A simple lead disposition process gives sales a clear way to tag each lead as qualified, unqualified, or needing nurture. It starts with defining disposition categories, then training reps to apply them consistently, and finally reviewing the tags to improve targeting.

Follow the steps below to set it up quickly and keep the process lightweight.

What a lead disposition process is

A lead disposition process is a set of labels that sales uses to mark the outcome of each lead interaction. Common labels include "Qualified", "Unqualified – Bad Fit", "Unqualified – No Budget", "Needs Nurture", and "Invalid – Bot or Spam". The goal is to create a shared language between marketing and sales so both teams know which leads are worth pursuing.

Why a simple process matters

When the process is simple, reps spend less time deciding how to tag a lead and more time selling. A simple process also produces clean data that marketing can use to refine targeting and reduce wasted ad spend. If the process is too complex, reps may skip it or apply tags inconsistently, which hurts data quality.

Core steps to build a simple lead disposition process

1. Define three to five disposition categories that cover all possible outcomes.
2. Write a one‑sentence description for each category so reps know when to use it.
3. Add the categories to your CRM as a pick‑list field on the lead record.
4. Run a short training session (15‑20 minutes) showing reps how to pick the right tag after each call or email.
5. Set a weekly review where a manager checks a sample of tagged leads and gives quick feedback.

Prerequisites before you start

• Access to edit lead fields in your CRM.
• A list of recent lead outcomes to inform your category names.
• 10‑15 minutes of a sales manager’s time to lead the training.

How to define each disposition category

Start with a workshop that lists every possible outcome a rep can encounter after a first touch. Group similar outcomes together. For each group write a concise rule: "Qualified – prospect matches ICP, has budget, and agreed to a discovery call." Keep the rule to one sentence. Avoid overlapping definitions; each lead should fit only one category.

Example: tagging a lead from first contact to follow‑up

1. Inbound form submission arrives. 2. Rep reviews the record, sees the prospect is a marketing director at a 200‑person SaaS company. 3. Rep calls, confirms budget and timeline. 4. Rep tags the lead "Qualified" and schedules a discovery call in the CRM. 5. If the prospect says they are only researching, rep tags "Needs Nurture" and adds the lead to a 30‑day email sequence. 6. If the phone number is disconnected, rep tags "Invalid – Bot or Spam" and suppresses the record from future outreach.

How to handle ambiguous leads

When a lead does not clearly fit a category, use a "Pending Review" tag. Assign the lead to a senior rep or manager for a second look within 24 hours. Document the reason for ambiguity in a note field so the team can refine definitions later. This prevents arbitrary tagging and keeps data clean.

What to do with each disposition

Measuring disposition accuracy

After one week, run a report that shows the percentage of leads in each disposition category. If the "Invalid – Bot or Spam" bucket is consistently above 5%, investigate your lead sources for fraud. If the "Qualified" bucket is stable or growing, the process is helping sales focus on real prospects. Track the conversion rate from "Qualified" to opportunity; a drop signals definition drift.

Common pitfalls and how to avoid them

• Too many categories: Keep the list short; more than six options cause hesitation.
• Vague definitions: Write each category in plain language with a concrete example.
• No follow‑up: Schedule a brief weekly check‑in to reinforce correct tagging.

Key facts about BotRefund (source‑pack data)

Using BotRefund to keep leads clean

BotRefund can automatically flag leads that show bot‑like behavior (e.g., super‑human form speed, no mouse movement). By sending those flags to your CRM, you can route suspicious leads to a "Bot or Spam" disposition before a sales rep sees them. This reduces wasted calls and keeps your disposition data accurate. Note that BotRefund works best when you install its client‑side script on all landing pages; it does not replace human review but adds an objective signal.

Limitations of a simple disposition process

A simple process works well when lead volume is moderate and traffic quality is high. It struggles when bot traffic is heavy, when reps disagree on tags, or when CRM data is incomplete. BotRefund’s 99% bot‑detection confidence helps keep invalid leads out of the pipeline before sales tags them. Its 83% client recovery rate shows that most advertisers can reclaim budget lost to bots, and the 20% budget‑loss figure highlights how much revenue can leak without automated filtering. In high‑bot environments, rely on BotRefund’s real‑time flags to pre‑tag leads as "Invalid – Bot or Spam" so the simple disposition list stays focused on genuine sales decisions.

FAQ

How many disposition categories should I use?

Three to five categories cover most B2B funnels. Add a sixth only if a distinct outcome (e.g., "Partner Referral") appears repeatedly.

What if two reps disagree on a tag?

Escalate to a manager for a quick decision, then update the category definition to prevent future conflict.

Can my CRM automate disposition?

Many CRMs allow workflow rules that set a disposition based on field values (e.g., lead score > 80 → Qualified). Use automation for clear‑cut cases; keep human review for edge cases.

How often should the process be reviewed?

Run a weekly spot‑check for the first month, then move to a monthly audit once tagging consistency exceeds 90%.

Does BotRefund replace the disposition process?

No. BotRefund supplies an objective bot‑flag that feeds into the "Invalid – Bot or Spam" category. Human reps still decide on qualified, nurture, or unqualified outcomes.

When two different devices produce the same hardware fingerprint, a binary match-or-block rule creates false positives for legitimate users and false negatives for sophisticated bots. The practical fix is to treat the fingerprint as one evidence layer among many: collect behavioral signals (input timing, pointer dynamics, scroll patterns), network reputation (IP history, proxy indicators, ASN consistency), and session context (page flow, referrer chain, conversion events), then feed the full set into a probabilistic model that weighs each layer against the others. BotRefund implements this by running 110+ independent checks — including WebGL texture constraints, canvas rendering, audio stack, and font enumeration — and cross-referencing every signal against live browser, network, and cursor behavior before scoring a session.

Why fingerprint collisions happen at scale

Device fingerprints compress dozens of hardware and software attributes into a single hash. Browsers update, users rotate devices, corporate images standardize builds, and privacy tools deliberately homogenize outputs. All of these shrink the entropy space, so distinct devices inevitably collide. The Arkose Labs analysis of fingerprinting at scale notes that static hashing produces "one device, dozens of conflicting IDs" and that the traditional approach becomes "increasingly fragile" as browsers and OSes evolve. Castle's documentation similarly highlights that reducing collisions is "of utmost importance for account security" to avoid locking out genuine users.

Collisions are not errors — they are expected when the signal space is smaller than the population. A fingerprint alone cannot distinguish a corporate laptop fleet from a botnet that mimics the same build. The solution is to stop treating the fingerprint as an identity and start treating it as a cluster hypothesis that must be confirmed or rejected by orthogonal evidence.

How BotRefund's multi-signal architecture resolves collisions

BotRefund does not rely on a single fingerprint. It runs 110+ independent checks — hardware and GPU fingerprinting, WebGL texture constraints, canvas rendering, audio context, font enumeration, battery status, and dozens of behavioral telemetry points — then feeds every signal into an edge AI model that evaluates the holistic pattern. As the WebGL Texture Constraint documentation states: "BotRefund feeds this signal into our prediction AI, evaluating the holistic picture across browser integrity, network origin, hardware fingerprints, and user telemetry. By corroborating all factors together, it identifies invalid clicks with 99% precision."

Each check is kept as evidence, not a verdict. The same documentation notes: "A single anomaly is not a bot verdict. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data." This design means a fingerprint collision on one layer (e.g., identical WebGL renderer strings) is automatically weighed against divergent signals on other layers (e.g., different pointer jitter, inconsistent IP reputation, or mismatched behavioral timing).

Step-by-step collision resolution process

1. Collect the raw fingerprint cluster. Hash the standard hardware attributes (GPU, canvas, fonts, audio, WebGL parameters). Group sessions that share the same hash.
2. Layer behavioral telemetry. For each session in the cluster, capture millisecond keypress offsets, pointer jitter, scroll velocity, focus/blur sequences, and DOM interaction order. BotRefund's SaaS funnel protection page describes this as "continuous, DOM-level behavioral telemetry" that "tracks millisecond keypress offsets, pointer jitter, and hardware rendering profiles."
3. Attach network and environmental context. Record IP reputation, ASN, geolocation consistency, proxy/VPN/Tor indicators, TLS fingerprint, and connection timing. The Facebook bot clicks guide lists "Campaign patterns: a sharp lead-quality difference by placement, creative, audience expansion, device, or landing page" as a signal worth investigating.
4. Score the combined pattern probabilistically. Feed the full vector — fingerprint cluster ID, behavioral features, network features, session metadata — into a model that outputs a probability of automation rather than a binary label. The edge model "weighs the complete multi-layer pattern instead of relying on a fragile static rule."
5. Apply tiered actions based on score bands. Low-risk scores pass silently. Medium-risk scores trigger silent pixel suppression (preventing conversion poisoning) and additional challenge. High-risk scores block and queue for refund evidence collection. BotRefund's automated browser detection page notes "Dynamic Meta Pixel & CAPI suppression" as a real-time action.
6. Close the loop with outcome feedback. When refund claims are approved or rejected by Google/Meta (83% approval rate per the homepage), feed the ground truth back into the model to recalibrate score thresholds for that fingerprint cluster.

Key signals that differentiate identical fingerprints

When the hardware hash collides, these orthogonal signals break the tie:

• Input dynamics. Humans exhibit variable keypress intervals, mouse micro-movements, and focus transitions. Headless scripts often populate forms in a single event loop tick. The SaaS funnel guide identifies "Superhuman Input Speed: Bots populate multiple form inputs instantly. A human user requires seconds to type their company details and email."
• Rendering consistency. A device claiming to be an iPhone 15 but producing desktop-class WebGL texture limits or missing mobile GPU extensions reveals spoofing. The WebGL Texture Constraint check "looks for a mismatch that a real browsing session does not normally create."
• Network behavior. Residential proxy botnets route through consumer IPs but often show datacenter-like latency patterns, inconsistent geolocation, or ASN mismatches. The Facebook ad refund guide describes "Residential Proxy Botnets: Malware on regular household computers and phones redirects clicks through normal consumer IP addresses, hiding bot activity within legitimate regional traffic."
• Session flow. Real users navigate, scroll, hesitate, and return. Bots follow direct paths to conversion events. The bot clicks guide flags "Session behavior: no scrolling, no field corrections, uniform click paths, and no meaningful time on the offer page."
• Temporal patterns. Burst arrivals at odd hours, identical inter-arrival intervals, or synchronization across sessions indicate automation. The same guide lists "Timing: several leads arriving in short bursts, forms submitted immediately after landing, or conversions concentrated at unusual hours."

Probabilistic scoring vs binary matching

Binary matching (fingerprint == known_bot_fingerprint → block) fails because collisions make the premise false. Probabilistic scoring asks: given this fingerprint cluster, this behavioral vector, this network context, and this session flow, what is the probability this session is automated? The model learns that certain fingerprint clusters have high baseline collision rates (corporate builds, privacy-hardened browsers) and automatically demands stronger behavioral evidence before flagging. Other clusters are rare in legitimate traffic (headless Chromium signatures) so a single behavioral anomaly suffices.

This approach mirrors the industry shift described by Arkose Labs: moving from "static snapshot" fingerprinting to "understanding devices as dynamic, evolving entities." BotRefund's edge execution (0ms latency per the homepage) makes this scoring feasible in the critical rendering path without delaying page load.

Limitations and when this advice does not apply

• Single-signal systems. If your stack only collects a hardware hash and has no behavioral or network telemetry, probabilistic scoring is impossible. You must either accept collision errors or add instrumentation.
• Privacy-regulated environments. Jurisdictions that restrict client-side telemetry (e.g., strict ePrivacy enforcement) may limit the behavioral signals available for disambiguation. In those cases, server-side fingerprinting (TLS, IP, header order) becomes the primary layer.
• Low-traffic sites. Model calibration requires sufficient volume per fingerprint cluster to learn baseline behavior. Sites with <10k sessions/month may not have enough data to train reliable cluster-specific thresholds.
• Sophisticated adversarial mimicry. Attackers who replay recorded human sessions (replay attacks) can defeat behavioral checks. This requires challenge-response or cryptographic attestation layers beyond fingerprinting.

Key facts

Frequently asked questions

What is a fingerprint collision?

A fingerprint collision occurs when two or more distinct physical devices produce the same hardware fingerprint hash. This happens because the fingerprint compresses many attributes into a fixed-length identifier, and the entropy of the attribute space is smaller than the population of devices — especially when browsers, OSes, or privacy tools standardize outputs.

Why not just use a longer hash or more attributes?

Adding attributes increases entropy but also increases brittleness: legitimate users change browsers, update drivers, switch networks, or enable privacy modes, causing their fingerprint to drift. A longer hash makes drift look like a new device, fragmenting identity. The robust approach is to accept collisions and resolve them with orthogonal signals.

How many behavioral signals are needed to resolve a collision reliably?

There is no fixed number. BotRefund uses 106 behavioral and environmental signals (S8) plus hardware checks. In practice, 5–10 high-quality behavioral features (input timing, pointer dynamics, scroll patterns, focus behavior, rendering consistency) combined with network context are often sufficient to separate a corporate fleet from a botnet mimicking it.

Does probabilistic scoring introduce latency?

Not if the model runs at the edge. BotRefund's architecture executes the full 110+ signal evaluation and scoring in 0ms added latency by running inside Cloudflare's edge network (S1, S2). The model is pre-compiled and inference is deterministic.

Can this approach work without client-side JavaScript?

Partially. Server-side signals (TLS fingerprint, IP reputation, header order, request timing) provide a baseline, but they lack the behavioral richness (pointer jitter, input dynamics, rendering checks) that most effectively breaks collisions. For high-value traffic, client-side telemetry is strongly recommended.

What happens when a legitimate user is scored as high-risk?

The tiered action design prevents hard blocks on medium scores. High-risk scores trigger silent pixel suppression and evidence queueing for refund claims, not immediate user-facing blocks. If a false positive occurs, the refund dispute process with Google/Meta (83% approval rate) provides a correction signal that feeds back into the model.

How do I know if my current fingerprinting solution has a collision problem?

Check your false positive rate on known-good traffic (corporate networks, privacy-browser users) and your false negative rate on known-bot traffic that mimics common builds. If either exceeds 1–2%, collisions are likely degrading accuracy. A/B test a multi-signal probabilistic layer against your current binary rule.

Direct answer: what Playwright and Selenium traffic looks like

Playwright and Selenium are browser automation frameworks. They drive a real browser, so the traffic comes from a genuine Chrome, Firefox, or WebKit process. That makes it harder to spot than a simple script using raw HTTP requests. But automation leaves traces.

The most reliable way to identify this traffic is to look for a cluster of signals, not one flag. A single property like navigator.webdriver can be spoofed or hidden by stealth plugins. A combination of browser, network, hardware, and behavior signals is much harder to fake consistently.

Step 1: Check for the WebDriver flag

Both Playwright and Selenium set navigator.webdriver to true by default. This is the fastest first check.

• In JavaScript on your page, run navigator.webdriver.
• If it returns true, the browser is under automation control.
• If it returns false or undefined, do not stop. Stealth plugins and patched drivers remove this flag.

Treat this as a tripwire, not a verdict. Many legitimate accessibility tools also set this flag, so combine it with other checks before blocking traffic.

Step 2: Look for CDP debugger leaks

Playwright and Selenium both use the Chrome DevTools Protocol (CDP) to control the browser. This leaves detectable traces.

• Check for window.chrome properties that are missing or altered.
• Look for Runtime.enable or Page.enable CDP commands in the browser's debugger state.
• Inspect navigator.plugins and navigator.languages for inconsistencies with the claimed user agent.

Bot detection services like BotRefund specifically check for "CDP Debugger Leak" as one of their 106 signals. A real user's browser does not expose an active debugging session.

Step 3: Inspect browser property consistency

Automation frameworks often fail to keep every browser property consistent with the claimed environment.

• Compare navigator.userAgent with navigator.platform and navigator.language.
• Check the Accept-Language header against the browser's configured languages.
• Verify the timezone reported by JavaScript matches the IP geolocation.
• Look for mismatches between the JavaScript engine version and the claimed browser version.

BotRefund's detection vectors include "HTTP User-Agent Mismatch," "Accept-Language Mismatch," "Timezone Evasion," and "JS Engine Mismatch." These are exactly the inconsistencies that Playwright and Selenium sessions often produce when configured hastily.

Step 4: Analyze behavioral signals

Even a well-configured automation session behaves differently from a human.

• Mouse movement: Playwright and Selenium scripts often move the pointer in straight lines or grid-aligned paths. Humans produce curved, jittery movement.
• Input speed: Automated clicks and keystrokes can happen in under 1 millisecond. A human cannot do that.
• Session duration: Bots often have unnaturally short or perfectly uniform session lengths.
• Engagement: Automated sessions may show no scrolling, no field corrections, and no meaningful page interaction.

BotRefund flags "Robotic linear mouse movements," "Superhuman input speed (<1ms)," "Grid-aligned movement patterns," and "Unnatural session durations." These behavioral patterns are common in Playwright and Selenium traffic because scripts execute actions without human hesitation.

Step 5: Check network and hardware fingerprints

Automation traffic often comes from datacenter IPs, VPNs, or residential proxies that do not match the claimed browser environment.

• Check for WebRTC leaks that reveal a different IP than the HTTP request.
• Look for DNS tunnel leaks where DNS and web traffic take different routes.
• Verify the OS and TCP TTL values match the claimed operating system.
• Check for suspicious ports or IP address inconsistencies.

BotRefund's network vectors include "WebRTC Network Leak," "DNS Tunnel Leak," "OS / TCP TTL Mismatch," and "IP Address Inconsistency." Playwright and Selenium sessions routed through proxies frequently trip these checks.

Step 6: Combine signals into a decision

No single signal is conclusive. A real user might have a VPN. A stealth-configured Playwright script might hide navigator.webdriver. The key is to evaluate the full pattern.

1. Collect all available signals for each session.
2. Score each signal for how strongly it indicates automation.
3. Look for clusters: three or more weak signals together are stronger than one strong signal.
4. Use a prediction model or rule engine to classify the session as human or automated.

BotRefund's approach is exactly this: "BotRefund's prediction AI sees how 106 browser, network, hardware, and behavior signals fit together before deciding whether a visit is human or automated." A single suspicious property is not enough; the full pattern matters.

Common mistake: relying on one flag

The most common mistake is blocking traffic based on navigator.webdriver alone. Modern Playwright and Selenium setups use stealth plugins that remove this flag. If you only check one property, you will miss sophisticated automation and may block legitimate users who use accessibility tools.

Instead, collect multiple signals and evaluate them together. This reduces false positives and catches more automation.

How to verify your detection works

Test your detection against known automation traffic.

1. Write a simple Playwright script that visits your page.
2. Write a simple Selenium script that visits your page.
3. Run both scripts and check whether your detection flags them.
4. Run a normal human browsing session and check that it is not flagged.

If your detection misses the automation scripts, add more signals. If it flags the human session, tune your thresholds. BotRefund offers a free bot audit that runs a live check on your site, which is a practical way to validate your setup.

Key facts

Limitations and when this advice does not apply

This guidance assumes you control the web page or application receiving the traffic. If you are analyzing server logs from a third-party platform, you may not have access to browser-side signals.

Some legitimate users run browsers with automation-like properties. Accessibility tools, enterprise security software, and remote desktop sessions can trigger false positives. Always allow human review or an appeal path before blocking traffic outright.

Detection is an arms race. Playwright and Selenium maintainers and stealth plugin authors continuously update their tools to evade detection. Your detection logic needs regular updates to stay effective.

FAQ

Can I identify Playwright traffic specifically versus Selenium?

Not reliably from a single signal. Both frameworks use the same underlying browser automation protocols. You can sometimes distinguish them by specific CDP command patterns or default configuration differences, but stealth plugins blur these lines. Focus on identifying automation in general rather than the specific framework.

What is the fastest way to check for automation traffic?

Run navigator.webdriver in the browser console. If it returns true, the browser is under automation control. However, this is only a first check; stealth plugins can hide it.

Do Playwright and Selenium always set navigator.webdriver to true?

By default, yes. But both frameworks allow you to disable this flag, and many stealth plugins do so automatically. Do not rely on it as your only detection method.

Can I block Playwright and Selenium traffic without affecting real users?

Yes, if you use a combination of signals and set conservative thresholds. Blocking based on one flag will cause false positives. A multi-signal approach with human review for borderline cases is safer.

What should I do after identifying automation traffic?

Decide based on your context. For ad traffic, you may want to exclude it from conversion tracking and file a refund claim. For a web application, you may want to block or challenge the session. For analytics, you may want to filter it out of your reports.

How often should I update my detection logic?

Regularly. Automation tools and stealth plugins update frequently. Review your detection signals at least quarterly, and test against the latest Playwright and Selenium versions.

Uniform click paths are sequences where every session follows the exact same series of clicks, indicating automated or bot behavior.

Definition and Scope

A click path (also called a clickstream) is the ordered list of pages or elements a visitor clicks during a session. When that list is exactly the same for many sessions, we call it a uniform click path. Uniformity alone does not prove fraud, but combined with other signals it strongly suggests non‑human activity.

Click paths can be captured at different granularities: page-level (URLs), element-level (button IDs, link classes), or event-level (custom analytics events). Page-level paths are easiest to collect from standard analytics platforms like Google Analytics 4 (GA4) or Meta Ads Manager. Element-level paths require client‑side instrumentation such as a JavaScript listener that records every click target. The choice of granularity affects detection sensitivity. Page‑level uniformity may miss bots that randomize sub‑page actions, while element‑level data can reveal identical interaction sequences even when page URLs differ slightly.

Scope also includes the time window. A uniform path observed over a few hours may indicate a burst of bot traffic from a single campaign. A pattern persisting across days suggests a persistent script or scraper. Analysts should segment by traffic source, device type, and geographic region to avoid conflating legitimate funnel steps (e.g., a linear checkout flow) with malicious uniformity.

Why Uniform Click Paths Matter

Uniform paths can inflate ad spend, poison conversion data, and hide the true performance of your campaigns. If you ignore them, you may keep optimizing on misleading metrics, wasting budget on traffic that never converts.

When bots follow identical click sequences, they generate fake clicks that cost money in pay‑per‑click models. They also trigger conversion pixels without real intent, corrupting the training data for bidding algorithms. This leads to higher cost‑per‑acquisition and lower return on ad spend. In lead‑generation campaigns, uniform paths often accompany form submissions with disposable emails or disconnected phones, wasting sales team effort. According to BotRefund research, bot clicks can steal up to 20% of Google and Meta ad budgets (source S2). Detecting uniform paths early lets you block offending IPs, adjust targeting, or file refund claims with ad platforms.

Detectable Signals

BotRefund’s research highlights several signals that often appear together with uniform click paths:

• No scrolling or mouse movement ("Absence of clicks or scrolling").
• No field corrections or repeated form edits.
• Identical, rapid form completions.
• Grid‑aligned or straight‑line mouse movements ("Path behavior").

Additional signals from BotRefund’s 106‑check suite include superhuman input speed (under 1 ms), absence of human‑like mouse tremor, and scrollbar width leaks that reveal automated browsers (source S4). These signals are independent; a single anomaly is not a verdict. BotRefund’s AI model cross‑checks them across browser, network, device, and behavior layers to reach 99% accuracy (source S4, S7). When uniform click paths co‑occur with multiple behavioral anomalies, confidence in bot classification rises sharply.

Step‑by‑Step Identification Process

1. Collect raw session data. Export click logs from your analytics platform (Google Analytics, Meta Ads Manager, etc.) that include timestamps, page URLs, and element IDs. In GA4, use the Exploration report with "Event name = click" and dimensions "Page path", "Event parameter: element_id", "Session ID". Export to BigQuery for large‑scale analysis.
2. Normalize the data. Strip query strings, session IDs, and any dynamic parameters that differ per user but do not affect navigation. Keep UTM parameters only if you need to attribute by campaign; otherwise remove them to avoid false uniformity. Also normalize case, trailing slashes, and URL encoding.
3. Build click‑path strings. Concatenate the ordered list of page identifiers for each session, e.g., home > product > checkout. For element‑level paths, use a delimiter like "|" between element IDs. Example BigQuery snippet:

   WITH clicks AS (
     SELECT
       session_id,
       ARRAY_AGG(page_path ORDER BY event_timestamp) AS path_array
     FROM `project.dataset.ga4_events`
     WHERE event_name = 'click'
     GROUP BY session_id
   )
   SELECT
     session_id,
     ARRAY_TO_STRING(path_array, ' > ') AS click_path_string
   FROM clicks;

4. Group identical strings. Count how many sessions share the exact same string. A high count (e.g., >5% of total sessions) flags a uniform path. Adjust threshold based on traffic volume; for low‑traffic sites, even 10 identical paths may be significant.
5. Cross‑check supporting signals. For the flagged group, examine scrolling depth, mouse‑move logs, and form‑field events. Uniform paths often lack these human‑like actions. Join with client‑side behavioral logs (e.g., BotRefund script) that capture scroll depth, mouse tremor, and input speed.
6. Score the sessions. Assign a risk score based on uniformity plus supporting signals. Use a rubric:

   Factor	Weight	Threshold
   Path uniformity (sessions sharing path / total sessions)	30%	>5%
   Zero scroll depth	20%	True
   No field corrections	15%	True
   Identical time-on-page (std dev < 1s)	15%	True
   Grid‑aligned mouse movement	10%	True
   Superhuman input speed	10%	True

   Sum weighted scores; sessions above 0.7 are high risk. BotRefund’s AI model can ingest these scores for an automated verdict.

Mini‑case: Normalization pitfall. A retailer stripped all query parameters, including product IDs, causing distinct product detail pages to collapse into a single "product" token. This made 2,000 legitimate sessions appear as one uniform path. The fix: preserve path‑defining parameters (e.g., product SKU) while removing session‑specific tokens (e.g., `session_id`, `fbclid`). Always audit a sample of normalized paths against raw URLs before grouping.

Common Mistakes to Avoid

• Removing too much data. Over‑normalizing (e.g., deleting all query parameters) can make distinct sessions appear identical. Example: stripping UTM parameters is safe, but removing product IDs merges different product views.
• Relying on a single signal. Uniform paths without scrolling anomalies may still be legitimate; always use a multi‑signal approach.
• Ignoring volume thresholds. A single identical path is normal; look for patterns across dozens or hundreds of sessions.
• Over‑normalizing UTM parameters. If you keep UTM source/medium but drop campaign/content, sessions from the same ad set but different creatives may falsely unify. Keep at least source and medium for attribution.
• Ignoring single‑page sessions. Bots often land on a page and trigger a conversion event without any clicks. These sessions have empty click paths and are missed by path‑only analysis. Include event‑only sessions in your audit.

Verifying Your Findings

After you flag a set of uniform paths, run a quick verification:

1. Sample a few sessions in a replay tool (e.g., Chrome DevTools or a session‑recording product) to see actual mouse movement.
2. Check server logs for IP diversity. Bots often use data‑center IP ranges.
3. Compare conversion outcomes. Uniform paths usually have zero or very low conversion rates.

If the sample confirms non‑human traits, you can proceed to block the traffic or submit a refund claim.

Note on session‑replay sampling bias. Replay tools often sample a subset of sessions (e.g., 10% of traffic). If bot traffic is high volume, the sample may under‑represent bots, leading to false confidence. Always verify with full‑population logs (BigQuery, server access logs) before concluding.

FAQ

• What if a legitimate A/B test creates similar paths? A/B tests are usually limited to a small percentage of traffic and still show natural scrolling and timing variations.
• Can I automate detection? Yes. BotRefund provides a client‑side script that logs click sequences and feeds them into its AI model for real‑time alerts.
• How often should I audit click paths? Perform a baseline audit monthly, and run quick spot checks after major campaign changes.
• Does uniform click‑path detection work on mobile? Absolutely. Mobile sessions also generate click‑path logs; look for the same lack of scrolling or rapid taps.
• How do single‑page applications (SPAs) affect false positives? SPAs often trigger virtual pageviews without full reloads, creating identical path strings for legitimate users navigating the same route. Mitigate by including element‑level clicks (button IDs, route changes) and checking for scroll/interaction signals.
• How should I handle consent‑mode gaps where behavioral data is missing? When users reject analytics cookies, GA4 may not record click events. Use server‑side logs (with hashed IPs) to reconstruct minimal paths, and rely on BotRefund’s cookieless behavioral signals (mouse tremor, input speed) that work without consent.

Learn more about this service

See how this page can help with your next step.

Learn more

How to Maintain Data Accuracy with Bot Filtering

How the migration works

BotRefund is built to audit every affiliate conversion before you pay a commission. To get your historical payouts into that same reporting view, you upload a CSV file that lists each payout with its network, date, amount, and status. BotRefund then matches those rows against the conversion data it has already collected from your tracking script. The result is a unified payout report that shows both your history and your current cycle in one place.

This process does not require you to rebuild your tracking or manually re-enter years of records. The CSV import is the fastest path, and it works even if your data is spread across multiple affiliate networks or platforms.

Why unified payout reporting matters

If you manage affiliate payouts across several networks, you likely get separate reports from each platform. You have to merge them by hand, which is time-consuming and error-prone. You might miss duplicate commissions, refunds, or fraudulent conversions that appear only when you compare networks side by side.

Unified reporting gives you a single view of all payouts. You can see which affiliates are generating clean revenue and which ones are costing you money. You also get a complete audit trail, which helps when you need to justify a rejected commission or when you want to negotiate better terms with a network. BotRefund's report combines your historical payouts with the audit scores for each conversion, so you know exactly which payouts are safe to release.

Prerequisites before you start

• Export payout history from each affiliate network or platform you use. Look for options like "export commissions", "payout history", or "transaction log".
• Standardize the file format to CSV. Combine multiple files into one if needed, and add a column that identifies the network or source.
• Make sure your tracking script is installed on your site. BotRefund reads UTM parameters and click IDs from your traffic to match payouts to the right conversions.
• Confirm you have the required columns at minimum: network/affiliate identifier, payout date, amount, and status (e.g., approved, paid, rejected, refunded).

Step-by-step migration process

Step 1: Export your payout history

Go to each affiliate network or payment system and export the payout records. Include as much detail as you can: affiliate ID, payout amount, date, currency, and any status fields. CSV is the preferred format.

If your network does not offer CSV export, check if you can copy the data from a table or use an API. If your history is only in PDFs, you will need to convert those to a digital format, for example by using a spreadsheet tool that can import PDF tables.

Step 2: Clean and standardize the data

Check that all rows have a consistent date format, a positive or negative amount, and a clear status. If you have refunds or rejected commissions, make sure those are marked. Remove duplicate rows if you see them.

Decide on a single date format, such as YYYY-MM-DD. If your amounts are in different currencies, add a currency column and keep it consistent per row. For status, use standard values like "approved", "paid", "rejected", "refunded". Do not mix synonyms like "approved" and "cleared" unless you map them to a standard list.

Step 3: Build and check your CSV structure

A well-structured CSV makes the import much smoother. At a minimum, include these columns:

Here are two example rows:

network,payout_date,amount,currency,status,affiliate_id,click_id
Impact,2024-01-15,150.00,USD,paid,aff_12345,clk_abc123
CJ,2024-01-20,-20.00,USD,refunded,aff_67890,

Note that the refunded row has a negative amount and no click_id. That is fine; BotRefund will still carry the status and amount.

Step 4: Upload the CSV in BotRefund

In your BotRefund dashboard, find the section for payout reconciliation or CSV upload. Select your file. The system will parse it and display a summary of what it found.

Before you upload, double-check that your CSV uses UTF-8 encoding and does not contain extra blank rows. Also make sure the first row is the header. If you have a large file (more than 10,000 rows), you might want to split it into chunks, but BotRefund can handle most files without trouble.

Step 5: Let BotRefund validate and map the data

BotRefund will attempt to match each payout row to a tracked conversion using the UTM and click ID data it has stored. Rows that cannot be matched will be flagged. You can review these and make manual adjustments if needed.

The matching logic works like this: BotRefund looks for a conversion event that has a matching click ID or UTM combination and a timestamp that aligns with the payout date. If a match is found, the payout row is linked to that conversion and receives the audit score that the conversion already has. If no match is found, the row stays unmatched.

Step 6: Review the unified report

Once the mapping is complete, you get a report that combines your historical payouts with the audit scores for each conversion. Each row is tagged as Approve, Review, Hold, or Reject, so you can see which payouts are safe to release.

For historical rows that were matched, the tag comes from the conversion's audit score. For unmatched rows, you will see them in a separate section without a tag. You can still see the total amounts and the network breakdown.

Step 7: Set up ongoing reconciliation

After the initial migration, you can upload a new CSV each payout cycle or connect your affiliate platform directly. This keeps the unified report current without extra manual work.

Most users start with CSV uploads for the first few cycles, then move to a direct integration if they want real-time data. Check with BotRefund support to see which integrations are available for your networks.

Understanding the reconciliation process in detail

Reconciliation is more than just summing numbers. BotRefund compares each payout row against the conversion data it has collected from your tracking script. The goal is to answer two questions: Did this payout actually correspond to a valid conversion? And was that conversion flagged as suspicious?

To make a match, BotRefund looks for a conversion that happened on or around the payout date and that shares the same affiliate identifier or click ID. If your tracking script captured a click ID, that is the strongest signal. If you only have a UTM parameter, BotRefund can use the combination of affiliate ID and timestamp to narrow down the match.

When a match is found, BotRefund pulls the audit score for that conversion. If the score is Approve, you know the payout is clean. If it is Review or Hold, you should investigate before paying. If it is Reject, you can decline the commission with confidence.

If you do not have tracking data for a historical period, the row will remain unmatched. You still see the payout amount, but you lose the per-conversion fraud analysis. That is why it is better to import only data that has corresponding tracking, or to accept that older rows will not have tags.

How BotRefund's scoring tags apply to historical data

BotRefund rates every conversion it tracks with one of four tags: Approve, Review, Hold, or Reject. These tags come from behavioral signals, attribution path analysis, and click-to-conversion timing. When you import historical payouts, the tags are applied to the conversion match.

For example, a payout row that matches a conversion with a clean attribution path and normal behavior gets an Approve tag. A payout that matches a conversion where the attribution path was hijacked in the final seconds gets a Reject tag. If the system is unsure, it flags the row as Review or Hold.

This means you do not have to re-audit each historical payout manually. The tags give you a fast way to prioritize which payouts to release and which ones need a second look. If you have a large history, you can filter the report by tag and handle the Reject rows first.

Keep in mind that tags are only assigned to rows that match a tracked conversion. Unmatched rows have no tag and are listed separately. You can still see the totals, but you lose the audit layer.

Common mistakes to avoid

• Uploading without dates: BotRefund needs a date to match payouts to conversion times. Missing dates will cause rows to be dropped.
• Inconsistent status values: If you mix "paid", "approved", "rejected", "refunded" with different labels, the parser may not recognize them.
• Mixing currencies: If your payouts are in multiple currencies, include a currency column and be consistent per row.
• Uploading too little data: Excluding affiliate IDs or network names makes it nearly impossible to map payouts to the right conversions.
• Ignoring duplicates: Duplicate rows can inflate your totals and cause false matches. Clean them before uploading.

Troubleshooting unmatched rows

After you upload your CSV, some rows may not match any conversion. Here are common reasons and how to fix them.

Missing click ID or UTM data

If your tracking script was not active during the period of the payout, you will not have a click ID to match. The row will appear as unmatched. Solution: leave it as is, or manually assign it to a conversion if you know the affiliate.

Date mismatch

The payout date in your CSV may not match the conversion date. BotRefund looks for conversions around the payout date, but if the dates are far apart (for example, a payout for a conversion from three months ago), the match may fail. Solution: include a conversion date column if you have it, or widen the match window in the settings.

Affiliate ID format differences

If your CSV uses one format for affiliate IDs (e.g., "aff_12345") and your tracking uses another (e.g., "12345"), BotRefund may not recognize them as the same. Solution: standardize the ID format in your CSV before upload.

Currency or status parsing errors

If a row has an unrecognized status or a malformed currency, it will be skipped. Check the error report in the dashboard. Solution: correct the values and re-upload.

Rows that are not conversion-based

Some payouts may be bonus payments, sign-up incentives, or adjustments that have no corresponding conversion. These will never match. Solution: separate them into a different import or label them clearly so you can exclude them from the audit.

How to verify the migration worked

Start by comparing the total payout amount in BotRefund with your own accounting records. The totals should match. Next, spot-check three or four known payouts to confirm the date, amount, and affiliate name are correct. Finally, confirm that any refunds or rejections appear in the report with the right status.

If you notice a discrepancy, check the unmatched rows list and the error log. It is often easier to fix a few rows and re-import than to trace through the whole file.

Key facts about BotRefund's payout reporting

Limitations and when this advice does not apply

BotRefund does not process payments. It only evaluates and recommends which commissions to pay. So the migration does not touch money movement; it just brings your data into a single reporting view.

If you had no tracking script installed during the period covered by your historical payout data, BotRefund will not have the underlying conversion data to match against. In that case, your imported rows will appear in the report as records without audit scores. You still get the consolidated totals, but you lose the per-conversion fraud analysis for older payouts.

This guide assumes you have access to export data from your networks. If your payout history is stored only in PDFs or printed reports, you will need to convert those to a digital format first.

FAQ

What columns must my CSV have?

At minimum, include a network or affiliate identifier, a payout date, an amount, and a status (approved, paid, rejected, refunded). Adding more fields like currency and click ID improves matching.

Can I connect my affiliate platform instead of uploading CSV?

Yes. BotRefund lets you connect your affiliate platform later for ongoing reconciliation, but CSV is the quickest way to load historical data in bulk.

How long does the migration take?

The upload itself is immediate. Validation and mapping may take longer, especially if you have many rows or need to resolve unmatched entries. BotRefund support can help you through the process.

What if my payout history has no UTMs or click IDs?

You can still import the payout records, but BotRefund will not be able to match them to specific conversions. The report will show the payout totals without the audit details.

Does BotRefund handle refunds during migration?

If your CSV includes a status like "refunded" or "rejected", BotRefund will carry that into the report and flag those commissions appropriately.

What happens to rows that don't match a

Monitoring Google Ads for bot traffic is crucial. Bots waste ad spend. They also skew campaign performance data. This leads to poor optimization. Regular checks prevent this. You need a consistent routine. This routine helps identify and block non-human visitors. It ensures your budget is spent on real potential customers.

Google Ads has built-in filters. However, these filters are not perfect. They often miss a significant portion of invalid traffic. Manual oversight is therefore essential. This helps protect your advertising budget. It also maintains the integrity of your conversion data.

Ignoring bot traffic can lead to 'pixel poisoning.' This is when machine learning algorithms start optimizing your campaigns for bot behavior. Instead of targeting actual customers, your ads are shown to more bots. This creates a negative feedback loop. Identifying patterns like high click-through rates with zero engagement or instant form completions is key. Taking proactive action to block these visitors keeps your conversion data accurate.

Establishing a Bot Monitoring Routine

A consistent monitoring routine is vital. Follow these steps to build an effective process:

1. Step 1: Audit Your Conversion-to-Click Ratios. Review your campaigns weekly. Look for campaigns with a sudden surge in clicks. If conversions or 'add to cart' actions do not increase proportionally, this signals potential bot activity. A high click volume with no corresponding engagement is a major red flag. This indicates bots are clicking your ads without any genuine interest.
2. Step 2: Set Up Automated Rules and Alerts. Utilize Google Ads' automated rules. Configure alerts for significant changes in key metrics. For example, set an alert if your Cost-Per-Click (CPC) drops dramatically. Also, alert if click volume doubles without a corresponding increase in conversions. These anomalies often indicate bot attacks. Automated alerts ensure you are notified promptly of suspicious activity, even when you are not actively monitoring.
3. Step 3: Analyze Traffic Sources in Google Analytics 4 (GA4). GA4 offers robust tools to filter out non-human behavior. Focus on sessions with zero engagement time. Look for extremely high bounce rates. Pay attention to traffic originating from specific geographical regions or unusual browser types. GA4's detailed reporting can reveal patterns that Google Ads alone might miss. Examine traffic sources, mediums, and campaign details for anomalies.
4. Step 4: Update IP Exclusions Regularly. Identify suspicious IP addresses from your logs and reports. Add these IPs to your Google Ads IP exclusion list. This prevents them from clicking your ads again. This is an ongoing maintenance task. IPs can change, so monthly reviews are recommended. Regularly updating your exclusion list is a direct way to block known sources of bot traffic.

Verification Step: Cross-reference your CRM data with your Google Ads dashboard. If your Google Ads dashboard shows a high number of leads, but your CRM contains junk data or is unexpectedly empty, your monitoring has successfully identified a bot leak. This discrepancy highlights the importance of validating data across platforms.

The Mechanics of Bot Traffic and Google Ads Filters

Understanding how bots operate is key to combating them. Google Ads employs sophisticated filters to detect and block invalid traffic. These filters analyze various signals, including IP addresses, click patterns, and device information. However, bot creators constantly evolve their methods to bypass these defenses.

Sophisticated Invalid Traffic (SIVT) refers to bot activity that is designed to evade standard detection mechanisms. These bots often employ advanced techniques:

• Browser Fingerprinting: Bots can mimic legitimate browser fingerprints. This includes user agent strings, screen resolutions, installed fonts, and browser plugins. By collecting and replicating these unique identifiers, bots can appear as real users to ad platforms. Advanced fingerprinting can even simulate the subtle variations found in human browsing.
• Residential Proxies: Instead of using data center IP addresses, bots leverage residential proxies. These are IP addresses assigned to actual homes. Traffic routed through residential proxies appears to originate from legitimate internet connections, making it extremely difficult to distinguish from genuine user traffic. Botnets often comprise compromised home computers and mobile devices.
• Behavioral Emulation: Modern bots go beyond simple click generation. They can emulate human browsing behavior. This includes simulating mouse movements, scroll actions, typing speeds, and even pauses between actions. These bots use headless browsers, which are web browsers without a graphical user interface, to execute complex scripts that mimic human interaction with web pages. They can navigate through websites, add items to carts, and even fill out forms, all while appearing as a real user.
• Headless Browsers: Tools like Puppeteer and Selenium are used to control headless browsers. These browsers can be programmed to perform specific actions on websites. They can bypass CAPTCHAs and other human verification methods by automating the entire interaction process. Their ability to execute JavaScript and render pages allows them to interact with dynamic content, making them highly effective for sophisticated bot attacks.
• API-Based Attacks: Some bots do not rely on browsers at all. They interact directly with website APIs. This allows them to submit data or trigger actions without ever rendering a web page. This method is often used for form submissions or creating fake accounts, as it is highly efficient and difficult to detect through traditional web traffic analysis.

Google's filters are constantly updated to combat these evolving threats. However, the arms race between bot creators and detection systems means that a layered approach to monitoring is always necessary.

The Mechanics of Pixel Poisoning

Pixel poisoning is a critical issue that directly impacts your campaign optimization. It occurs when bot traffic contaminates your conversion tracking data. This data is then used by machine learning algorithms to make bidding and targeting decisions.

Here's how it works:

• Bot Interaction: Bots click on your ads and visit your website. They may perform actions that mimic user behavior, such as browsing pages, adding items to a cart, or even filling out forms.
• Conversion Pixel Triggering: If these bot actions trigger your conversion pixels (e.g., Google Ads conversion tag, Meta Pixel), the ad platform receives a signal that a conversion has occurred.
• Machine Learning De-training: The ad platform's machine learning algorithm interprets these bot-generated conversions as genuine user intent. It begins to identify patterns associated with these bot sessions. These patterns might include specific IP ranges (if not properly masked), browser characteristics, or interaction speeds.
• Skewed Optimization: The algorithm then starts to optimize your campaigns to find more users who exhibit these bot-like characteristics. This means your ad budget is increasingly allocated to serving ads to bots, rather than to actual potential customers.
• Reduced ROI: As your campaigns are optimized for bots, your return on ad spend (ROAS) plummets. You are paying for clicks and conversions that do not translate into real business value.

The consequence of pixel poisoning is that your campaigns become less effective over time. The machine learning models become 'de-trained' on real customer behavior and instead learn to target automated traffic. This makes it harder to reach genuine buyers and achieve your marketing goals.

Types of Bot Traffic to Watch

To monitor effectively, you must understand the different types of bot traffic and their technical distinctions:

• Click Farms: These are often human-operated or semi-automated setups. Low-cost labor or simple scripts click on ads repeatedly. They aim to generate revenue for publishers or to artificially inflate click counts. While they may use real devices, their behavior is often repetitive and lacks genuine user intent.
• Scrapers: Automated bots designed to extract data from websites. They visit pages to collect information like product details, pricing, or contact information. To access deeper content or specific landing pages, scrapers often trigger ad clicks. They may not interact with the page content in a human-like way after the click.
• Headless Browsers: These are scripts that control web browsers without a graphical user interface. They are powerful tools for automation. They can mimic human interaction with websites, filling out forms, navigating pages, and submitting data at superhuman speeds. Unlike traditional bots that might be detected by browser anomalies, headless browsers can be configured to appear very similar to legitimate browser sessions.
• API-Based Attacks: These bots interact directly with application programming interfaces (APIs). They bypass the need for a web browser entirely. This method is highly efficient for tasks like submitting forms or creating fake accounts. Detection is challenging as there is no visible web traffic to analyze.
• Residential Proxy Botnets: These bots operate from compromised home computers and mobile devices. They use the IP addresses of these devices to route their traffic. This makes the bot activity appear to originate from legitimate residential internet connections, effectively hiding within normal user traffic and bypassing IP-based detection methods.

The Impact of Ignoring Bot Traffic

Ignoring bot traffic has severe consequences for your advertising efforts. It's not just about immediate budget waste. Modern advertising platforms, including Google Ads, rely heavily on machine learning to identify users most likely to convert. When bots click your ads, the algorithm interprets these actions as valuable signals.

This creates a detrimental feedback loop. Your ad budget is increasingly directed towards bots. This diverts resources away from reaching real human prospects. Data indicates that non-human traffic consistently consumes a significant portion of paid advertising budgets, often between 15% and 25%. In industries with high Cost-Per-Click (CPC) rates, such as legal services, insurance, or B2B software, this waste can be even more substantial.

Without regular monitoring and intervention, your audience targeting models, including Lookalike audiences, become poisoned with fake data. This renders your future targeting efforts increasingly ineffective. You end up paying to reach audiences that are unlikely to ever convert.

Forensic Indicators of Bot Activity

When reviewing your ad and website logs, look for these specific technical red flags that indicate bot activity:

• Superhuman Input Speed: Forms that are filled out instantly. Humans naturally take several seconds to type information. Bots can populate entire forms in milliseconds. This extreme speed is a strong indicator of automation.
• Lack of UI Focus States: Observe sessions where form fields are populated without any simulated mouse movements, scroll triggers, or focus changes. Genuine user interaction involves these subtle UI cues. Their absence suggests script-driven input.
• Abnormally Low App Activity: Users who register or complete a primary action and then immediately log out or leave the site without interacting with other pages or features are suspicious. This indicates a lack of genuine user interest beyond the initial automated action.
• Identical Field Structures or 'Fake' Domains: Multiple leads arriving with the exact same data patterns, or using identical 'fake' corporate domains, are a clear sign of bot-generated submissions. This uniformity is rarely seen in organic lead generation.
• Unusual Click Patterns: Bots may exhibit repetitive clicking on the same ad or landing page. They might also click ads at consistent intervals or at times when human activity is typically low.
• High Click-Through Rates (CTR) with Low Engagement: A campaign might show a very high CTR, suggesting ads are appealing. However, if users immediately bounce or show no engagement on the landing page, it points to bot clicks rather than genuine interest.
• Geographic Anomalies: Sudden spikes in traffic from unexpected or irrelevant geographic locations can indicate bot activity, especially if these IPs are associated with known botnets or data centers.

Limitations of Monitoring and Mitigation Strategies

While diligent monitoring is essential, it's important to understand its limitations. Sophisticated bots are designed to mimic human behavior closely. They can introduce artificial delays, vary their interaction speeds, and even simulate mouse jitter to appear more human-like. This makes detection increasingly challenging.

Furthermore, Google has limitations on manual claims for invalid traffic. Typically, claims are restricted to the past 60 days. If you do not monitor and document bot traffic within this window, you may lose the opportunity to reclaim wasted ad spend. This underscores the need for continuous, proactive monitoring rather than reactive measures.

Mitigation Strategies:

• Third-Party Detection Tools: Investing in specialized bot detection and ad fraud prevention tools can significantly enhance your monitoring capabilities. These tools often employ advanced forensic analysis and machine learning to identify SIVT with high accuracy.
• Client-Side Behavioral Analysis: Implementing solutions that analyze user behavior directly on your website (client-side) can provide deeper insights. These tools can detect subtle anomalies in interaction patterns that server-side logs might miss.
• Regular Data Audits: Beyond Google Ads reports, regularly audit your CRM, analytics platforms, and server logs. Comparing data across thes

To monitor suspicious patterns weekly in Meta Ads, begin with a repeatable checklist that compares ad‑platform data, website sessions, and CRM results. Look for abnormal contactability, timing spikes, uniform session behavior, placement‑level lead‑quality differences, and a high lead count with no downstream conversions. Automate the data pull so you can review the same metrics every seven days without manual extraction.

Why weekly monitoring matters

Invalid traffic can waste budget, distort conversion data, and poison pixel learning. A weekly cadence catches sudden bursts before they accumulate, lets you separate normal lead‑quality variation from automated activity, and gives you evidence to support refund requests with Meta.

Meta’s own documentation notes that bot traffic can appear as a steady cost‑per‑lead while the sales team sees unreachable contacts or duplicate messages. Detecting the problem early prevents wasted spend from compounding over weeks.

Weekly reviews also protect the algorithm. Meta’s machine‑learning optimizes toward signals it receives. If bots inflate conversion events, the system may allocate budget to low‑quality audiences, reducing overall return on ad spend (ROAS).

Understanding invalid traffic on Meta

BotRefund’s blog explains that invalid traffic leaves repeatable technical and behavioral patterns: unusually fast form completion, identical field structures, sudden placement‑level spikes, or conversion events with no meaningful page engagement (S1). These patterns differ from genuine low‑intent leads, which still show human‑like interaction.

Typical signals include:

• Disconnected phone numbers or email domains that never resolve.
• Leads arriving in seconds after a click, indicating no reading time.
• Sessions with no scrolling, no mouse movement, and identical click paths.
• Sharp quality differences across placements or devices.
• High lead volume but zero booked demos or calls.

When multiple signals appear together, the likelihood of bot activity rises sharply.

Core signals to watch for suspicious patterns

Focus on these five signal groups, each drawn from the BotRefund source on Meta Ads invalid traffic:

• Contactability: disconnected phone numbers, invalid email domains, repeated addresses, or an unusual concentration of one country code (S1).
• Timing: several leads arriving in short bursts, forms submitted immediately after landing, or conversions concentrated at unusual hours (S1).
• Session behavior: no scrolling, no field corrections, uniform click paths, and no meaningful time on the offer page (S1).
• Campaign patterns: a sharp lead‑quality difference by placement, creative, audience expansion, device, or landing page (S1).
• CRM outcome: a high reported lead count paired with no calls connected, demos booked, qualified opportunities, or repeat engagement (S1).

Setting up automated alerts in Meta Ads Manager

Use Meta’s built‑in reporting to create a weekly scheduled export:

1. Open Ads Manager and select the campaign set you want to audit.
2. Choose Breakdown → Delivery → Time (day of week) and add columns for Leads, Cost per Lead, and any custom conversion.
3. Click Export → Schedule Export, set frequency to Weekly, and deliver the CSV to a shared folder or email.
4. In your spreadsheet, add conditional formatting to flag rows where Cost per Lead deviates >20% from the 4‑week average or where Lead volume spikes >3× the median.

This automated pull gives you a consistent baseline for the five signal groups.

Integrating BotRefund with your tech stack

BotRefund adds a layer of client‑side evidence that Meta’s server‑side filters miss. Install the BotRefund script on your landing page (takes about one minute). The service runs 106 independent checks, including click, trap, pointer, motion, speed, path, and engagement behavior (S2).

Each check contributes an evidence point. The AI model weighs the complete pattern to achieve up to 99% accuracy in distinguishing human from bot visits (S2). The script does not interfere with existing analytics tags, so you can keep Google Tag Manager, Meta Pixel, and any CRM integrations active.

After installation, log in to the BotRefund dashboard. Export a visitor‑behavior report for any date range. The report lists the number of sessions that triggered each behavior check, allowing you to correlate spikes with Meta metrics.

Step‑by‑step weekly audit workflow

Follow this ordered process every Monday (or whichever day suits your reporting cycle):

1. Download the weekly Meta Ads export from the scheduled report.
2. Apply the conditional formatting rules to highlight outliers in contactability, timing, and campaign patterns.
3. Open BotRefund’s dashboard and export the visitor‑behavior report for the same date range.
4. Cross‑reference flagged Meta rows with BotRefund signals: e.g., a timing spike accompanied by a high proportion of “Speed behavior” alerts.
5. Document any combination of at least two signal types (one from Meta, one from BotRefund) as a suspicious pattern.
6. If a pattern is confirmed, pause the offending ad set, creative, or placement and investigate the source (e.g., check IP ranges, review landing‑page scripts).
7. After investigation, either resume the asset with adjusted targeting or prepare a refund request using the BotRefund report as evidence.
8. Record the outcome in a simple log: date, flagged metric, BotRefund signals observed, action taken, and result.

Automating decision rules with scripts

For teams that prefer zero‑touch monitoring, you can extend the spreadsheet with simple Google Apps Script or Power Automate flows. Example rule: if Cost per Lead exceeds the 4‑week average by 20% AND BotRefund’s “Speed behavior” count is above the 90th percentile, trigger an email to the campaign manager.

The script can also auto‑pause an ad set via Meta’s Marketing API, provided you have the necessary permissions. This reduces reaction time from days to minutes, limiting budget loss.

Verifying the next step

Before changing targeting or filing a claim, verify that the anomaly is not a normal fluctuation:

• Compare the current week’s data to the same week in the previous month; true bot activity tends to be persistent or growing.
• Check whether the spike aligns with a known event (e.g., a holiday, a new competitor campaign).
• Run a hold‑out test: duplicate the ad set with a 10% budget allocation and monitor whether the suspicious signals disappear when the audience is restricted to known‑good segments.

If the signals persist under these checks, you have sufficient evidence to act.

Practical scenarios and decision criteria

Scenario 1 – Sudden lead surge from a single placement: The export shows a 5× increase in leads from the “Audience Network” placement. BotRefund flags a spike in “Ghost click” and “Grid‑aligned movement” signals for the same dates. Decision: pause the placement, investigate IP ranges, and file a refund request.

Scenario 2 – High lead volume but zero demos: Leads rise 30% week‑over‑week, yet CRM shows no booked demos. Contactability signals reveal many invalid phone numbers from the same country code. Decision: review the creative copy for hidden honeypot fields, adjust form validation, and consider a tighter audience filter.

Scenario 3 – Low‑volume brand awareness campaign: Weekly leads are under 50. Statistical noise makes spikes unreliable. Decision: switch to a monthly review and rely on Meta’s platform‑level invalid‑activity reports instead of BotRefund alerts.

Limitations and when the advice does not apply

This weekly process works best for lead‑generation campaigns where you can tie ad clicks to CRM outcomes. It is less effective for:

• Pure brand‑awareness campaigns with no downstream conversion tracking.
• Accounts with very low weekly volume (<50 leads) where statistical noise dominates.
• Situations where you lack access to website‑level behavioral data (e.g., third‑party landing pages you cannot tag).

In those cases, rely more on platform‑level invalid‑activity reports and consider a monthly rather than weekly review.

Case study snapshot

FinTrust, a neobank, reported a 14% bot click rate that inflated its cost‑per‑lead. By installing BotRefund, they suppressed conversion events flagged by “Superhuman input speed” and “Robotic linear mouse movements.” The audit led to a $140,000 refund and an 18% increase in verified conversions (S6). This illustrates how a single weekly audit can translate into significant financial recovery.

Key facts

FAQ

How much time does the weekly audit take?

Once the automated export and BotRefund script are in place, the review itself takes about 15‑20 minutes per week.

Do I need technical skills to install BotRefund?

No. Adding the script requires copying a single line of code into your site’s header; the provider estimates a setup time of under one minute.

What if I see a spike only in one signal?

A single signal is not enough to confirm bot activity. Look for corroboration from at least one other signal group before taking action.

Can I use this process for Instagram ads?

Yes. Instagram is part of Meta’s ad network, so the same signals and BotRefund tracking apply.

Is there a cost for the weekly Meta Ads export?

No. Meta’s scheduled export feature is free within Ads Manager.

What should I do if BotRefund shows high confidence but Meta’s reports look normal?

Give priority to the BotRefund evidence; it captures client‑side behavior that Meta’s server‑side filters may miss. Use the BotRefund report as the basis for a refund request.

How do I handle low‑volume campaigns?

When weekly leads are under 50, statistical variance can mask true patterns. Switch to a monthly review and focus on platform‑level invalid‑activity alerts.

Will pausing an ad set affect my overall campaign performance?

Pausing a suspect ad set isolates the problem and prevents budget waste. The rest of the campaign continues to learn from clean data, often improving ROAS.

Can I automate the refund request?

Meta does not provide a fully automated refund API. However, you can generate a pre‑filled PDF using BotRefund data and attach it to a support ticket, reducing manual effort.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• 7 Ways to Spot Suspicious Meta Ad Activity - AdAmigo.ai Blog
• How to Spy on Competitors' Facebook Ads: Weekly Monitoring Workflow
• Guide to Threat Detection for Meta Ads - AdAmigo.ai Blog

When a paid click arrives, the first seconds decide whether you can later prove the traffic was invalid. Capture the campaign name, ad set, creative, placement, and click identifier (such as fbclid or gclid) immediately on the landing page. At the same time, start recording behavioral signals — scroll activity, mouse movement, form interaction timing, and viewport changes — so each session carries a complete, tamper-resistant record. Keep this data intact even if you pause the campaign, change targeting, or swap creatives; the evidence must remain linked to the original click so Google or Meta reviewers can trace it back to the exact impression that was billed.

Why Preserving Campaign Context Matters for Ad Quality

Ad platforms bill on clicks and impressions, not on lead quality. A campaign can show a healthy cost per lead while the sales team receives disconnected numbers, copied messages, or enquiries that never progress. Without preserved context, you cannot distinguish a weak offer from automated fraud. The source pack notes that Meta campaigns reach people across Facebook, Instagram, and partner inventory at high volume, which also means accidental interactions, low-intent traffic, and deliberately fraudulent submissions can enter the funnel. Treating every unresponsive contact as fraud risks excluding a valuable audience, so a structured audit that compares ad-platform data, website sessions, and CRM outcomes is the necessary first step.

Core Components of Session Evidence

Session evidence has two layers: attribution data that ties the visit to a paid click, and behavioral data that shows whether a human performed the actions. Attribution data includes the campaign hierarchy (campaign, ad set, creative), placement, device, timestamp, and the click identifier. Behavioral data includes scroll depth and pattern, pointer movement (linear vs. natural curves), click and typing speed, form field corrections, time on page, and navigation flow. The source pack describes 110+ independent checks across browser, hardware, network, and behavior signals, each kept as evidence rather than a verdict, then cross-checked by an AI model that reaches 99% confidence when the full pattern supports it. No single anomaly proves fraud; a consistent cluster does.

Step-by-Step Process to Preserve Attribution and Session Data

1. Capture click identifiers on landing. Read fbclid, gclid, msclkid, or other platform parameters from the URL before any redirect or consent wall strips them. Write them into a first-party cookie or local storage with a short TTL so they survive page navigations.
2. Attach attribution to every event. When you fire conversion pixels, form submissions, or custom events, include the stored click ID, campaign name, ad set, creative, and placement. This keeps the evidence chain intact even if the user moves across subdomains.
3. Record behavioral signals client-side. Deploy a lightweight script that logs scroll events, mouse coordinates, click timestamps, form focus/blur, and viewport visibility changes. Send these as a session payload tied to the same click ID.
4. Store session replays or structured logs. Keep a tamper-resistant copy — either a full session recording or a signal-by-signal JSON log — that can be exported without manual translation. The source pack emphasizes reports built in the format platform teams use to review invalid traffic claims, including click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning.
5. Preserve evidence after campaign changes. Do not delete or overwrite session data when you pause a campaign, adjust budgets, or swap creatives. The evidence must remain queryable by the original click ID for the duration of the platform's refund window (typically 60–90 days).
6. Correlate with CRM outcomes. Match each click ID to the downstream lead record: contactability, demo booked, qualified opportunity, or repeat engagement. A high reported lead count paired with no connected calls or qualified opportunities is a strong signal to investigate.

Technical Implementation: Client-Side vs Server-Side Collection

Server-side logs (IP, user-agent, headers) catch basic scrapers but miss advanced botnets that rotate residential proxies and mimic browser fingerprints. Client-side audits analyze the visitor's browser environment — canvas rendering, WebGL, font enumeration, pointer dynamics, scrollbar metrics, iframe context — and can detect automation tools that patch or hide APIs. The source pack explains that automation tools often break when checked from another angle, such as a clean context iframe test. A practical setup uses both: server-side for fast filtering and click-ID capture, client-side for the behavioral evidence that platforms require for refund claims. BotRefund's approach combines 110+ signals across browser, network, device, and behavior, then weighs the complete pattern instead of trusting a raw rule.

Common Mistakes That Break the Evidence Chain

• Stripping click IDs at consent walls. Many cookie banners reload the page or redirect, dropping fbclid/gclid before your script reads them. Capture parameters before any consent UI renders.
• Relying only on platform auto-credits. Google and Meta automated systems catch some invalid activity, but the source pack notes they catch less than advertisers think. Manual claims with structured evidence recover the rest.
• Deleting session data when pausing campaigns. The evidence must survive campaign pauses. Export or archive before making structural changes.
• Using security logs instead of marketing-ready reports. Platform reviewers need click IDs, campaign hierarchy, timestamps, and signal reasoning in a readable format — not raw WAF logs that require manual translation.
• Treating every bad lead as fraud. Weak offers attract real people who aren't ready to buy. Compare ad-platform data, website sessions, and CRM outcomes before changing targeting or filing a refund request.

How to Verify Your Evidence Is Refund-Ready

Before filing a claim, run a verification checklist: (1) Can you query any click ID from the last 90 days and retrieve the full session payload — attribution, behavioral signals, and CRM outcome? (2) Does the export include campaign, ad set, creative, placement, device, timestamp, and click identifier in columns a platform reviewer expects? (3) Are behavioral signals presented as independent facts with cross-checked context, not a single "bot score"? (4) Does the report show signal-by-signal reasoning that a human reviewer can follow? The source pack states that BotRefund formats data in the structure Google and Meta teams use, and that 83% of clients across 2,500+ audits recover funds because the evidence meets reviewer expectations. If your export fails any of these checks, fix the collection or formatting gap before submitting.

Limitations and When This Advice Does Not Apply

• Organic or direct traffic. This process preserves context for paid clicks with platform identifiers. It does not create attribution for sessions without a click ID.
• Platforms without click identifiers. Some networks (e.g., certain programmatic DSPs) do not pass a standard click ID. You need a custom parameter strategy agreed with the vendor.
• Privacy regulations that restrict client-side tracking. In jurisdictions requiring prior consent for non-essential scripts, you may only collect behavioral signals after consent. Capture the click ID before the consent prompt, but delay behavioral recording until consent is granted.
• Single-page apps with hard navigations. If your SPA does full page reloads between steps, ensure the click ID persists in storage across reloads.
• Evidence older than the platform's refund window. Google and Meta typically review invalid activity within 60–90 days. Data older than that cannot support a new claim.

Key Terms and Definitions

• Click ID (fbclid, gclid, msclkid): A unique parameter appended by the ad platform to the landing-page URL, linking the visit to a specific impression and click.
• Attribution chain: The unbroken link from impression → click → landing page → conversion event → CRM outcome, all tied to the same click ID.
• Behavioral signals: Observable browser actions — scroll, pointer movement, typing rhythm, form corrections, viewport changes — that distinguish human interaction from automation.
• Pixel poisoning: When invalid traffic fires conversion pixels, corrupting the platform's optimization model so it bids more aggressively on similar low-quality traffic.
• Refund-ready report: A structured export containing click IDs, campaign hierarchy, timestamps, session recordings or signal logs, and signal-by-signal reasoning formatted for platform reviewer consumption.
• Cross-checked context: The practice of verifying that multiple independent signals (browser, network, device, behavior) tell the same story before labeling a session invalid.

FAQ

What is the minimum data I must capture on every paid landing page?

At minimum: the click ID (fbclid, gclid, or equivalent), campaign name, ad set name, creative ID, placement, device type, and timestamp. Store these in first-party storage before any redirect or consent wall can strip them.

How long should I keep session evidence?

Keep it for at least the platform's refund review window — typically 60 to 90 days from the click. If you have an open claim, retain evidence until the claim is resolved.

Can I use server-side logs alone for a refund claim?

Server-side logs help, but platforms require behavioral evidence (scroll, pointer, timing) that only client-side collection captures. The source pack notes server-side audits struggle to detect advanced botnets that mimic headers and rotate residential IPs.

What if the user rejects analytics cookies?

Capture the click ID before the consent prompt (it's in the URL, not a cookie). Delay behavioral recording until consent is granted. You still preserve attribution; you just have a behavioral gap for non-consenting users.

How do I know if my evidence format is acceptable to Google or Meta?

Check whether your export includes: click ID, full campaign hierarchy, placement, timestamp, device, session recording or structured signal log, and a plain-language explanation of each signal's finding. The source pack states BotRefund builds reports in the format platform teams use to review invalid traffic claims.

Does preserving context hurt page speed?

A lightweight client-side script (under 10 KB gzipped) that captures click IDs on load and streams behavioral events asynchronously adds negligible latency. The source pack's detection script runs 110+ checks without blocking page interaction.

When should I involve a specialist service instead of building this myself?

If you spend over $10,000/month on paid social or search, have had refund claims denied, or lack engineering bandwidth to maintain 100+ signal checks and platform-specific report formatting, a specialist service that negotiates with Google and Meta on your behalf can be more efficient. The source pack notes BotRefund has worked through 2,500+ audits and knows how to present evidence to platform reviewers.

Direct answer: what to preserve and when

Before you change targeting, pause a campaign, or swap creative, capture the complete attribution chain for every paid click you may later dispute. That means exporting the click identifier (GCLID for Google, FBCLID or fbclid for Meta), the exact timestamp of the click, the full campaign–ad set–ad–placement hierarchy, the landing-page URL with all query parameters, and any client-side session recording or behavioral log tied to that click. Store these in a read-only archive (CSV, JSON, or a dedicated evidence folder) that is separate from your live analytics. Do this before you make any campaign change, because pausing or editing a campaign can break the link between the platform’s internal click record and your exported data.

Platform refund teams (Google’s Invalid Activity team, Meta’s Traffic Quality team) review evidence against their own click logs. If your export misses the original click ID or timestamp, or if the campaign structure has shifted, the reviewer cannot match your claim to their data and the claim is denied. The preservation step is not optional — it is the prerequisite that makes a refund request reviewable.

Why original dates and attribution break when you don’t act early

Ad platforms attribute conversions and quality signals to the click that started the session. When you pause a campaign, rename an ad set, or move an ad to a new campaign, the platform’s UI often re-aggregates historical data under the new structure. The raw click-level logs still exist on the platform side, but your ability to join them to a human-readable campaign name, placement, or creative disappears from the standard reporting interface. If you wait until after a change to pull a report, you lose the exact mapping that a refund reviewer needs.

Meta campaigns can reach people across Facebook, Instagram, and eligible partner inventory at high volume. That reach is valuable, but it also means a lead campaign can receive accidental interactions, low-intent traffic, automated browsing, and deliberately fraudulent submissions. A structured audit that compares ad-platform data, website sessions, and CRM outcomes before changing targeting or making a refund request is the only way to keep the evidence chain intact.

Exact data points you must capture for each click

• Click identifier: GCLID (Google Ads), FBCLID/fbclid (Meta), or the platform-specific click ID parameter.
• Timestamp: ISO 8601 date-time of the click (including timezone), not just the date.
• Campaign hierarchy: Campaign ID, campaign name, ad set ID, ad set name, ad ID, ad name — exactly as they exist at the moment of the click.
• Placement: Platform-reported placement (e.g., Facebook Feed, Instagram Stories, Audience Network, Google Search Partners, YouTube In-Stream).
• Device and network context: Device type, OS, browser, IP subnet (first three octets), and any VPN/proxy flag your detection layer provides.
• Landing-page URL: Full URL with all UTM and click-ID parameters preserved.
• Session evidence: Client-side behavioral log (mouse movement, scroll depth, form interaction timing, honeypot triggers, scrollbar-width leak, clean-context iframe result) tied to the same click ID.
• Conversion outcome: Whether the session produced a lead, purchase, or other conversion event, and the CRM status (contacted, qualified, disqualified).

BotRefund turns each finding into a refund-ready report with click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning. The evidence is structured in the format platform teams use to review invalid traffic claims.

Step-by-step preservation workflow

1. Enable click-ID capture on every landing page. Ensure your tag manager or first-party script reads the GCLID/FBCLID from the URL and writes it to a first-party cookie or local storage before any redirect or form submit.
2. Log the full campaign hierarchy at click time. Use the platform’s ValueTrack (Google) or URL parameters (Meta) to pass campaign, ad set, ad, and placement IDs into the landing page. Store them alongside the click ID.
3. Record the client-side session. Deploy a behavioral detection script that captures pointer behavior, scroll behavior, speed behavior, and evasion checks (e.g., scrollbar-width leak, clean-context iframe) and attaches the click ID to the session record.
4. Export daily (or per-batch) evidence packages. Automate a daily job that pulls: platform click-performance report (with click IDs), your first-party session log, and CRM lead status. Save as immutable files (e.g., write-once cloud storage with versioning).
5. Freeze the campaign structure before changes. Before pausing, renaming, or restructuring, take a snapshot of the entire campaign tree (API export or UI CSV). Label it with the date and reason (e.g., “2024-01-15_pre-refund-audit_snapshot”).
6. Match platform credits to your evidence. When Google issues an automatic invalid-activity credit or Meta shows a traffic-quality adjustment, join the platform’s credit line items to your click-ID archive. Only matched clicks become claim line items.
7. Build the refund-ready report. For each disputed click, include: click ID, timestamp, campaign hierarchy, placement, session recording link, behavioral signal summary, and CRM outcome. Format as a single PDF or CSV per platform’s specification.

Organizing evidence for Google vs. Meta review teams

Google’s Invalid Activity team expects a CSV with columns: Click ID (GCLID), Click Timestamp, Campaign ID, Ad Group ID, Ad ID, Criterion ID (placement/keyword), Invalid Click Type (if known), and your evidence reference (session ID). They match this against their internal click logs. Meta’s Traffic Quality team requires a similar structure but uses FBCLID/fbclid and expects placement breakdown by Facebook Feed, Instagram, Audience Network, and Messenger. Both platforms reject claims where the click ID is missing, truncated, or cannot be joined to a live campaign structure.

Reports in the format Google and Meta accept — we turn each finding into a refund-ready report with click IDs, campaign details, timestamps, session recordings, and signal-by-signal reasoning. The evidence is structured in the format platform teams use to review invalid traffic claims.

Common mistakes that destroy refund evidence

Verification step: confirm your archive is review-ready

Pick a random date from the last 30 days. Pull the platform’s click-performance report for that date (include click IDs). Join it to your first-party session log on click ID. Verify that every row has: a valid click ID, a timestamp matching the platform’s timestamp (within seconds), a complete campaign hierarchy, a placement value, and a session recording or behavioral summary. If any column is blank or mismatched, your preservation pipeline has a gap — fix it before you need to file a claim.

Limitations and when this advice does not apply

• Automatic platform credits (Google’s nightly invalid-activity credit, Meta’s automatic traffic-quality adjustments) are issued without a claim. You cannot influence them, but you should still archive the data to audit whether the credit matches your observed invalid traffic.
• If you have never captured click IDs on your landing pages, you cannot retroactively create them for past clicks. Start capture today; past periods are unrecoverable.
• This process applies to paid-click refunds (Google Ads, Meta Ads). It does not cover tax refunds, chargebacks, or merchant refunds — the SERP results for “preserve original dates for refund review” often refer to IRS protective claims, which are a completely different domain.
• Platforms impose claim windows (typically 60–90 days for manual claims). Preserved data older than the window cannot be claimed, though it remains useful for pattern analysis.

Key facts from BotRefund source pack

Terminology quick reference

• GCLID: Google Click Identifier — unique parameter appended to landing-page URLs for Google Ads clicks.
• FBCLID / fbclid: Facebook Click Identifier — Meta’s equivalent click-tracking parameter.
• Click ID: Generic term for the platform-specific unique identifier tied to a single paid click.
• Attribution chain: The full hierarchy (campaign → ad set → ad → placement → click ID) that links a click to its source.
• Invalid activity / invalid traffic: Clicks or impressions the platform determines are not genuine user interest (bots, click farms, accidental taps, competitor fraud).
• Refund-ready report: Evidence package formatted to the platform’s review-team specification (CSV/PDF with required columns).
• Client-side detection: Behavioral analysis running in the visitor’s browser (mouse, scroll, timing, browser API checks) as opposed to server-log analysis.

FAQ

How far back can I claim a refund if I have preserved data?

Google and Meta generally allow manual claims for 60–90 days from the click date. Automatic credits may cover a longer lookback but are not disputable. Preserved data beyond the claim window is still valuable for trend analysis and negotiating larger adjustments.

Do I need a third-party tool to capture click IDs?

You can capture GCLID/FBCLID with a simple GTM variable and first-party cookie. However, tying that click ID to behavioral evidence (mouse movement, scroll depth, evasion checks) and exporting a platform-formatted report is where a dedicated detection layer like BotRefund saves hours of engineering.

What if the platform already issued an automatic credit?

Download the credit line items (Google: Billing → Invalid Activity; Meta: Billing → Traffic Quality). Join them to your click-ID archive. If the credit covers fewer clicks than your evidence shows, file a manual claim for the delta with your per-click evidence.

Can I preserve dates after I’ve already restructured campaigns?

You can pull historical click-performance reports via API (Google Ads API, Meta Marketing API) which still contain click IDs and timestamps for past dates, even if the UI has re-aggregated. Do this immediately — API retention is not guaranteed forever.

What does a refund-ready report actually look like?

One row per disputed click. Columns: Click ID, Click Timestamp (ISO 8601), Campaign ID, Campaign Name, Ad Set ID, Ad Set Name, Ad ID, Ad Name, Placement, Device Type, IP Subnet, Session ID, Behavioral Signal Summary (e.g., “superhuman input speed <1ms, no scroll, honeypot triggered”), CRM Outcome (e.g., “disconnected number, invalid email”). Attach session recording links in a separate column or appendix.

Does preserving original dates guarantee a refund?

No. It makes your claim reviewable. The platform still decides whether the clicks meet their invalid-activity definition. BotRefund’s 83% recovery rate across 2,500+ audits comes from 99% detection confidence, platform-formatted reports, and negotiation experience — not from preservation alone.

Should I pause suspected bad placements before or after preserving data?

After. Export the click-ID archive and campaign snapshot first, then pause. Pausing first risks losing the placement-level attribution in the UI.