Seatext library / BotRefund evidence
When Does a High Duplicate Rate Signal a Bot Problem? A Readiness Checklist
A high duplicate rate points to bots when it exceeds roughly 25%, submissions arrive in tight clusters of seconds or minutes, timestamps match across campaigns, velocity from a single IP or ASN is extreme,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
If your lead forms or conversion pixels show the same data arriving over and over, the first question is whether real people are double-submitting or something automated is replaying requests. The short answer: suspect bots when the duplicate rate pushes past 25%, submissions land in bursts of seconds or minutes, identical timestamps appear across different campaigns, a single IP or ASN delivers high velocity, or form completion takes less than three seconds. Human resubmissions usually have think-time between attempts, varied intervals, and different device or network fingerprints.
What duplicate rate means in ad traffic
Duplicate rate measures how often the same lead data — email, phone, name, or click ID — appears more than once in your CRM or analytics within a short window. A certain amount is normal: people refresh pages, hit back buttons, or submit twice by accident. The problem starts when the pattern stops looking like human hesitation and starts looking like a script.
Meta and Google both track invalid activity, but their automated filters catch only a fraction. According to BotRefund's analysis, up to 20% of ad traffic on Google and Meta can be non-human, and the platform's own invalid-activity credits often miss sophisticated botnets that use residential proxies and browser automation.
Why does this matter? Duplicate leads poison your conversion data. When Meta's pixel sees the same conversion fire repeatedly, the algorithm learns to optimize for that pattern. You end up paying for more bot traffic because the system thinks it's working. Your cost per real lead rises while your reported cost per lead looks fine.
Threshold signals that point to bots
- Duplicate rate above 25%. Below this, most duplicates are genuine resubmissions. Above it, the volume usually exceeds what human error explains.
- Burst clustering. Ten leads with the same email arriving within 60 seconds is not a user clicking twice. It's a loop.
- Identical timestamps across campaigns. If the same lead fires at 14:03:12 in Campaign A and 14:03:12 in Campaign B, a single automated process triggered both.
- High velocity from one IP or ASN. Hundreds of submissions from a single autonomous system number in minutes indicates a proxy farm, not a coffee shop.
- Form completion under three seconds. Humans need time to read, type, correct, and submit. Sub-three-second completions are a classic bot fingerprint.
These thresholds come from pattern analysis across thousands of campaigns. They are not absolute rules. A sophisticated botnet might throttle submissions to stay under 25% while still poisoning data. Treat thresholds as investigation triggers, not verdicts.
Timing patterns that distinguish bots from humans
Human behavior has variance. A person might submit, realize a typo, go back, fix it, and submit again — two to five minutes later. Bots either fire instantly (milliseconds apart) or on a fixed schedule (every 30 seconds). Look at the inter-arrival distribution: a tight peak at zero or a regular interval is a red flag; a spread of minutes to hours is normal.
BotRefund's detection looks for "superhuman input speed (<1ms)" and "absence of humanlike mouse tremor" — signals that only client-side behavioral tracking can capture. Server logs alone miss these because the HTTP requests look perfectly formed.
Practical scenario: You see 50 duplicates in one hour. Check the timestamps. If they land at 10:00:01, 10:00:31, 10:01:01, that's a cron job. If they land at 10:02, 10:07, 10:15, 10:23, that's a human fixing errors. The first pattern warrants an immediate block and refund claim. The second warrants a form usability review.
Technical fingerprints: IP, ASN, device, and session
Real users come from diverse IPs, device types, screen resolutions, and browser versions. Bot traffic often shows:
- Single IP or tight CIDR block delivering disproportionate volume
- ASN ownership by hosting providers, VPNs, or proxy services
- Identical user-agent strings across hundreds of sessions
- Missing or inconsistent client hints (screen size, battery, touch support)
- No scroll, no mouse movement, no focus events before submit
BotRefund flags "grid-aligned movement patterns" and "robotic linear mouse movements" as telltale signs that the session never had a human at the keyboard.
Decision criteria: When you see three or more of these signals together, the probability of bot traffic exceeds 90%. A single signal (e.g., same user-agent) could be a corporate network. Combined with no scroll events and sub-second form fills, it's automation.
Form completion behavior: speed, corrections, and honeypots
A human types, pauses, backspaces, retypes. Bots fill fields in a single DOM write or via autofill APIs. Honeypot fields — hidden inputs that humans never see — get filled only by scrapers. BotRefund watches for "honeypot trap interactions" and "absence of clicks or scrolling" to separate automated submissions from real ones.
If your form analytics show zero field-focus events, zero keystrokes, and instant submit, the duplicate is almost certainly bot-generated.
Mechanics: Modern bots use headless browsers (Puppeteer, Playwright) that execute JavaScript and render pixels. They can trigger conversion events without a human ever seeing the page. Client-side behavioral scripts detect this by measuring time-to-first-keystroke, scroll depth, mouse entropy, and focus/blur sequences. Server-side logs see a perfect form POST. Client-side sees a ghost session.
Campaign-level patterns: placement, creative, and audience expansion
Duplicates that concentrate in one placement (e.g., Meta Audience Network), one creative, or one expanded audience segment suggest the fraud source is tied to that delivery path. The BotRefund blog notes that "a sharp lead-quality difference by placement, creative, audience expansion, device, or landing page" is a signal worth investigating. If turning off Audience Network cuts duplicates by 80%, you've found the vector.
Why Audience Network? Third-party app publishers sometimes run click bots to inflate revenue. These bots click ads, land on your page, and fire conversion pixels to make the placement look high-performing. Meta's default filters miss this because the traffic comes from real devices on residential IPs.
Practical workflow: Segment your duplicate report by placement. If 90% of duplicates come from Audience Network but only 20% of spend goes there, exclude the placement. Monitor for two weeks. If duplicates drop and lead quality rises, you've isolated the source without needing a refund claim.
When to escalate to Meta or Google support
Escalate when you have:
- Client-side behavioral logs showing sub-three-second completions, no scroll, no mouse tremor
- Click IDs (FBCLID/GCLID) tied to those sessions
- Duplicate rate >25% sustained over 7+ days
- Clear placement or audience correlation
- CRM outcome data: high lead count, zero qualified opportunities
BotRefund prepares "compliance-ready refund reports" with this evidence and negotiates directly with Google and Meta, citing an 83% refund success rate for high-volume advertisers. Platforms require specific evidence formats; raw server logs rarely suffice.
Evidence checklist for a support ticket:
- CSV of suspicious sessions with timestamps, click IDs, IPs, user-agents
- Behavioral metrics per session: form fill time, scroll depth, mouse events, keystroke count
- Honeypot trigger logs
- Placement/creative breakdown showing concentration
- CRM outcome export: lead status, contact attempts, qualification results
Limitations and when this checklist does not apply
- Low-volume campaigns. Thresholds like 25% duplicate rate are statistically noisy under 100 leads/week.
- Legitimate high-velocity sources. Webinar registrations, flash sales, or viral content can produce bursty human traffic that mimics bots.
- CRM deduplication logic. Some systems count the same lead twice if it enters via different forms; audit your pipeline first.
- Platform auto-credits. Google and Meta sometimes issue invalid-activity credits automatically; check billing before filing a manual claim.
- Residential proxy botnets. Advanced botnets rotate clean residential IPs, making IP/ASN analysis less reliable. Behavioral signals become primary.
Key facts
| Metric | Value | Source |
|---|---|---|
| Bot traffic share of ad clicks (Google + Meta) | Up to 20% | S2 |
| Refund success rate for high-volume advertisers | 83% | S2 |
| Superhuman input speed threshold | <1ms | S2 |
| Form completion time bot threshold | <3 seconds | Brief |
| Duplicate rate suspicion threshold | >25% | Brief |
| Detection methods used | Behavioral analysis, honeypots, pointer analysis, session analysis | S2, S6 |
FAQ
What counts as a duplicate lead?
Any submission where the identifying fields (email, phone, click ID) match an existing record within your defined lookback window — typically 24 to 72 hours.
Can't I just block the IP?
Modern botnets rotate residential proxies. Blocking one IP catches a fraction and risks blocking real users sharing that exit node. Behavioral detection at the browser level is more durable.
Does Meta's Audience Network cause more duplicates?
Yes. The BotRefund blog identifies Audience Network as a primary channel for bot traffic because third-party app publishers sometimes run click bots to inflate revenue.
How far back can I claim refunds?
BotRefund recovers Google Ads spend dating back to 2017. Meta's window varies; gather evidence as soon as you spot the pattern.
What if my duplicate rate is 15% but completions are instant?
Low rate with bot fingerprints still warrants investigation. The threshold is a guideline, not a rule. A small, fast botnet can poison pixel data without hitting 25%.
Do I need client-side tracking to prove bots?
Server logs show what arrived; client-side tracking shows how it arrived. Platforms require behavioral evidence (mouse, scroll, timing) for manual refund claims. BotRefund captures this automatically.
What's the difference between click fraud and form spam?
Click fraud burns budget on ad clicks. Form spam poisons conversion data and wastes sales time. Both often come from the same botnets. BotRefund addresses both by protecting the pixel and capturing lead-level evidence.
How do I know if my CRM is double-counting?
Export raw form submissions with timestamps and compare to CRM records. If the same submission ID appears twice in CRM but once in form logs, your deduplication logic is the issue, not bots.
Can bots bypass honeypots?
Sophisticated bots can detect hidden fields via CSS analysis. Rotate honeypot names, use CSS-only hiding (not display:none), and add time-based validation. No single trap catches everything.
What's the fastest way to stop the bleeding?
Exclude the worst placement (usually Audience Network), enable client-side behavioral blocking, and start collecting evidence for a refund claim. Do not pause campaigns — you lose pixel momentum.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.