When to Review Session Replays After a Suspected Fraud Event

The Right Time to Review

When a fraud alert fires, the clock starts. Review the session replay within 24–48 hours while the session is still fresh in your mind and the evidence is easy to interpret. But don't wait to preserve it. Lock the replay in immutable storage the moment the alert appears. That way, even if you delay the deep review, the original session is safe for a refund dispute or investigation.

Why 24–48 hours? Because memory fades, and so does context. You might remember a campaign change or a traffic spike that explains what you see. Waiting longer makes it harder to connect the replay to the alert. Also, ad platforms like Google and Meta expect timely disputes. Delaying your review can weaken your refund claim.

Readiness Checklist for Timely Replay Review

Before you need to review a replay, make sure you have these in place. This checklist helps you act fast without scrambling.

• Immutable storage is set up. Your replay tool should automatically save sessions to a write-once location. No one can edit or delete them.
• Alert rules are defined. Know which behaviors trigger a fraud alert: ghost clicks, robotic mouse movements, superhuman input speed, or unnatural session durations.
• Access is ready. The person who reviews replays has login access and knows how to filter by alert type and timestamp.
• A review template exists. Use a simple form to record what you see: click path, pointer movement, scroll behavior, time on page, and any form fills.
• Escalation path is clear. If the replay confirms fraud, you know who to notify and what evidence to export.
• Backup reviewer is assigned. If the primary reviewer is away, someone else can step in within 24 hours.

Signs You Should Wait Before Reviewing

Sometimes reviewing immediately is a mistake. Wait if any of these are true:

• The alert is ambiguous. A single fast click might be a misclick, not a bot. Wait until you have more data or a second alert.
• You lack context. If you don't know what campaign or landing page the session came from, you might misinterpret normal behavior.
• The replay is corrupted. If the video won't load or the data is incomplete, don't force a review. Get a fresh capture or check the raw logs.
• A legal hold is in place. If you're in litigation, follow your legal team's instructions before touching any evidence.

Exception: if the fraud is ongoing and costing you money every minute, don't wait. Review immediately and block the source. The 24–48 hour window is a target, not a hard rule.

Why the 24–48 Hour Window Matters

Session replays are time-sensitive for three reasons.

1. Memory and context. You might remember a new ad creative or a traffic spike that explains what you see. After two days, that context is gone.

2. Platform deadlines. Google and Meta have dispute windows. If you wait too long, you lose the chance to claim a refund. BotRefund notes that you can recover bot-click refunds from Google Ads spend dating back to 2017, but only if you act.

3. Evidence quality. Replays are most reliable when reviewed soon after capture. Storage glitches, data retention policies, or accidental overwrites can erase the evidence.

How to Lock Down Evidence Immediately

When an alert fires, do these steps right away:

1. Freeze the session. Export the replay to a secure, immutable location. Use a tool that writes once and never allows edits.
2. Record metadata. Note the timestamp, user ID, campaign ID, and the alert reason. This helps you match the replay to the fraud claim.
3. Take a screenshot. Capture the key moment—like a robotic mouse path or a form filled in under a second.
4. Log the alert. Write down what triggered the alert and what you plan to check.
5. Notify the team. Tell the person who handles refunds or fraud disputes that a replay is ready for review.

BotRefund's detection system captures video proof for each bot click. That proof is your evidence. Lock it down before you do anything else.

What to Look for in a Session Replay

When you review, focus on behaviors that separate humans from bots. BotRefund's detection engine looks for these signals:

• Ghost clicks: Clicks that happen without a natural sequence of human intent.
• Robotic linear mouse movements: Unnaturally straight pointer paths.
• Absence of humanlike tremor: No tiny jitter that real hands produce.
• Superhuman input speed: Interactions faster than a person could realistically perform.
• Grid-aligned movement patterns: Movement that snaps to precise lines or blocks.
• Absence of clicks or scrolling: A session that stays too static.
• Unnatural session durations: Visits that are too short, too long, or too uniform.

If you see any of these, the replay likely confirms fraud. Document what you see and export the evidence.

Common Mistakes That Ruin a Fraud Case

Even with a timely review, mistakes can sink your refund claim. Avoid these:

• Editing the replay. Never trim or alter the original. Use a copy for analysis.
• Ignoring metadata. The replay alone isn't enough. You need the click ID, timestamp, and campaign details.
• Waiting too long to file. Google and Meta have deadlines. BotRefund's guide on Google Ads refund requests stresses the importance of acting quickly.
• Not preserving attribution. If you change the campaign before you capture evidence, you lose the link between the bot click and the ad spend.
• Treating every bad lead as fraud. Some unresponsive leads are just low-intent humans. Use the replay to confirm bot behavior, not just poor conversion.

Limitations: When This Advice Doesn't Apply

The 24–48 hour rule works for most ad fraud cases, but not all. If you're dealing with affiliate fraud or cookie stuffing, the replay might not show the full picture. BotRefund's behavioral analysis can catch those, but you may need to review server logs too.

Also, if your replay tool doesn't capture pointer movement or click timing, you can't rely on it alone. You'll need additional telemetry.

Finally, if you're in a regulated industry with strict data retention rules, your legal team may require a different review schedule. Always follow compliance requirements.

Key Facts About BotRefund

FAQ

What if I miss the 48-hour window?

You can still review the replay, but your refund claim may be weaker. Act as soon as you can, and always preserve the evidence first.

Can I review a replay on my phone?

Most replay tools work on mobile, but for detailed analysis, use a desktop with a large screen. You need to see pointer paths clearly.

How do I know if a replay is worth reviewing?

Check the alert reason. If it matches a known bot behavior like superhuman speed or ghost clicks, review it. If it's a weak signal, wait for more data.

What should I do if the replay is inconclusive?

Look at other data: IP address, device fingerprint, form fill time, and CRM outcome. Combine the replay with these signals before deciding.

Does BotRefund store replays for me?

BotRefund captures video proof for each bot click. You can export that proof for your dispute. Check the platform for storage details.

Can I use session replays for Google Ads refunds?

Yes. BotRefund's guide on Google Ads refund requests shows how to export client-side behavioral proof logs to win your dispute.