How to Detect Ad Fraud from Referral Spam: A Step-by-Step Guide

Referral spam is a type of invalid traffic that shows up in your analytics as a referral source but is actually a bot or scraper. It can drain your ad budget, skew your conversion data, and make your campaigns look worse than they are. The fastest way to detect it is to filter by medium "referral", look for unknown domain names, and use exclusion lists for known spam hosts. But that only scratches the surface. To truly protect your budget, you need to understand the behavioral signals that separate bots from humans.

What referral spam looks like in your analytics

Referral spam appears in your reports as a source/medium pair like spamdomain.com / referral. These visits often have a 100% bounce rate, near-zero session duration, and no pages viewed beyond the landing page. They may also show up in spikes, hitting your site at odd hours or in bursts.

The problem is that these fake referrals can inflate your session count, distort your conversion rate, and even trigger ad platform algorithms to optimize toward the wrong audience. If you run paid campaigns, referral spam can also consume your budget indirectly by poisoning your pixel data.

Step 1: Isolate referral traffic in your analytics tool

Open your analytics platform and create a segment or filter that shows only traffic where the medium equals "referral". In Google Analytics, go to Acquisition → All Traffic → Referrals. In other tools, use a custom report.

This gives you a clean list of every domain that sent you traffic. Sort by number of sessions, bounce rate, and average session duration. Look for domains you don't recognize or that have no obvious relationship to your business.

Step 2: Review referral domains for known spam hosts

Many spam domains are reused across thousands of sites. You can find community-maintained blacklists or use built-in exclusion lists in your analytics tool. Google Analytics has a built-in list of known bots, but it's not exhaustive.

Check each domain against a search engine. If the domain has no real website, no social presence, or is a random string of characters, it's likely spam. Also look for domains that mimic legitimate sites with slight misspellings.

Step 3: Check behavioral signals that separate bots from humans

Bots leave behavioral fingerprints. According to BotRefund's detection methodology, these include:

• Ghost clicks – clicks that happen without a natural sequence of human intent.
• Trap interactions – bots that respond to hidden or deceptive page elements.
• Robotic linear mouse movements – unnaturally straight pointer paths.
• Absence of humanlike mouse tremor – no tiny imperfections or jitter.
• Superhuman input speed – interactions faster than a person could perform.
• Grid-aligned movement patterns – movement that snaps to precise lines.
• Absence of clicks or scrolling – sessions that stay too static.
• Unnatural session durations – visits that are too short, too long, or too uniform.

If you see these patterns in your referral traffic, it's a strong sign of bot activity.

Step 4: Apply exclusion lists and filters

Once you've identified spam domains, add them to your analytics exclusion list. In Google Analytics, go to Admin → View → Filters and create a filter that excludes those domains. You can also use the built-in bot filtering option.

For ad platforms, use negative placements or exclusions. On Google Ads, you can exclude specific placements. On Meta, you can block certain domains from your Audience Network.

Remember: exclusion lists are reactive. They stop the spam from showing up in your reports, but they don't recover the money already wasted.

Step 5: Deploy client-side detection for real-time proof

To catch referral spam before it hits your analytics, you need client-side detection that runs in the browser. Tools like BotRefund add a small script to your site that monitors behavior in real time. It logs every click, mouse movement, scroll, and session duration.

This gives you two things: a live filter that blocks or flags suspicious sessions, and a detailed evidence log you can use to dispute charges with Google or Meta. BotRefund's detection signals include ghost click detection, trap behavior, pointer behavior, motion behavior, speed behavior, path behavior, engagement behavior, and session behavior.

Step 6: Document evidence and request refunds

If you've identified referral spam that clicked on your ads, you can request a refund from the ad platform. Google and Meta both have processes for invalid traffic disputes. You'll need to provide proof that the clicks were automated or fraudulent.

BotRefund helps you build a refund evidence dossier. It captures video proof of each bot click and organizes the data into a case you can submit. According to BotRefund, they recover bot-click refunds from Google Ads spend dating back to 2017.

Key facts about referral spam and bot detection

These figures come from BotRefund's public site. Actual results vary by traffic quality and available evidence.

Limitations: when referral spam detection doesn't apply

Not every bad referral is a bot. Some are real users who clicked a link on a low-quality site. Treating every unresponsive visit as fraud can lead you to exclude valuable audiences.

Also, referral spam is just one type of invalid traffic. Click fraud, affiliate lead fraud, and pixel poisoning require different detection methods. If you only filter referrals, you'll miss bots that come from direct traffic or search ads.

Finally, exclusion lists and analytics filters are reactive. They clean your data after the fact. To prevent wasted spend, you need real-time detection that can block bots before they trigger a conversion event.

FAQ

What is referral spam?

Referral spam is fake traffic that appears in your analytics as a referral source. It's usually generated by bots or scrapers and has no real user intent.

How can I tell if a referral is spam?

Look for unknown domains, high bounce rates, near-zero session duration, and no engagement signals like clicks or scrolling. Also check for spikes in traffic at unusual times.

Can referral spam affect my ad budget?

Yes. If referral spam clicks on your ads, it can drain your budget and skew your conversion data. It can also trigger ad platform algorithms to optimize toward the wrong audience.

What should I do if I find referral spam?

Add the domains to your exclusion list, filter them out of your analytics, and consider deploying client-side detection to catch future bots. If you've already paid for those clicks, file a refund request with the ad platform.

How does BotRefund detect referral spam?

BotRefund uses behavioral signals like ghost clicks, trap interactions, robotic mouse movements, and superhuman input speed. It runs a script on your site that logs every session and flags suspicious activity.

Is referral spam the same as click fraud?

No. Referral spam is a type of invalid traffic that appears in your analytics. Click fraud is a broader category that includes any fraudulent click on an ad, regardless of source.

How long does it take to set up bot detection?

BotRefund says you can add their script to your website in about one minute. No credit card is required for the free audit.