Seatext library / BotRefund evidence
Session Replay Fraud Proof: How Visual Evidence Recovers Wasted Ad Spend
Session replay fraud proof is a video recording of a visitor's actual browser session that captures behavioral signals — mouse movements, click timing, scroll patterns, and navigation paths — revealing whether a click came...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Session replay fraud proof is a recorded playback of a visitor's browser session that shows exactly how they moved, clicked, scrolled, and navigated. Unlike aggregate analytics, it captures the micro-behaviors — tremor in mouse movement, natural click latency, organic scroll patterns — that distinguish real humans from automated scripts. When a click lacks these human signatures, the replay becomes visual evidence you can submit to Google Ads or Meta to request a refund for invalid traffic.
Why session replay matters for ad fraud detection
Click fraud and bot traffic drain up to 20% of Google and Meta ad budgets according to BotRefund's data. Standard filters in ad platforms catch some invalid clicks, but sophisticated bots mimic basic human actions well enough to slip through. Session replay closes that gap by recording the full behavioral context of each visit, not just the click event.
Ad platforms accept visual proof when you file a refund claim. A replay showing a cursor moving in perfectly straight lines at superhuman speed, or a session with zero scroll events and uniform duration, carries more weight than a spreadsheet of IP addresses. The evidence is concrete, timestamped, and difficult to dispute.
How session replay captures fraud signals
BotRefund's detection engine records sessions and analyzes them across seven behavioral dimensions. Each dimension targets a specific automation tell:
- Ghost click detection — catches clicks that fire without the natural sequence of human intent (no hover, no approach movement, no hesitation).
- Honeypot trap interactions — watches for bots that respond to hidden or deceptive page elements real users never see.
- Robotic linear mouse movements — flags unnaturally straight pointer paths that rarely appear in real sessions.
- Absence of humanlike mouse tremor — looks for the tiny imperfections and jitter typical of human movement; bots often move with mathematical precision.
- Superhuman input speed (<1ms) — identifies interactions faster than a person could realistically perform.
- Grid-aligned movement patterns — detects movement that snaps to precise lines or blocks instead of natural curves.
- Absence of clicks or scrolling — highlights sessions that stay too static to match a real browsing journey.
- Unnatural session durations — catches visit lengths that are too short, too long, or too uniform to be human.
These signals come from BotRefund's detection methodology and are recorded continuously for every paid click.
From replay to refund: the evidence chain
Having a replay is only step one. The evidence chain that leads to a refund looks like this:
- Tag every paid click — BotRefund adds a lightweight script to your site that binds each ad click (gclid, fbclid) to a session recording.
- Classify the session — the engine scores each session against the seven behavioral dimensions above.
- Export flagged sessions — sessions that fail multiple checks are packaged with timestamps, click IDs, and the video replay.
- Submit to the platform — you or BotRefund's team send the evidence package to Google Ads or Meta support with a formal refund request.
- Negotiate and recover — platforms review the visual proof; approved claims result in credit back to your ad account.
BotRefund reports an 83% success rate across client refund claims submitted to ad platforms, with recovery possible for Google Ads spend dating back to 2017.
Key facts at a glance
| Metric | Detail | Source |
|---|---|---|
| Bot click share of ad budget | Up to 20% of Google and Meta spend | S1 |
| Refund approval rate | 83% of customers successfully get a refund | S1 |
| Lookback window | Google Ads spend dating back to 2017 | S1 |
| Setup time | About one minute to add to website | S1 |
| Detection dimensions | 7 behavioral categories (click, trap, pointer, motion, speed, path, engagement, session) | S1, S2, S3, S4, S5, S6, S7 |
| Pricing tiers | Based on monthly Google/Meta spend: under $10K, $10K–$50K, $50K–$250K, $250K–$1M, over $1M | S1, S2 |
What session replay catches that other methods miss
IP blocklists and click-frequency filters rely on reputation or volume thresholds. They fail when:
- Bots rotate residential IPs or use clean proxy pools.
- Click volume stays low per IP to avoid rate limits.
- The bot executes JavaScript, loads assets, and fires analytics events — looking "real" to server-side logs.
Session replay operates at the browser level. It sees the how, not just the what. A bot that perfectly loads your page but moves its cursor in a straight line at 5000px/second with zero tremor is instantly flagged, even if its IP is pristine and its user-agent matches Chrome on macOS.
Limitations and when replay isn't enough
Session replay is powerful but not a silver bullet:
- Privacy regulations — GDPR, CCPA, and ePrivacy require consent for session recording. BotRefund's script only activates on paid clicks (gclid/fbclid present), which narrows scope, but you still need a lawful basis and clear disclosure.
- Mobile and app traffic — replay works best on desktop web. Mobile browsers restrict some APIs; in-app traffic (Instagram, Facebook mobile app) often opens in webviews with limited recording capability.
- Sophisticated human fraud — click farms with real people clicking ads won't trigger bot behavioral signals. Replay shows human movement, so this fraud type requires different detection (e.g., conversion quality analysis).
- Platform discretion — Google and Meta ultimately decide refund approval. Strong evidence improves odds but doesn't guarantee payment.
How BotRefund differs from general session replay tools
Tools like Mixpanel Session Replay, Hotjar, or FullStory record sessions for product analytics and UX research. They can incidentally reveal fraud, but they aren't built for ad-click attribution or refund workflows. Key differences:
| Capability | General replay tools | BotRefund |
|---|---|---|
| Ad-click binding (gclid/fbclid) | Manual or not supported | Automatic on every paid click |
| Bot behavioral scoring | Not built-in | 7-dimension engine |
| Refund-ready evidence export | Manual video clipping | Packaged with click IDs, timestamps, scores |
| Platform negotiation support | None | Team handles disputes |
| Lookback recovery | Limited to retention window | Google Ads back to 2017 |
If your goal is recovering ad spend, a purpose-built tool saves weeks of manual work per claim.
Practical scenarios where replay proof wins refunds
Scenario 1: Competitor click bot
A competitor runs a script that clicks your Google Ads daily from a rotating proxy pool. Each click loads the landing page, fires GA, and bounces in 3 seconds. IP filters miss it because IPs are clean. Session replay shows: zero mouse movement, zero scroll, session duration exactly 3.0s every time. Refund approved.
Scenario 2: Affiliate fraud
An affiliate stuffs your Meta click ID into a traffic bot to inflate their commission. Replay reveals honeypot trap clicks (hidden elements only bots find) and grid-aligned mouse paths. Evidence submitted; affiliate banned, spend recovered.
Scenario 3: Click farm with real humans
Real people in a click farm click your ads. Replay shows human movement — this won't flag as bot traffic. You need conversion-level analysis (no purchases, no form fills, high bounce) combined with geographic anomalies. Session replay alone isn't sufficient here.
Terminology quick reference
- gclid / fbclid — Google Click ID / Facebook Click ID; query parameters appended to ad destination URLs that identify the specific paid click.
- Session replay — A video-like reconstruction of a user's browser session (DOM mutations, mouse position, scroll, input) rendered for playback.
- Honeypot — A hidden page element (link, button, form field) invisible to humans but detectable by bots scraping the DOM.
- Mouse tremor — The microscopic, involuntary jitter in human cursor movement caused by motor control imperfections; absent in most scripted automation.
- Invalid traffic (IVT) — Google and Meta's term for clicks that don't come from genuine user interest (bots, click farms, accidental clicks).
- Lookback window — How far back a platform allows refund claims; Google Ads permits disputes for spend back to 2017 with sufficient evidence.
Frequently asked questions
Does session replay work on mobile traffic?
Partially. Mobile web (Chrome/Safari on phones) supports most recording APIs, but gesture data (touch, pinch) differs from mouse events. In-app browsers (Facebook app, Instagram app) often restrict recording. BotRefund focuses on desktop and mobile web where paid clicks land.
Is recording sessions legal under GDPR/CCPA?
Yes, if you have a lawful basis (legitimate interest for fraud prevention is commonly cited) and provide clear notice. BotRefund only records sessions that arrive with a gclid or fbclid — paid traffic — which narrows the data scope significantly. You should still update your privacy policy and cookie banner.
How long does a refund claim take?
Typically 2–6 weeks from submission to credit, depending on platform queue and evidence completeness. BotRefund's team manages the back-and-forth with Google/Meta support.
What if the platform rejects the claim?
You can appeal with additional evidence (e.g., server logs, conversion data). BotRefund includes escalation support for enterprise clients. There's no guarantee — platforms have final say — but the 83% approval rate suggests strong evidence usually works.
Can I use my existing Hotjar/FullStory recordings for refunds?
Technically yes, but you'd need to manually find the sessions matching each click ID, clip the relevant segments, and format the submission. Purpose-built tools automate this end-to-end.
What's the minimum ad spend to make this worthwhile?
BotRefund's pricing starts at under $10K/mo monthly spend. Below that, the absolute dollar recovery may not justify the subscription. The free bot audit lets you see the scale of the problem before committing.
Does BotRefund block bots in real time?
No — it's a detection and recovery tool, not a WAF or bot blocker. It identifies fraudulent clicks after they happen and builds the evidence for refunds. For real-time blocking, you'd pair it with a traffic filtering solution.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.