Seatext library / BotRefund evidence
What Is the CPU Concurrency Lie and How Bot Detection Catches It
The CPU concurrency lie happens when a bot reports a false number of CPU cores to mimic a human device. Bot detection systems such as BotRefund flag it because real browsers show hardware details...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
The CPU concurrency lie happens when a bot or automated browser reports a false CPU core count to a website, pretending to run on a normal human device. It affects bot detection because a real browser reports hardware details that naturally fit together, while a spoofed profile often shows a mismatch—claiming one machine while its processor, graphics, or system behavior tells another story.
What exactly is the CPU concurrency lie?
Browsers expose a property called hardwareConcurrency through JavaScript. It tells a website how many logical CPU cores the visitor's machine has. A typical desktop might report 8 or 16, a phone might report 8, and an older laptop might report 4. That number becomes part of the browser fingerprint—a set of signals a site can read to identify the device.
Bots and automation tools need to control that fingerprint. If a bot running in a virtual machine reports 2 cores while claiming to be a high-end gaming PC, the story falls apart. So bot operators "lie" about the concurrency value, setting it to a number that looks typical for the device they are imitating.
That is the CPU concurrency lie: reporting a concurrency value that does not match the actual hardware or the rest of the browser profile. The lie is rarely the only problem. It usually appears alongside other mismatched signals, such as an unexpected GPU, a missing font set, or audio behavior that does not match the claimed device.
How bots use the concurrency lie to hide
Modern bot networks do not just send a request. They build a complete browser profile designed to pass fingerprint checks. The concurrency value is one of the easiest numbers to set, and it is also one of the easiest to get wrong.
A common pattern looks like this:
- A bot operator runs automation in a data center or virtual machine.
- The framework reports a hardwareConcurrency value that comes from the host server, not the emulated device.
- To avoid that, the operator overrides the value to something like "8" or "16" without checking what the rest of the profile implies.
- The result is a profile that claims a modern multi-core machine while the GPU, fonts, or operating system strings point to a simpler device.
That mismatch is exactly what the concurrency lie check looks for. BotRefund compares the reported concurrency against other hardware and browser signals to see whether the full story fits together. It is one of 106 independent checks the service uses to build a reliable picture of whether a visit is human or automated.
The common mistake: treating one signal as a bot verdict
Here is the mistake many people make when they first hear about this check: they assume that a mismatched concurrency value proves the visitor is a bot. That is wrong.
A single anomaly is not a bot verdict. Real people can produce unusual values too. Privacy tools, travel setups, corporate networks, and uncommon devices can trigger unexpected behavior for genuine visitors. A VPN might route traffic through a server with different resources. An old machine might report fewer cores than a modern site expects. A privacy extension might intentionally scramble the fingerprint.
BotRefund keeps this signal as evidence, not a verdict. It cross-checks the concurrency lie against independent browser, network, device, and behavior data. Only when multiple signals point the same direction does the system conclude the visit is likely automated.
How BotRefund checks the concurrency signal
BotRefund treats the CPU concurrency lie as one objective fact about a visit. It does not make a decision from that fact alone. Instead, it follows a three-step process:
- Independent evidence. The system records whether the reported concurrency matches the rest of the hardware profile. This is one of 106 independent checks.
- Cross-checked context. BotRefund tests whether other signals support the same story. If the concurrency value is odd but the GPU, fonts, audio, and behavior all look human, the system does not jump to a bot verdict.
- AI prediction. The model weighs the complete pattern instead of trusting a raw rule. It looks across browser, network, device, and behavior evidence before classifying a visit.
That is why BotRefund reports 99% accuracy: the decision rests on corroboration, not one browser tell.
Practical scenarios where the concurrency lie matters
The concurrency lie shows up in several real situations, most of them connected to ad fraud or account abuse. Here are the common ones:
- Ad click fraud. Bots click Google or Meta ads to drain a competitor's budget or inflate a publisher's revenue. A bot profile that reports a fake core count is one signal among many.
- Fake registrations. A bot fills out a signup form on a search ad landing page. The concurrency lie helps separate that automated visit from a real customer.
- Scraping. A scraper loads a site repeatedly with an emulated device profile. The mismatch in hardware signals can expose the automation.
- Pixel poisoning. Fraud networks send fake conversion events to confuse ad-platform targeting. The concurrency check contributes to detecting those events before they corrupt the machine learning model.
The practical impact is budget. Bot clicks can steal up to 20% of a Google or Meta ad budget. Catching the concurrency lie, combined with dozens of other behavioral checks, lets a business prove the fraud and recover the money.
Key facts about BotRefund's detection
| Fact | Detail |
|---|---|
| Number of checks | 106 independent checks are used to build a reliable picture of a visit. |
| Signal role | The CPU Concurrency Lie check is evidence, not a verdict. |
| Cross-checking | Signals are tested against browser, network, device, and behavior data. |
| Decision method | AI prediction weighs the complete pattern instead of a raw rule. |
| Reported accuracy | BotRefund reports 99% accuracy from corroboration. |
| Setup time | Adding BotRefund to a website takes about one minute, with no credit card required. |
Limitations: when the concurrency check does not apply
The CPU concurrency check is not useful in every scenario, and pretending it is would hurt accuracy.
First, if a visitor uses a privacy-focused browser or a fingerprint-randomizing extension, the reported concurrency may be deliberately altered. That creates false signals for real users. BotRefund's design recognizes this. That is why the concurrency signal is never treated in isolation.
Second, the check is only meaningful on pages where a real browser would have executed JavaScript. If a bot loads a page without running the measurement, the system has to rely on other signals entirely.
Third, the concurrency lie can be told consistently. A well-built bot profile might set concurrency to a value that matches its emulated GPU and operating system perfectly. In that case, the concurrency check finds no anomaly, and detection depends on the other 105 checks.
Finally, the check does nothing by itself. It only matters when paired with contextual data: click patterns, mouse movement, timing, session length, and network behavior. A site that installs only the concurrency check and calls it done will miss modern bots.
What changes if you ignore the concurrency lie
If you ignore the CPU concurrency check, you lose one piece of corroborating evidence. A bot that reports a false core count can go unnoticed if every other signal happens to look clean. Over months, that traffic can inflate your click counts, distort your conversion data, and drain your ad budget.
Businesses that add BotRefund see the difference. In one case study, FinTrust, a neobank, recovered $140,000 in ad spend, cut its average bot click rate to 14%, and lifted conversion rate by 18% after suppressing automated browser emulation signals. The concurrency lie is one reason that kind of clean-up is possible—it is a small, specific tell that helps the AI build a reliable picture of who is really visiting.
Frequently asked questions
What does hardwareConcurrency actually report?
It reports the number of logical processor cores available to the browser. A normal desktop often shows 8 or 16, while a phone might show 8, and an older laptop might show 4.
Is the CPU concurrency lie the same as a fingerprint mismatch?
It is one type of fingerprint mismatch. The concurrency lie is specifically about the processor core count not matching the rest of the device profile.
Can a real user trigger the concurrency check?
Yes. Privacy tools, corporate networks, travel setups, and unusual hardware can produce values that look odd. That is why the check is evidence, not a verdict.
How many signals does BotRefund combine?
BotRefund uses 106 independent checks. The concurrency lie is one of them, and it is cross-checked against the others.
What should I do if I think bot clicks are wasting my ad budget?
You can run a free bot audit. BotRefund will inspect your website traffic and show whether automated visits are present.
How fast does BotRefund detect the concurrency lie?
BotRefund runs the check in real time as part of its page script. Setup takes about one minute, and the audit can start immediately.
Your next step
The concurrency lie is not a standalone test you can run once and trust forever. It is a signal that belongs inside a larger detection system. BotRefund combines it with 105 other checks, cross-references the results, and uses AI to decide. If you want to know whether your own site is receiving bot clicks, the practical next step is a free bot audit.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
How BotRefund can help
BotRefund runs the CPU Concurrency Lie check as one of 106 independent signals that build a picture of each visit. It does not judge a visitor on a single anomaly. Instead, it cross-checks the concurrency mismatch against browser, network, device, and behavior data, then feeds the complete pattern into its prediction AI. That is how BotRefund reports 99% accuracy in identifying bot versus human traffic.
The same system turns the evidence into a refund request. Bot clicks can steal up to 20% of Google and Meta ad budget, and BotRefund proves the clicks, negotiates with the platforms, and recovers the money. The free bot audit is the practical first step: it takes about one minute to add the script and requires no credit card.
A relevant limitation: the concurrency check alone never decides a verdict. If your traffic shows an odd core count but every other signal matches a real person, BotRefund will not flag it as a bot. The value comes from the full 106-signal model, not a single test.