behavioral telemetry" that "tracks millisecond keypress offsets, pointer jitter, and hardware rendering profiles."
3. Attach network and environmental context. Record IP reputation, ASN, geolocation consistency, proxy/VPN/Tor indicators, TLS fingerprint, and connection timing. The Facebook bot clicks guide lists "Campaign patterns: a sharp lead-quality difference by placement, creative, audience expansion, device, or landing page" as a signal worth investigating.
4. Score the combined pattern probabilistically. Feed the full vector — fingerprint cluster ID, behavioral features, network features, session metadata — into a model that outputs a probability of automation rather than a binary label. The edge model "weighs the complete multi-layer pattern instead of relying on a fragile static rule."
5. Apply tiered actions based on score bands. Low-risk scores pass silently. Medium-risk scores trigger silent pixel suppression (preventing conversion poisoning) and additional challenge. High-risk scores block and queue for refund evidence collection. BotRefund's automated browser detection page notes "Dynamic Meta Pixel & CAPI suppression" as a real-time action.
6. Close the loop with outcome feedback. When refund claims are approved or rejected by Google/Meta (83% approval rate per the homepage), feed the ground truth back into the model to recalibrate score thresholds for that fingerprint cluster.

Key signals that differentiate identical fingerprints

When the hardware hash collides, these orthogonal signals break the tie:

• Input dynamics. Humans exhibit variable keypress intervals, mouse micro-movements, and focus transitions. Headless scripts often populate forms in a single event loop tick. The SaaS funnel guide identifies "Superhuman Input Speed: Bots populate multiple form inputs instantly. A human user requires seconds to type their company details and email."
• Rendering consistency. A device claiming to be an iPhone 15 but producing desktop-class WebGL texture limits or missing mobile GPU extensions reveals spoofing. The WebGL Texture Constraint check "looks for a mismatch that a real browsing session does not normally create."
• Network behavior. Residential proxy botnets route through consumer IPs but often show datacenter-like latency patterns, inconsistent geolocation, or ASN mismatches. The Facebook ad refund guide describes "Residential Proxy Botnets: Malware on regular household computers and phones redirects clicks through normal consumer IP addresses, hiding bot activity within legitimate regional traffic."
• Session flow. Real users navigate, scroll, hesitate, and return. Bots follow direct paths to conversion events. The bot clicks guide flags "Session behavior: no scrolling, no field corrections, uniform click paths, and no meaningful time on the offer page."
• Temporal patterns. Burst arrivals at odd hours, identical inter-arrival intervals, or synchronization across sessions indicate automation. The same guide lists "Timing: several leads arriving in short bursts, forms submitted immediately after landing, or conversions concentrated at unusual hours."

Probabilistic scoring vs binary matching

Binary matching (fingerprint == known_bot_fingerprint → block) fails because collisions make the premise false. Probabilistic scoring asks: given this fingerprint cluster, this behavioral vector, this network context, and this session flow, what is the probability this session is automated? The model learns that certain fingerprint clusters have high baseline collision rates (corporate builds, privacy-hardened browsers) and automatically demands stronger behavioral evidence before flagging. Other clusters are rare in legitimate traffic (headless Chromium signatures) so a single behavioral anomaly suffices.

This approach mirrors the industry shift described by Arkose Labs: moving from "static snapshot" fingerprinting to "understanding devices as dynamic, evolving entities." BotRefund's edge execution (0ms latency per the homepage) makes this scoring feasible in the critical rendering path without delaying page load.

Limitations and when this advice does not apply

• Single-signal systems. If your stack only collects a hardware hash and has no behavioral or network telemetry, probabilistic scoring is impossible. You must either accept collision errors or add instrumentation.
• Privacy-regulated environments. Jurisdictions that restrict client-side telemetry (e.g., strict ePrivacy enforcement) may limit the behavioral signals available for disambiguation. In those cases, server-side fingerprinting (TLS, IP, header order) becomes the primary layer.
• Low-traffic sites. Model calibration requires sufficient volume per fingerprint cluster to learn baseline behavior. Sites with <10k sessions/month may not have enough data to train reliable cluster-specific thresholds.
• Sophisticated adversarial mimicry. Attackers who replay recorded human sessions (replay attacks) can defeat behavioral checks. This requires challenge-response or cryptographic attestation layers beyond fingerprinting.

Key facts

Frequently asked questions

What is a fingerprint collision?

A fingerprint collision occurs when two or more distinct physical devices produce the same hardware fingerprint hash. This happens because the fingerprint compresses many attributes into a fixed-length identifier, and the entropy of the attribute space is smaller than the population of devices — especially when browsers, OSes, or privacy tools standardize outputs.

Why not just use a longer hash or more attributes?

Adding attributes increases entropy but also increases brittleness: legitimate users change browsers, update drivers, switch networks, or enable privacy modes, causing their fingerprint to drift. A longer hash makes drift look like a new device, fragmenting identity. The robust approach is to accept collisions and resolve them with orthogonal signals.

How many behavioral signals are needed to resolve a collision reliably?

There is no fixed number. BotRefund uses 106 behavioral and environmental signals (S8) plus hardware checks. In practice, 5–10 high-quality behavioral features (input timing, pointer dynamics, scroll patterns, focus behavior, rendering consistency) combined with network context are often sufficient to separate a corporate fleet from a botnet mimicking it.

Does probabilistic scoring introduce latency?

Not if the model runs at the edge. BotRefund's architecture executes the full 110+ signal evaluation and scoring in 0ms added latency by running inside Cloudflare's edge network (S1, S2). The model is pre-compiled and inference is deterministic.

Can this approach work without client-side JavaScript?

Partially. Server-side signals (TLS fingerprint, IP reputation, header order, request timing) provide a baseline, but they lack the behavioral richness (pointer jitter, input dynamics, rendering checks) that most effectively breaks collisions. For high-value traffic, client-side telemetry is strongly recommended.

What happens when a legitimate user is scored as high-risk?

The tiered action design prevents hard blocks on medium scores. High-risk scores trigger silent pixel suppression and evidence queueing for refund claims, not immediate user-facing blocks. If a false positive occurs, the refund dispute process with Google/Meta (83% approval rate) provides a correction signal that feeds back into the model.

How do I know if my current fingerprinting solution has a collision problem?

Check your false positive rate on known-good traffic (corporate networks, privacy-browser users) and your false negative rate on known-bot traffic that mimics common builds. If either exceeds 1–2%, collisions are likely degrading accuracy. A/B test a multi-signal probabilistic layer against your current binary rule.

Competitor click fraud appears as clicks that cost you money but never turn into genuine visitors or conversions. The quickest way to spot it is to compare click‑through rates (CTR) and conversion rates against your historical averages and watch for sudden, unexplained spikes.

What is competitor click fraud?

It is a form of invalid traffic where a rival deliberately clicks your ads to drain your budget or poison your conversion data. The clicks look like normal human traffic in basic reports, but deeper analysis reveals anomalies. Competitors may hire click farms, use automated scripts, or deploy bot networks that rotate residential proxies to mimic real users. These tactics make the traffic appear legitimate in standard Google Ads dashboards, which only show surface metrics like impressions, clicks, and CTR.

Why it matters

Even a small percentage of fraudulent clicks can erode ROI. Industry data shows 11%‑14% of Google Ads clicks are invalid on average, meaning up to one in eight clicks could be waste S1. For high‑CPC verticals such as legal, insurance, and B2B SaaS, invalid traffic rates can exceed 35% S1. If you spend $50,000 per month, you could lose $5,000 to $15,000 monthly — $60,000 to $180,000 annually — to non‑human clicks S3. Click fraud also distorts your ROAS: with 14% invalid clicks, your effective cost per real click is 16% higher than reported CPC, and advertisers who clean their traffic see 40‑60% improvement in true ROAS within 6‑8 weeks S5.

How competitor click fraud works

Competitors typically use three mechanisms. First, manual click farms: low‑cost workers repeatedly click ads from different devices and IP addresses. Second, automated scripts: bots programmed to search target keywords, click ads, and simulate basic browsing. Third, sophisticated bot networks: these rotate residential proxies, use headless browsers, and mimic human mouse movements, scroll patterns, and session durations to evade Google's automated filters. Google's own filters catch less than 50% of invalid traffic; the remainder is classified as sophisticated invalid traffic (SIVT) that requires manual evidence submission S1. Because these bots can trigger conversion pixels, they poison Smart Bidding algorithms, causing the system to optimize toward bot traffic and amplify waste over time S7.

Common signs in Google Ads

• CTR spikes that are not matched by a rise in conversions.
• Very low average session duration or high bounce rate from ad clicks.
• Geographic clusters of clicks from unexpected locations.
• Click timestamps that occur in rapid succession (seconds apart).
• Consistent patterns of clicks on the same ad copy or keyword.

Step‑by‑step detection process

1. Export click data. Pull the last 30‑60 days of clicks from Google Ads.
2. Segment by device, location, and time. Look for outliers—e.g., many clicks from a single IP range or at odd hours.
3. Match clicks to on‑site behavior. Use analytics to see if the click led to meaningful page interaction (scroll, form fill, time on page).
4. Apply behavioral filters. Identify super‑fast clicks (<1 ms), straight‑line mouse paths, or lack of mouse tremor—signals of bots.
5. Document evidence. Capture Google Click IDs (GCLIDs) and the behavioral logs that prove the click was invalid.
6. Submit a refund request. Use the compiled evidence to dispute the charges with Google.

Verifying fraud with behavioral signals

Basic metrics like bounce rate and session duration are easily spoofed. Reliable verification requires behavioral biometrics that bots struggle to replicate. Key signals include: ghost clicks — click activity without the natural sequence of human intent; trap behavior — interactions with hidden honeypot elements that real users never see; pointer behavior — robotic linear mouse movements, absence of humanlike micro‑tremor, and grid‑aligned movement patterns; speed behavior — superhuman input speeds under 1 ms; engagement behavior — sessions with no scrolling, no field corrections, or no clicks beyond the landing page; session behavior — unnaturally short, long, or uniform visit lengths S2. These signals are captured in real time during the session, not after the fact, because delayed analysis means your bidding algorithms have already optimized toward the fraudulent traffic S7.

Building the evidence chain for refunds

Google requires clear proof that a click was non‑human. A refund‑ready evidence package must link each suspicious click to behavioral proof. Collect the following for every disputed click: the GCLID linked to the click; timestamp and IP address; behavioral metrics (click speed, mouse path, session duration, scroll depth, form interactions); honeypot trigger logs if available; and a session replay screenshot or video showing the anomalous behavior. Package these into a concise report and submit through Google's invalid click dispute form. BotRefund's aggregated data shows an 83% refund success rate for high‑volume advertisers when evidence is properly structured S2. Refunds can be recovered for Google Ads spend dating back to 2017 S2.

Manual vs automated detection: trade‑offs

Manual analysis works for small accounts with limited budgets. You export click reports, segment in spreadsheets, and cross‑reference analytics. This approach is free but time‑consuming, does not scale, and cannot catch bots that mimic human behavior in real time. Automated detection tools capture GCLIDs, analyze mouse movement, and protect conversion pixels continuously. They flag fraudulent clicks during the session, preventing pixel poisoning and feeding clean data to Smart Bidding S7. The trade‑off is cost: enterprise‑grade behavioral detection typically requires a subscription, though many providers offer a free audit to assess risk S2. Tools relying solely on IP blacklists or rate limiting miss modern bot networks that use rotating residential proxies and browser automation S7.

Tools and techniques

Effective click fraud protection in 2026 requires three core capabilities. Behavioral detection: the only reliable way to catch sophisticated bots using rotating residential proxies and browser automation S7. Conversion pixel protection: prevents invalid sessions from triggering your Google Ads conversion tracking, stopping Smart Bidding from optimizing toward bot traffic S7. GCLID evidence capture: links each click to behavioral proof, generating audit‑ready refund dispute reports S7. Real‑time filtering must happen during the session, not after the fact, because delayed analysis means your algorithms have already learned from fraudulent data S7.

Limitations and when to seek help

Even the best filters can miss sophisticated bots that mimic human behavior. Google's automated filters catch less than 50% of invalid traffic S1. Behavioral detection reduces but cannot eliminate false negatives — some advanced bots replicate mouse tremor, scroll patterns, and realistic session durations. If you see persistent anomalies after applying the steps above, consider a dedicated fraud‑detection service that offers real‑time behavioral verification and managed refund disputes. Also note that not all low‑quality traffic is competitor fraud; some comes from accidental clicks, scrapers, or low‑intent users. Treating every unresponsive contact as fraud can make you exclude valuable audiences S6.

FAQ

• Can I stop all competitor click fraud? No, but you can dramatically reduce its impact with monitoring and evidence‑based disputes.
• How often should I audit my clicks? At least monthly, or after any major budget change.
• Does Google automatically refund invalid clicks? Google filters many bots, but it catches less than 50% of sophisticated traffic, so manual disputes are often needed S1.
• What cost is associated with a detection tool? Prices vary; many providers offer a free audit to assess your risk S2.
• How does click fraud affect my bidding strategy? Bot clicks that trigger conversion pixels poison Smart Bidding, causing it to optimize for bot traffic and increase waste over time S7.
• What is the typical refund success rate? High‑volume advertisers see an 83% refund success rate when submitting properly structured behavioral evidence S2.
• Can I recover spend from past years? Yes, refunds can be recovered for Google Ads spend dating back to 2017 S2.

Key facts

Direct answer: what Playwright and Selenium traffic looks like

Playwright and Selenium are browser automation frameworks. They drive a real browser, so the traffic comes from a genuine Chrome, Firefox, or WebKit process. That makes it harder to spot than a simple script using raw HTTP requests. But automation leaves traces.

The most reliable way to identify this traffic is to look for a cluster of signals, not one flag. A single property like navigator.webdriver can be spoofed or hidden by stealth plugins. A combination of browser, network, hardware, and behavior signals is much harder to fake consistently.

Step 1: Check for the WebDriver flag

Both Playwright and Selenium set navigator.webdriver to true by default. This is the fastest first check.

• In JavaScript on your page, run navigator.webdriver.
• If it returns true, the browser is under automation control.
• If it returns false or undefined, do not stop. Stealth plugins and patched drivers remove this flag.

Treat this as a tripwire, not a verdict. Many legitimate accessibility tools also set this flag, so combine it with other checks before blocking traffic.

Step 2: Look for CDP debugger leaks

Playwright and Selenium both use the Chrome DevTools Protocol (CDP) to control the browser. This leaves detectable traces.

• Check for window.chrome properties that are missing or altered.
• Look for Runtime.enable or Page.enable CDP commands in the browser's debugger state.
• Inspect navigator.plugins and navigator.languages for inconsistencies with the claimed user agent.

Bot detection services like BotRefund specifically check for "CDP Debugger Leak" as one of their 106 signals. A real user's browser does not expose an active debugging session.

Step 3: Inspect browser property consistency

Automation frameworks often fail to keep every browser property consistent with the claimed environment.

• Compare navigator.userAgent with navigator.platform and navigator.language.
• Check the Accept-Language header against the browser's configured languages.
• Verify the timezone reported by JavaScript matches the IP geolocation.
• Look for mismatches between the JavaScript engine version and the claimed browser version.

BotRefund's detection vectors include "HTTP User-Agent Mismatch," "Accept-Language Mismatch," "Timezone Evasion," and "JS Engine Mismatch." These are exactly the inconsistencies that Playwright and Selenium sessions often produce when configured hastily.

Step 4: Analyze behavioral signals

Even a well-configured automation session behaves differently from a human.

• Mouse movement: Playwright and Selenium scripts often move the pointer in straight lines or grid-aligned paths. Humans produce curved, jittery movement.
• Input speed: Automated clicks and keystrokes can happen in under 1 millisecond. A human cannot do that.
• Session duration: Bots often have unnaturally short or perfectly uniform session lengths.
• Engagement: Automated sessions may show no scrolling, no field corrections, and no meaningful page interaction.

BotRefund flags "Robotic linear mouse movements," "Superhuman input speed (<1ms)," "Grid-aligned movement patterns," and "Unnatural session durations." These behavioral patterns are common in Playwright and Selenium traffic because scripts execute actions without human hesitation.

Step 5: Check network and hardware fingerprints

Automation traffic often comes from datacenter IPs, VPNs, or residential proxies that do not match the claimed browser environment.

• Check for WebRTC leaks that reveal a different IP than the HTTP request.
• Look for DNS tunnel leaks where DNS and web traffic take different routes.
• Verify the OS and TCP TTL values match the claimed operating system.
• Check for suspicious ports or IP address inconsistencies.

BotRefund's network vectors include "WebRTC Network Leak," "DNS Tunnel Leak," "OS / TCP TTL Mismatch," and "IP Address Inconsistency." Playwright and Selenium sessions routed through proxies frequently trip these checks.

Step 6: Combine signals into a decision

No single signal is conclusive. A real user might have a VPN. A stealth-configured Playwright script might hide navigator.webdriver. The key is to evaluate the full pattern.

1. Collect all available signals for each session.
2. Score each signal for how strongly it indicates automation.
3. Look for clusters: three or more weak signals together are stronger than one strong signal.
4. Use a prediction model or rule engine to classify the session as human or automated.

BotRefund's approach is exactly this: "BotRefund's prediction AI sees how 106 browser, network, hardware, and behavior signals fit together before deciding whether a visit is human or automated." A single suspicious property is not enough; the full pattern matters.

Common mistake: relying on one flag

The most common mistake is blocking traffic based on navigator.webdriver alone. Modern Playwright and Selenium setups use stealth plugins that remove this flag. If you only check one property, you will miss sophisticated automation and may block legitimate users who use accessibility tools.

Instead, collect multiple signals and evaluate them together. This reduces false positives and catches more automation.

How to verify your detection works

Test your detection against known automation traffic.

1. Write a simple Playwright script that visits your page.
2. Write a simple Selenium script that visits your page.
3. Run both scripts and check whether your detection flags them.
4. Run a normal human browsing session and check that it is not flagged.

If your detection misses the automation scripts, add more signals. If it flags the human session, tune your thresholds. BotRefund offers a free bot audit that runs a live check on your site, which is a practical way to validate your setup.

Key facts

Limitations and when this advice does not apply

This guidance assumes you control the web page or application receiving the traffic. If you are analyzing server logs from a third-party platform, you may not have access to browser-side signals.

Some legitimate users run browsers with automation-like properties. Accessibility tools, enterprise security software, and remote desktop sessions can trigger false positives. Always allow human review or an appeal path before blocking traffic outright.

Detection is an arms race. Playwright and Selenium maintainers and stealth plugin authors continuously update their tools to evade detection. Your detection logic needs regular updates to stay effective.

FAQ

Can I identify Playwright traffic specifically versus Selenium?

Not reliably from a single signal. Both frameworks use the same underlying browser automation protocols. You can sometimes distinguish them by specific CDP command patterns or default configuration differences, but stealth plugins blur these lines. Focus on identifying automation in general rather than the specific framework.

What is the fastest way to check for automation traffic?

Run navigator.webdriver in the browser console. If it returns true, the browser is under automation control. However, this is only a first check; stealth plugins can hide it.

Do Playwright and Selenium always set navigator.webdriver to true?

By default, yes. But both frameworks allow you to disable this flag, and many stealth plugins do so automatically. Do not rely on it as your only detection method.

Can I block Playwright and Selenium traffic without affecting real users?

Yes, if you use a combination of signals and set conservative thresholds. Blocking based on one flag will cause false positives. A multi-signal approach with human review for borderline cases is safer.

What should I do after identifying automation traffic?

Decide based on your context. For ad traffic, you may want to exclude it from conversion tracking and file a refund claim. For a web application, you may want to block or challenge the session. For analytics, you may want to filter it out of your reports.

How often should I update my detection logic?

Regularly. Automation tools and stealth plugins update frequently. Review your detection signals at least quarterly, and test against the latest Playwright and Selenium versions.

Uniform click paths are sequences where every session follows the exact same series of clicks, indicating automated or bot behavior.

Definition and Scope

A click path (also called a clickstream) is the ordered list of pages or elements a visitor clicks during a session. When that list is exactly the same for many sessions, we call it a uniform click path. Uniformity alone does not prove fraud, but combined with other signals it strongly suggests non‑human activity.

Click paths can be captured at different granularities: page-level (URLs), element-level (button IDs, link classes), or event-level (custom analytics events). Page-level paths are easiest to collect from standard analytics platforms like Google Analytics 4 (GA4) or Meta Ads Manager. Element-level paths require client‑side instrumentation such as a JavaScript listener that records every click target. The choice of granularity affects detection sensitivity. Page‑level uniformity may miss bots that randomize sub‑page actions, while element‑level data can reveal identical interaction sequences even when page URLs differ slightly.

Scope also includes the time window. A uniform path observed over a few hours may indicate a burst of bot traffic from a single campaign. A pattern persisting across days suggests a persistent script or scraper. Analysts should segment by traffic source, device type, and geographic region to avoid conflating legitimate funnel steps (e.g., a linear checkout flow) with malicious uniformity.

Why Uniform Click Paths Matter

Uniform paths can inflate ad spend, poison conversion data, and hide the true performance of your campaigns. If you ignore them, you may keep optimizing on misleading metrics, wasting budget on traffic that never converts.

When bots follow identical click sequences, they generate fake clicks that cost money in pay‑per‑click models. They also trigger conversion pixels without real intent, corrupting the training data for bidding algorithms. This leads to higher cost‑per‑acquisition and lower return on ad spend. In lead‑generation campaigns, uniform paths often accompany form submissions with disposable emails or disconnected phones, wasting sales team effort. According to BotRefund research, bot clicks can steal up to 20% of Google and Meta ad budgets (source S2). Detecting uniform paths early lets you block offending IPs, adjust targeting, or file refund claims with ad platforms.

Detectable Signals

BotRefund’s research highlights several signals that often appear together with uniform click paths:

• No scrolling or mouse movement ("Absence of clicks or scrolling").
• No field corrections or repeated form edits.
• Identical, rapid form completions.
• Grid‑aligned or straight‑line mouse movements ("Path behavior").

Additional signals from BotRefund’s 106‑check suite include superhuman input speed (under 1 ms), absence of human‑like mouse tremor, and scrollbar width leaks that reveal automated browsers (source S4). These signals are independent; a single anomaly is not a verdict. BotRefund’s AI model cross‑checks them across browser, network, device, and behavior layers to reach 99% accuracy (source S4, S7). When uniform click paths co‑occur with multiple behavioral anomalies, confidence in bot classification rises sharply.

Step‑by‑Step Identification Process

1. Collect raw session data. Export click logs from your analytics platform (Google Analytics, Meta Ads Manager, etc.) that include timestamps, page URLs, and element IDs. In GA4, use the Exploration report with "Event name = click" and dimensions "Page path", "Event parameter: element_id", "Session ID". Export to BigQuery for large‑scale analysis.
2. Normalize the data. Strip query strings, session IDs, and any dynamic parameters that differ per user but do not affect navigation. Keep UTM parameters only if you need to attribute by campaign; otherwise remove them to avoid false uniformity. Also normalize case, trailing slashes, and URL encoding.
3. Build click‑path strings. Concatenate the ordered list of page identifiers for each session, e.g., home > product > checkout. For element‑level paths, use a delimiter like "|" between element IDs. Example BigQuery snippet:

   WITH clicks AS (
     SELECT
       session_id,
       ARRAY_AGG(page_path ORDER BY event_timestamp) AS path_array
     FROM `project.dataset.ga4_events`
     WHERE event_name = 'click'
     GROUP BY session_id
   )
   SELECT
     session_id,
     ARRAY_TO_STRING(path_array, ' > ') AS click_path_string
   FROM clicks;

4. Group identical strings. Count how many sessions share the exact same string. A high count (e.g., >5% of total sessions) flags a uniform path. Adjust threshold based on traffic volume; for low‑traffic sites, even 10 identical paths may be significant.
5. Cross‑check supporting signals. For the flagged group, examine scrolling depth, mouse‑move logs, and form‑field events. Uniform paths often lack these human‑like actions. Join with client‑side behavioral logs (e.g., BotRefund script) that capture scroll depth, mouse tremor, and input speed.
6. Score the sessions. Assign a risk score based on uniformity plus supporting signals. Use a rubric:

   Factor	Weight	Threshold
   Path uniformity (sessions sharing path / total sessions)	30%	>5%
   Zero scroll depth	20%	True
   No field corrections	15%	True
   Identical time-on-page (std dev < 1s)	15%	True
   Grid‑aligned mouse movement	10%	True
   Superhuman input speed	10%	True

   Sum weighted scores; sessions above 0.7 are high risk. BotRefund’s AI model can ingest these scores for an automated verdict.

Mini‑case: Normalization pitfall. A retailer stripped all query parameters, including product IDs, causing distinct product detail pages to collapse into a single "product" token. This made 2,000 legitimate sessions appear as one uniform path. The fix: preserve path‑defining parameters (e.g., product SKU) while removing session‑specific tokens (e.g., `session_id`, `fbclid`). Always audit a sample of normalized paths against raw URLs before grouping.

Common Mistakes to Avoid

• Removing too much data. Over‑normalizing (e.g., deleting all query parameters) can make distinct sessions appear identical. Example: stripping UTM parameters is safe, but removing product IDs merges different product views.
• Relying on a single signal. Uniform paths without scrolling anomalies may still be legitimate; always use a multi‑signal approach.
• Ignoring volume thresholds. A single identical path is normal; look for patterns across dozens or hundreds of sessions.
• Over‑normalizing UTM parameters. If you keep UTM source/medium but drop campaign/content, sessions from the same ad set but different creatives may falsely unify. Keep at least source and medium for attribution.
• Ignoring single‑page sessions. Bots often land on a page and trigger a conversion event without any clicks. These sessions have empty click paths and are missed by path‑only analysis. Include event‑only sessions in your audit.

Verifying Your Findings

After you flag a set of uniform paths, run a quick verification:

1. Sample a few sessions in a replay tool (e.g., Chrome DevTools or a session‑recording product) to see actual mouse movement.
2. Check server logs for IP diversity. Bots often use data‑center IP ranges.
3. Compare conversion outcomes. Uniform paths usually have zero or very low conversion rates.

If the sample confirms non‑human traits, you can proceed to block the traffic or submit a refund claim.

Note on session‑replay sampling bias. Replay tools often sample a subset of sessions (e.g., 10% of traffic). If bot traffic is high volume, the sample may under‑represent bots, leading to false confidence. Always verify with full‑population logs (BigQuery, server access logs) before concluding.

FAQ

• What if a legitimate A/B test creates similar paths? A/B tests are usually limited to a small percentage of traffic and still show natural scrolling and timing variations.
• Can I automate detection? Yes. BotRefund provides a client‑side script that logs click sequences and feeds them into its AI model for real‑time alerts.
• How often should I audit click paths? Perform a baseline audit monthly, and run quick spot checks after major campaign changes.
• Does uniform click‑path detection work on mobile? Absolutely. Mobile sessions also generate click‑path logs; look for the same lack of scrolling or rapid taps.
• How do single‑page applications (SPAs) affect false positives? SPAs often trigger virtual pageviews without full reloads, creating identical path strings for legitimate users navigating the same route. Mitigate by including element‑level clicks (button IDs, route changes) and checking for scroll/interaction signals.
• How should I handle consent‑mode gaps where behavioral data is missing? When users reject analytics cookies, GA4 may not record click events. Use server‑side logs (with hashed IPs) to reconstruct minimal paths, and rely on BotRefund’s cookieless behavioral signals (mouse tremor, input speed) that work without consent.

Start by instrumenting your site to collect browser fingerprint data, network connection details, device characteristics, and behavioral signals like mouse movement, click timing, and scroll patterns. Feed every signal into a scoring engine that weighs the full pattern rather than triggering on one anomaly. Cross-check each signal against the others — a mismatched timezone and language, or a headless browser signature paired with superhuman click speed, carries more weight than either alone. Finally, verify the system by running a controlled test with known bots and real users, then tune thresholds to keep false positives below your tolerance.

What reliable bot detection actually means

Reliable detection is not a single script that blocks "bad" user agents. It is a pipeline that gathers dozens of independent observations, checks them for internal consistency, and scores the overall likelihood of automation. A single signal — like a missing navigator.webdriver flag — can be spoofed or appear on a privacy-hardened browser. When you combine 100-plus signals across browser APIs, network routing, device sensors, and interaction patterns, the probability of a false positive drops sharply. BotRefund's approach treats every signal as evidence, not a verdict, and lets an AI model weigh the complete picture.

Core detection layers that work together

Four evidence layers feed the decision engine. Each layer contains multiple checks that can be implemented independently.

• Browser layer: Checks for automation framework artifacts (Playwright, Puppeteer, Selenium), inconsistent API implementations, JavaScript engine mismatches, and canvas/WebGL fingerprint anomalies.
• Network layer: Validates IP reputation, proxy/VPN exit nodes, suspicious port usage, TLS fingerprint consistency, and geolocation-to-timezone alignment.
• Device layer: Collects screen resolution, color depth, battery status, hardware concurrency, touch support, and sensor data (gyroscope, accelerometer) where available.
• Behavior layer: Records mouse trajectories, click intervals, scroll velocity, form completion speed, focus/blur sequences, and session duration distributions.

Each layer produces independent signals. The browser layer might flag a Playwright init script artifact. The network layer might detect a data-center IP on a residential ISP range. The behavior layer might see sub-millisecond form fills. Alone, each is noisy. Together, they form a coherent story.

Step-by-step implementation framework

1. Instrument the client side. Deploy a lightweight script that runs on every page load and captures the four evidence layers. Use requestIdleCallback or a web worker to avoid blocking the main thread.
2. Normalize and hash signals. Convert raw observations into stable feature vectors. Hash canvas fingerprints, serialize navigator properties, encode mouse paths as compressed coordinate arrays.
3. Send to a scoring service. Post the feature vector to your backend or a third-party API. Include a session ID and timestamp for replay and audit.
4. Cross-check signals server-side. Compare the client-reported IP geolocation against the timezone offset. Verify the user agent string matches the observed browser APIs. Check that touch events align with reported touch support.
5. Apply a weighted model. Use a gradient-boosted tree or neural net trained on labeled bot/human traffic. Weight features by their historical predictive power. Output a probability score, not a binary block/allow.
6. Enforce with graduated response. Low scores: log and monitor. Medium scores: challenge with a lightweight proof-of-work or behavioral CAPTCHA. High scores: block and feed the session into a retraining loop.
7. Close the feedback loop. Track downstream outcomes — chargebacks, spam complaints, conversion quality — and relabel sessions. Retrain monthly.

Common signal categories and what they catch

Key facts from BotRefund's detection architecture

Trade-offs: build vs. buy vs. hybrid

Choose custom build if you have a dedicated ML team and face novel automation techniques not covered by commercial feeds. Choose managed service if your primary pain is ad spend waste and you need refund-grade evidence quickly. Choose open-source if you need on-premise deployment and can invest in signal curation. Choose hybrid if you already have a scoring pipeline and want to augment it with a maintained signal feed.

Practical scenarios where detection succeeds or fails

Scenario: Click farm draining search ad budget

Bots click search ads, land on a landing page, and bounce instantly. Behavior layer catches zero scroll, zero mouse movement, sub-second dwell. Network layer shows data-center IPs. Browser layer reveals headless Chrome signatures. Score hits 0.98. Block and submit refund claim with session replay video.

Scenario: Sophisticated credential stuffing

Attackers use residential proxies, real Chrome via Puppeteer with stealth plugins, human-like mouse curves, and randomized delays. Individual signals look clean. Cross-check reveals timezone offset mismatches IP geolocation in 12% of requests. TLS fingerprint matches a known automation library. Combined score reaches 0.73 — challenge with proof-of-work, log for review.

Scenario: Privacy-conscious real user flagged

User runs hardened Firefox with privacy.resistFingerprinting, Tor exit node, no mouse movement (keyboard-only navigation). Browser layer shows anomalies. Network layer shows Tor. Behavior layer shows no mouse. Without cross-check context, score hits 0.85. With context: known privacy tool fingerprint, consistent keyboard navigation pattern, no automation framework artifacts. Score drops to 0.12. Allow.

Limitations and when this advice does not apply

• Client-side only: If you cannot run JavaScript (AMP pages, email clients, API endpoints), browser and behavior layers are unavailable. Rely on network and server-side heuristics only.
• Encrypted traffic inspection: TLS 1.3 with encrypted ClientHello hides JA3 fingerprints. Network layer loses a strong signal.
• Mobile apps: No mouse, different sensor stack, app attestation APIs replace browser fingerprinting. Requires separate SDK integration.
• Regulatory constraints: GDPR, CCPA, or sector rules may limit fingerprinting, IP storage, or behavioral profiling. Build consent and anonymization into the pipeline.
• Low-traffic sites: Training a custom model needs labeled volume. Below ~10k sessions/month, a managed service with pre-trained models is more practical.

FAQ

How many signals do I actually need?

Start with 15-20 high-signal checks across all four layers. Add more as you measure false-positive rates. BotRefund uses 106; most teams see diminishing returns after 30 well-chosen signals.

Can I detect bots without JavaScript?

Partially. Server-side headers, TLS fingerprints, IP reputation, and request timing give a baseline. But you lose browser fingerprinting, behavior, and device signals — the layers that catch sophisticated automation.

What false-positive rate should I target?

Under 0.1% for blocking actions. Higher is acceptable for challenge or log-only modes. Measure by sampling challenged sessions and manually verifying humanity.

How often do detection signals rot?

Browser automation frameworks update weekly. Browser APIs change quarterly. Plan to refresh at least 20% of your signal library every 90 days, or use a vendor that does this for you.

Does bot detection hurt Core Web Vitals?

A well-written script adds <5ms to main-thread time and <2KB gzipped. Load asynchronously, defer initialization, and use requestIdleCallback. Test with Lighthouse before and after.

Can I use the same system for ad fraud and account takeover?

Yes, but the signal weights differ. Ad fraud prioritizes click behavior and landing-page engagement. Account takeover prioritizes login velocity, credential stuffing patterns, and device continuity. Share the signal pipeline; run separate scoring models.

What evidence do ad platforms accept for refunds?

Google and Meta require timestamped session replays, IP logs, browser fingerprints, and a clear automation narrative. BotRefund packages these into dispute-ready reports. Self-built systems must produce equivalent documentation.

Terminology quick reference

• Headless browser: Browser running without a visible UI, typically controlled by automation scripts.
• Fingerprinting: Collecting browser/device attributes to create a stable identifier.
• JA3/JA3S: TLS client/server fingerprint hashes used to identify software stacks.
• Residential proxy: Proxy exit node on a consumer ISP IP range, harder to block than data-center IPs.
• Proof-of-work challenge: Computational puzzle that slows automated requests but is trivial for humans.
• Stealth plugin: Browser extension or script that masks automation artifacts (e.g., puppeteer-extra-plugin-stealth).

Learn more about this service

See how this page can help with your next step.

Learn more

How to Maintain Data Accuracy with Bot Filtering

What Is Percent of Leads Contacted?

The percent of leads contacted shows how many of your total leads your team has reached at least once.

It is calculated by dividing contacted leads by total leads and multiplying by 100.

This metric tracks outreach coverage, not conversion.

Knowing this number helps you spot gaps in your follow‑up process.

If the rate is low, some leads never get a touchpoint, which can lose revenue.

If the rate is high, you know your team is reaching most leads.

The metric works for inbound and outbound leads alike.

You can measure it for a single campaign, a quarter, or your entire database.

It is a simple health check for your sales engine.

Teams often pair this metric with lead response rate and conversion rate.

Together they reveal whether you are reaching leads and whether those leads are moving toward a sale.

A stable or improving percent of leads contacted indicates your outreach process is reliable.

A sudden drop may signal data problems, changes in lead source, or reduced rep capacity.

How Invalid or Bot Leads Skew the Metric

Invalid leads include fake emails, bot‑filled forms, or disconnected numbers.

They increase your total lead count but never receive real outreach.

When you divide contacted leads by this inflated total, the percent looks lower than reality.

Your team may think outreach is weak when the problem is bad data.

If your team mistakenly marks a bot lead as contacted without a real touch, the metric can look artificially high.

This hides missed opportunities and wastes sales time.

BotRefund detects bots with 99% accuracy by analyzing browser behavior such as input speed, pointer movement, and page engagement (S4).

It flags leads that show superhuman typing, lack of mouse jitter, or other non‑human signals.

Removing these flagged leads before calculation gives a cleaner denominator.

Your percent of leads contacted then reflects genuine outreach effort.

Cleaner data also improves downstream metrics like response rate and conversion rate.

Your sales team focuses on real prospects.

Step‑by‑Step Calculation Process

1. Pull total leads for the period from your CRM.
2. Exclude duplicates, existing customers, and any leads you have already flagged as invalid.
3. Define what counts as a contact for your team.
4. Common definitions include a sent email, a connected phone call, a LinkedIn message, or a completed demo request.
5. Write this definition down and share it with everyone.
6. Count the leads that received at least one qualifying touchpoint during the same period.
7. Use your outreach tool to extract a list of contacted leads.
8. Make sure the timeframe for total leads and contacted leads matches exactly.
9. If you measure total leads for January but contacted leads for February, the result will be wrong.
10. Divide the contacted leads count by the total leads count.
11. Multiply the result by 100 to get the percentage.
12. Segment the result by lead source, sales rep, or campaign.
13. This shows where outreach works and where gaps exist.
14. Verify a random sample of leads marked “not contacted.”
15. Check your outreach logs to confirm none received a touchpoint.
16. Adjust counts if you find misclassifications.
17. Recalculate after fixing any errors.
18. Repeat the process each reporting period to keep the metric reliable.

Common Mistakes and Data Quality Issues

• Counting partial outreach as a contact when your definition requires a connected call.
• For example, counting a sent email only inflates the numerator incorrectly.
• Including invalid or duplicate leads in the total count.
• A fake email address or a duplicate entry raises the denominator, making the contact rate look lower than it truly is.
• Measuring total leads and contacted leads in different windows.
• If you pull total leads for Q1 but contacted leads for the first two months of Q1, the ratio is skewed.
• Ignoring lead quality.
• A high contact rate can still mean you are reaching low‑intent leads that never buy.
• Pair this metric with qualification and conversion rates.
• Failing to remove bot leads before calculation.
• Bot leads inflate the denominator and can also be incorrectly counted as contacted, distorting both sides of the fraction.
• Not training the team on the contact definition.
• Inconsistent application leads to noisy data over time.
• Overlooking data sync issues between CRM and outreach tool.
• If a call is logged in the dialer but not pushed to the CRM, the lead appears as not contacted.
• Relying on manual spreadsheets for large volumes.
• Manual entry errors increase as lead counts grow, reducing trust in the metric.

Using BotRefund to Clean Lead Data and Recover Wasted Spend

BotRefund runs client‑side behavioral audits that spot automated form submissions with 99% accuracy (S4).

It evaluates signals such as typing speed, mouse movement, and page engagement to distinguish humans from bots.

When a lead is flagged as a bot, BotRefund supplies evidence you can use to suppress that lead in your CRM.

Removing bot leads gives a cleaner total lead count and a more accurate percent of leads contacted.

The service also helps you claim refunds for invalid ad clicks.

BotRefund’s reports show an 83% approval rate when submitted to Google or Meta (S2).

This means most valid claims are reimbursed.

In the FinTrust case study, BotRefund recovered $140,000 of wasted ad spend from fake leads (S6).

The neobank suppressed bot registrations, improved lead quality, and saw a higher conversion rate from genuine prospects.

Integrating BotRefund’s audit trail into your CRM can be done with a simple JavaScript snippet.

Once installed, the tool runs in real time and tags each new lead as human or bot.

With bot leads removed, your sales team spends less time on dead ends.

Your percent of leads contacted becomes a truer reflection of outreach effectiveness.

Regularly review BotRefund reports to adjust your lead capture forms.

Adding validation steps such as CAPTCHA or real‑time email verification further reduces fake entries.

Combining clean lead data with BotRefund’s refund recovery improves both marketing ROI and sales efficiency.

You get better metrics and money back from wasted ad spend.

Limitations, Best Practices, and FAQ

The percent of leads contacted only measures whether you reached a lead, not whether the lead responded or bought.

A 100% contact rate is useless if none of those leads engage further.

Pair this metric with lead response rate and conversion rate to see the full funnel.

Use segmentation to understand which sources need better follow‑up or lead nurturing.

Keep your lead definition consistent over time.

Changes in what counts as a contact will break trend analysis unless you back‑fill data.

Run regular BotRefund audits to keep your lead list free of automated traffic.

Schedule audits weekly for high‑volume campaigns or monthly for steadier flows.

Train your sales and marketing teams on the contact definition and on how to interpret the metric.

Clear communication reduces counting errors.

Use the metric as a diagnostic tool, not a performance target alone.

Combine it with qualitative feedback from call recordings or email reply rates.

What is the difference between percent of leads contacted and lead response rate?

Percent of leads contacted measures how many leads you reached out to.

Lead response rate measures how many of those leads replied or took a desired action after being contacted.

You need both metrics to see outreach effectiveness.

How often should I measure this metric?

Most teams measure it weekly or monthly, depending on sales cycle length.

Fast B2C cycles benefit from weekly checks; longer B2B cycles often use monthly or quarterly reporting.

What is a good target for my team?

Many B2B teams aim for a 70‑90% contact rate within 30 days of lead capture.

Your target depends on lead volume, team size, and lead quality.

Adjust the goal as you learn what works for your process.

Does this metric apply to inbound and outbound leads equally?

Yes, but measure them separately.

Inbound leads usually have higher contact rates because they have shown interest.

Outbound leads often have lower rates, so separate targets prevent unfair evaluations.

Can I measure it without a CRM?

Yes, you can use a spreadsheet for small teams with fewer than 500 leads.

For larger teams, a CRM automates data sync and reduces manual errors.

What should I do if my percent is low?

First, check for invalid or bot leads inflating your total.

Second, verify that your sales team follows the contact definition and follows up quickly.

Third, consider reducing lead volume per rep or adding lead validation tools at capture.

How the migration works

BotRefund is built to audit every affiliate conversion before you pay a commission. To get your historical payouts into that same reporting view, you upload a CSV file that lists each payout with its network, date, amount, and status. BotRefund then matches those rows against the conversion data it has already collected from your tracking script. The result is a unified payout report that shows both your history and your current cycle in one place.

This process does not require you to rebuild your tracking or manually re-enter years of records. The CSV import is the fastest path, and it works even if your data is spread across multiple affiliate networks or platforms.

Why unified payout reporting matters

If you manage affiliate payouts across several networks, you likely get separate reports from each platform. You have to merge them by hand, which is time-consuming and error-prone. You might miss duplicate commissions, refunds, or fraudulent conversions that appear only when you compare networks side by side.

Unified reporting gives you a single view of all payouts. You can see which affiliates are generating clean revenue and which ones are costing you money. You also get a complete audit trail, which helps when you need to justify a rejected commission or when you want to negotiate better terms with a network. BotRefund's report combines your historical payouts with the audit scores for each conversion, so you know exactly which payouts are safe to release.

Prerequisites before you start

• Export payout history from each affiliate network or platform you use. Look for options like "export commissions", "payout history", or "transaction log".
• Standardize the file format to CSV. Combine multiple files into one if needed, and add a column that identifies the network or source.
• Make sure your tracking script is installed on your site. BotRefund reads UTM parameters and click IDs from your traffic to match payouts to the right conversions.
• Confirm you have the required columns at minimum: network/affiliate identifier, payout date, amount, and status (e.g., approved, paid, rejected, refunded).

Step-by-step migration process

Step 1: Export your payout history

Go to each affiliate network or payment system and export the payout records. Include as much detail as you can: affiliate ID, payout amount, date, currency, and any status fields. CSV is the preferred format.

If your network does not offer CSV export, check if you can copy the data from a table or use an API. If your history is only in PDFs, you will need to convert those to a digital format, for example by using a spreadsheet tool that can import PDF tables.

Step 2: Clean and standardize the data

Check that all rows have a consistent date format, a positive or negative amount, and a clear status. If you have refunds or rejected commissions, make sure those are marked. Remove duplicate rows if you see them.

Decide on a single date format, such as YYYY-MM-DD. If your amounts are in different currencies, add a currency column and keep it consistent per row. For status, use standard values like "approved", "paid", "rejected", "refunded". Do not mix synonyms like "approved" and "cleared" unless you map them to a standard list.

Step 3: Build and check your CSV structure

A well-structured CSV makes the import much smoother. At a minimum, include these columns:

Here are two example rows:

network,payout_date,amount,currency,status,affiliate_id,click_id
Impact,2024-01-15,150.00,USD,paid,aff_12345,clk_abc123
CJ,2024-01-20,-20.00,USD,refunded,aff_67890,

Note that the refunded row has a negative amount and no click_id. That is fine; BotRefund will still carry the status and amount.

Step 4: Upload the CSV in BotRefund

In your BotRefund dashboard, find the section for payout reconciliation or CSV upload. Select your file. The system will parse it and display a summary of what it found.

Before you upload, double-check that your CSV uses UTF-8 encoding and does not contain extra blank rows. Also make sure the first row is the header. If you have a large file (more than 10,000 rows), you might want to split it into chunks, but BotRefund can handle most files without trouble.

Step 5: Let BotRefund validate and map the data

BotRefund will attempt to match each payout row to a tracked conversion using the UTM and click ID data it has stored. Rows that cannot be matched will be flagged. You can review these and make manual adjustments if needed.

The matching logic works like this: BotRefund looks for a conversion event that has a matching click ID or UTM combination and a timestamp that aligns with the payout date. If a match is found, the payout row is linked to that conversion and receives the audit score that the conversion already has. If no match is found, the row stays unmatched.

Step 6: Review the unified report

Once the mapping is complete, you get a report that combines your historical payouts with the audit scores for each conversion. Each row is tagged as Approve, Review, Hold, or Reject, so you can see which payouts are safe to release.

For historical rows that were matched, the tag comes from the conversion's audit score. For unmatched rows, you will see them in a separate section without a tag. You can still see the total amounts and the network breakdown.

Step 7: Set up ongoing reconciliation

After the initial migration, you can upload a new CSV each payout cycle or connect your affiliate platform directly. This keeps the unified report current without extra manual work.

Most users start with CSV uploads for the first few cycles, then move to a direct integration if they want real-time data. Check with BotRefund support to see which integrations are available for your networks.

Understanding the reconciliation process in detail

Reconciliation is more than just summing numbers. BotRefund compares each payout row against the conversion data it has collected from your tracking script. The goal is to answer two questions: Did this payout actually correspond to a valid conversion? And was that conversion flagged as suspicious?

To make a match, BotRefund looks for a conversion that happened on or around the payout date and that shares the same affiliate identifier or click ID. If your tracking script captured a click ID, that is the strongest signal. If you only have a UTM parameter, BotRefund can use the combination of affiliate ID and timestamp to narrow down the match.

When a match is found, BotRefund pulls the audit score for that conversion. If the score is Approve, you know the payout is clean. If it is Review or Hold, you should investigate before paying. If it is Reject, you can decline the commission with confidence.

If you do not have tracking data for a historical period, the row will remain unmatched. You still see the payout amount, but you lose the per-conversion fraud analysis. That is why it is better to import only data that has corresponding tracking, or to accept that older rows will not have tags.

How BotRefund's scoring tags apply to historical data

BotRefund rates every conversion it tracks with one of four tags: Approve, Review, Hold, or Reject. These tags come from behavioral signals, attribution path analysis, and click-to-conversion timing. When you import historical payouts, the tags are applied to the conversion match.

For example, a payout row that matches a conversion with a clean attribution path and normal behavior gets an Approve tag. A payout that matches a conversion where the attribution path was hijacked in the final seconds gets a Reject tag. If the system is unsure, it flags the row as Review or Hold.

This means you do not have to re-audit each historical payout manually. The tags give you a fast way to prioritize which payouts to release and which ones need a second look. If you have a large history, you can filter the report by tag and handle the Reject rows first.

Keep in mind that tags are only assigned to rows that match a tracked conversion. Unmatched rows have no tag and are listed separately. You can still see the totals, but you lose the audit layer.

Common mistakes to avoid

• Uploading without dates: BotRefund needs a date to match payouts to conversion times. Missing dates will cause rows to be dropped.
• Inconsistent status values: If you mix "paid", "approved", "rejected", "refunded" with different labels, the parser may not recognize them.
• Mixing currencies: If your payouts are in multiple currencies, include a currency column and be consistent per row.
• Uploading too little data: Excluding affiliate IDs or network names makes it nearly impossible to map payouts to the right conversions.
• Ignoring duplicates: Duplicate rows can inflate your totals and cause false matches. Clean them before uploading.

Troubleshooting unmatched rows

After you upload your CSV, some rows may not match any conversion. Here are common reasons and how to fix them.

Missing click ID or UTM data

If your tracking script was not active during the period of the payout, you will not have a click ID to match. The row will appear as unmatched. Solution: leave it as is, or manually assign it to a conversion if you know the affiliate.

Date mismatch

The payout date in your CSV may not match the conversion date. BotRefund looks for conversions around the payout date, but if the dates are far apart (for example, a payout for a conversion from three months ago), the match may fail. Solution: include a conversion date column if you have it, or widen the match window in the settings.

Affiliate ID format differences

If your CSV uses one format for affiliate IDs (e.g., "aff_12345") and your tracking uses another (e.g., "12345"), BotRefund may not recognize them as the same. Solution: standardize the ID format in your CSV before upload.

Currency or status parsing errors

If a row has an unrecognized status or a malformed currency, it will be skipped. Check the error report in the dashboard. Solution: correct the values and re-upload.

Rows that are not conversion-based

Some payouts may be bonus payments, sign-up incentives, or adjustments that have no corresponding conversion. These will never match. Solution: separate them into a different import or label them clearly so you can exclude them from the audit.

How to verify the migration worked

Start by comparing the total payout amount in BotRefund with your own accounting records. The totals should match. Next, spot-check three or four known payouts to confirm the date, amount, and affiliate name are correct. Finally, confirm that any refunds or rejections appear in the report with the right status.

If you notice a discrepancy, check the unmatched rows list and the error log. It is often easier to fix a few rows and re-import than to trace through the whole file.

Key facts about BotRefund's payout reporting

Limitations and when this advice does not apply

BotRefund does not process payments. It only evaluates and recommends which commissions to pay. So the migration does not touch money movement; it just brings your data into a single reporting view.

If you had no tracking script installed during the period covered by your historical payout data, BotRefund will not have the underlying conversion data to match against. In that case, your imported rows will appear in the report as records without audit scores. You still get the consolidated totals, but you lose the per-conversion fraud analysis for older payouts.

This guide assumes you have access to export data from your networks. If your payout history is stored only in PDFs or printed reports, you will need to convert those to a digital format first.

FAQ

What columns must my CSV have?

At minimum, include a network or affiliate identifier, a payout date, an amount, and a status (approved, paid, rejected, refunded). Adding more fields like currency and click ID improves matching.

Can I connect my affiliate platform instead of uploading CSV?

Yes. BotRefund lets you connect your affiliate platform later for ongoing reconciliation, but CSV is the quickest way to load historical data in bulk.

How long does the migration take?

The upload itself is immediate. Validation and mapping may take longer, especially if you have many rows or need to resolve unmatched entries. BotRefund support can help you through the process.

What if my payout history has no UTMs or click IDs?

You can still import the payout records, but BotRefund will not be able to match them to specific conversions. The report will show the payout totals without the audit details.

Does BotRefund handle refunds during migration?

If your CSV includes a status like "refunded" or "rejected", BotRefund will carry that into the report and flag those commissions appropriately.

What happens to rows that don't match a