The Best Approach to Device-Level Aggression When Sample Size Is Low

When to Suspect a Device Group

Device-level aggression means blocking an entire device group—such as a specific OS version, browser, or device model—based on a small number of suspicious events. The best approach is to hold off on blocking until you have enough data. A good rule of thumb: if the group has fewer than 50 clicks, flag it as suspect but do not block it. Instead, monitor it for at least a week. If the suspicious pattern continues, then consider manual blocking.

Readiness Checklist: Steps to Take Before Blocking

• Check the sample size: Count clicks or conversions for the device group. Below 50 clicks? Move to monitoring.
• Review the time window: Look at the last 7 days. A short spike is not a trend.
• Compare with baseline: Compare the device group's click-through rate, conversion rate, or error rate to your account average. A small deviation may be noise.
• Investigate the source: Use platform reports (e.g., Meta Ads Manager) to see if the traffic is concentrated in one placement, like Audience Network, which often has higher bot activity (S4).
• Preserve attribution: Before making any changes, export click IDs, timestamps, and campaign context. This evidence is needed if you later request a refund (S5).
• Set up a manual review process: Create a rule that moves low-sample device groups to a “recommended” or “suspect” status instead of automatically blocking them.

Worked Example: Applying the Block-vs-Monitor Rule

Imagine you run a lead-generation campaign on Meta. You notice that the device group "Android 13 / Chrome 119" has 32 clicks over the past 7 days. The click-through rate is 4.2%, double your account average of 2.1%. However, zero leads came from those clicks. The traffic comes entirely from Audience Network placements.

Step 1: Sample size is 32 clicks, which is below the 50-click threshold. You mark the group as "suspect" in your tracking sheet.

Step 2: You check the 7-day window. The clicks are spread across 5 days, not a single spike.

Step 3: You compare baseline metrics. The bounce rate for this group is 95% versus 60% account average. Time on page is under 2 seconds.

Step 4: You see the placement concentration. All clicks are from Audience Network. According to BotRefund (S4), Audience Network often has higher bot activity.

Step 5: You export click IDs (GCLIDs/FBCLIDs) and timestamps for the 32 clicks. You save them in a CSV for potential refund claims.

Step 6: You set a calendar reminder to review this group in one week. If the pattern holds (e.g., another 30+ clicks with zero leads and high bounce), you will manually block the device group at the placement level first.

Step-by-Step Guide: Building a 7-Day Device-Group Report in Meta Ads Manager and Google Ads

Meta Ads Manager

1. Open Ads Manager and go to the "Reports" tab.
2. Click "Create Report" and choose "Custom Report".
3. Set the date range to "Last 7 days".
4. In "Breakdown", select "Device" then "Operating System" or "Device Model" as needed.
5. Add metrics: Clicks, Impressions, CTR, Cost per Click, Landing Page Views, Leads (or Conversions).
6. Apply a filter: "Clicks" less than 50.
7. Save the report with a name like "Low-Sample Device Groups - 7 Day".
8. Schedule weekly email delivery to yourself or your team.

Google Ads

1. In Google Ads, navigate to "Reports" > "Predefined reports" > "Basic" > "Device".
2. Set the date range to "Last 7 days".
3. Add segments: "Device model" or "Operating system version".
4. Include columns: Clicks, Impr., CTR, Avg. CPC, Conversions, Cost/conv.
5. Download the report as CSV.
6. In Excel or Google Sheets, filter the "Clicks" column to show only rows with fewer than 50 clicks.
7. Add a column for "Status" with values "Monitor" or "Block".
8. Save the file in a shared folder for weekly review.

Signs to Wait: When a Low-Sample Device Group Is Not a Threat

Not every suspicious-looking device group is fraudulent. Delay blocking if:

• The group has fewer than 50 clicks and the pattern is not repeating.
• Traffic comes from a newly released device or OS version that naturally has low volume.
• The spike happened during a promotional campaign or seasonal event—legitimate users may behave differently.
• Your conversion tracking setup has a known issue, such as missing consent or slow page load, that could cause data gaps.
• The suspicious activity is isolated to a single day and does not persist.

Exception: When Immediate Blocking Is Justified

In rare cases, you can block a device group with low sample size. Do this only if:

• The group shows clear evidence of coordinated fraud, such as identical form submissions from multiple devices at the same second.
• The device group is a known source of invalid traffic from past audits (e.g., a specific IP range or data center).
• You are losing a significant amount of budget (e.g., over $1,000 per day) from that single group, and the pattern is unmistakable.

Even then, prefer to block at the placement level first rather than the entire device group.

Decision Table for Edge Cases

Scenario	Recommended Action	Reason
Account receives < 100 clicks/week total	Extend monitoring to 2-3 weeks before deciding	50 clicks may be a large portion of data; need more time to establish pattern
Suspicious traffic isolated to one placement (e.g., Audience Network)	Block placement first, keep device group active	Placement-level blocking is more precise and preserves legitimate traffic on other placements
Device group is a brand-new OS version (released < 30 days)	Monitor for 14 days, compare to similar new versions	New versions naturally have low volume and unstable metrics
High CTR but zero conversions, sample 30 clicks	Check landing page for technical issues; monitor 7 more days	Could be tracking breakage, not fraud
Known bot signature from third-party audit (e.g., BotRefund)	Block immediately at device group level	Behavioral evidence (ghost clicks, trap interactions) overrides sample size (S2)

How to Set Up a Monitoring Workflow

Use a simple two-step process:

1. Create a saved report in your ad platform that shows device group performance over the last 7 days. Filter for groups with fewer than 50 clicks.
2. Review the report weekly. If a group shows consistent poor quality (e.g., high bounce rate, no conversions, fast form fills) for two consecutive weeks, escalate to manual blocking.

For more advanced detection, tools like BotRefund can automatically flag device groups with abnormal behavior patterns, even when sample sizes are low. Their client-side audit captures behavioral signals like mouse movement, session duration, and form interaction speed—giving you evidence to decide whether to block or wait (S2).

Key Facts: Device Group Aggression and Invalid Traffic

Fact	Detail	Source
Minimum sample size to consider blocking	50 clicks or more; below that, treat as suspect	Editorial guideline
Time window for monitoring	7 days minimum before deciding to block	Recommended threshold
Bot traffic share	Automated traffic can exceed 50% of web traffic (Imperva 2025), but not all of it is fraud	BotRefund blog (S6)
Refund success rate	83% of BotRefund customers successfully get a refund from Google or Meta	BotRefund homepage (S2)
Budget wasted by bots	Bot clicks can steal up to 20% of your ad budget	BotRefund homepage (S2)
Behavioral detection signals	BotRefund uses ghost clicks, trap interactions, unnatural mouse paths, and superhuman input speed	BotRefund homepage (S2)

Limitations of This Approach

This approach works best for accounts with moderate to high traffic. If your entire account receives fewer than 100 clicks per week, even 50 clicks may be a large portion of your data. In that case, monitor for 2-3 weeks before making a decision. Also, this advice applies to device groups, not to individual IP addresses or user agents. For very low-traffic accounts, consider using a third-party detection tool that can pool data across accounts or use behavioral signals that do not require large sample sizes.

Terminology

• Device group: A set of devices sharing the same operating system, browser, or model (e.g., iOS 15.4, Chrome 120, Samsung Galaxy S22).
• Sample size: The number of clicks or conversions recorded for a device group in a given period.
• Device-level aggression: The practice of blocking an entire device group based on limited data.
• Invalid traffic: Clicks or impressions that are not the result of genuine user interest, including bots and accidental clicks.

Frequently Asked Questions

Why is 50 clicks the recommended minimum?

Below 50 clicks, the data is too noisy to distinguish between a real threat and random variation. Statistically, you need at least 30-50 events to have any confidence in a rate or pattern.

What if the device group has very high click-through rate but no conversions?

That is a red flag, but still wait for 50 clicks and a week of data. It could be a technical issue with your landing page or tracking.

Can I use a tool to automate this monitoring?

Yes. BotRefund offers a free audit that automatically detects suspicious device groups and provides video evidence of bot behavior. This can speed up your decision process.

How do I know if my ad platform already blocks low-sample device groups?

Platforms like Meta and Google have automated systems that may block device groups with very few events. But they are not perfect. Manual oversight is still needed.

What if I block a device group by mistake?

It can cut off legitimate users and distort your campaign optimization. That is why the wait-and-monitor approach is safer. If you accidentally block, you can restore the group in your ad platform's invalid traffic list.

Does this approach work for both Google and Meta campaigns?

Yes. The same logic applies to any ad platform that reports device-level data. The sample size threshold may vary, but the principle of avoiding premature blocking holds.

How much does it cost to use a tool like BotRefund?

BotRefund offers a free bot audit with no credit card required. Pricing is based on ad spend range. Check their website for details.

Further Reading

These sources from the provided pack cover invalid traffic, bot detection, and refund workflows:

• Meta Ads Invalid Traffic: What Advertisers Can Measure and Block (S1)
• Facebook Ad Bot Detection: How to Identify Fake Traffic and Reclaim Social Ad Spend (S3)
• Facebook Ads Getting Bot Traffic? How to Secure Your Meta Campaigns (S4)
• Google Ads Invalid Activity Credit: How It Works and How to Get Your Money Back (S5)
• How to Audit Meta Lead Quality in Your CRM (S6)
• Click Fraud Impact on ROAS: How Invalid Traffic Destroys Your Return on Ad Spend (S7)

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• An empirically based power primer for laboratory aggression ...
• Low‒Level Aggression: Definition, Escalation, Intervention
• Introduction - Strategies To De-escalate Aggressive Behavior in ...

Learn more

Visit the website for more information.