Bots are a hidden problem in paid advertising. They can consume your ad budget quickly. They also poison your conversion data. This makes it hard to see real campaign performance. Meta and Google use machine learning to optimize your ads. If bots trigger your pixels, the algorithms learn from fake data. Then your ads target more bots. You waste money and miss real customers. That is why detecting suspicious visits early is critical. BotRefund helps you identify and prove bot traffic. You can then get refunds from Google and Meta.

Readiness Checklist

Before contacting BotRefund, check for these patterns. They come from real cases of invalid traffic. If you see several of these signs, it is time to act.

• Contactability issues: Leads have disconnected phone numbers, invalid email domains, repeated addresses, or an unusual concentration of one country code. This means the data is not real.
• Timing anomalies: Several leads arrive in short bursts. Forms are submitted immediately after landing. Conversions happen at unusual hours, like 3 AM in your time zone.
• Session behavior red flags: No scrolling, no field corrections, uniform click paths, and no meaningful time on the offer page. Real users pause, scroll, and correct mistakes.
• Campaign patterns: A sharp lead-quality difference by placement, creative, audience expansion, device, or landing page. For example, one placement delivers only bad leads while others perform well.
• CRM outcomes: High reported lead count paired with no calls connected, demos booked, qualified opportunities, or repeat engagement. The sales team gets nothing from the leads.

If you see these signs, you likely have bot traffic. Do not wait. The problem worsens as algorithms learn from bad data.

How BotRefund Detects Suspicious Visits

BotRefund uses client-side behavioral signals. These are actions that happen in the browser. They are hard for bots to fake. Here are the key signals detected:

• Ghost clicks: Clicks that happen without the natural sequence of human intent. A real user moves the mouse, hovers, then clicks. Bot clicks often appear out of order.
• Honeypot traps: Hidden elements on the page that only bots interact with. Real users never see them. If a bot triggers a honeypot, BotRefund flags it.
• Robotic linear mouse paths: Real mouse movement has curves and small corrections. Bots move in straight lines from point A to point B.
• Superhuman input speed: Actions that happen in less than one millisecond. A human cannot type or click that fast. This is a clear sign of automation.
• Grid-aligned movement patterns: Bots often snap to pixel-perfect lines or blocks. Natural human movement is messy and uneven.
• Absence of clicks or scrolling: Real users scroll and click around the page. Bots often load the page and do nothing. They just trigger the pixel.
• Unnatural session durations: Visits that are too short (under 2 seconds) or too uniform (every session exactly 10 seconds). Real users vary widely.

These signals are collected by a small JavaScript snippet. You add it to your site in about one minute. No credit card needed. BotRefund then creates a video proof of each suspicious session. This evidence is used to file refund claims.

Server-Side vs. Client-Side Audits

There are two ways to detect bot traffic. Each has strengths and weaknesses.

Server-side audits look at log files from your web server. They check IP addresses, user agents, and request patterns. This can catch data center IPs and known bad bots. But it misses many modern bots. Those bots use residential proxies and real browsers. They look like normal traffic at the server level. Server-side audits are cheap but often incomplete.

Client-side audits run in the browser. They capture mouse movements, clicks, scrolls, and input timing. This is the only way to see behavioral patterns. BotRefund uses client-side signals. This gives you stronger evidence. You can prove a bot clicked because no human would move that way. Client-side audits are more accurate. They detect the bots that server logs miss.

The trade-off is setup. You need to add a tracking code. But the code is lightweight and does not affect page speed. Once installed, you get real-time data. For refund claims, client-side evidence is required. Google and Meta ask for it. Without it, your claim is weak.

Why does this matter? Bot traffic can look like normal lead-quality variation. A weak campaign might attract uninterested real people. But a bot attack causes sudden, repeatable patterns. Server logs alone cannot tell the difference. Client-side audits can. That is why BotRefund recommends client-side detection for any serious investigation.

Limitations and When This Advice Doesn’t Apply

BotRefund is powerful, but it has limits. Understand them so you know when to act.

• Minimum ad spend threshold: If your monthly ad spend is under $10,000, a refund claim may not be cost-effective. The refund amount might not justify the effort. However, you can still run a free audit to learn about your traffic.
• Tracking code must be active: BotRefund needs its JavaScript snippet on your site. If you remove it or never install it, no evidence is collected. You cannot go back in time. Install it now to protect future spend.
• Reliance on server-side logs alone: If you only look at server logs, you may miss the behavioral signals that prove bot activity. Server logs show IP and user agent, but not mouse movement. Without client-side data, your refund claim is unlikely to succeed.
• Harmless surges vs. sustained invalid traffic: A one-time spike from a viral post is normal. Wait a day or two. If the spike persists and shows the patterns above, then contact BotRefund. Not every surge is fraud.
• Past claims: BotRefund can generate evidence for historic campaigns, but only if the tracking code was active during those campaigns. You cannot prove past fraud without past data.

This advice does not apply if you are running a brand awareness campaign without conversion tracking. Bot traffic there is less harmful. It also does not apply if you are using only organic traffic. Paid ads are the main target for refunds.

Steps to Prepare Your Case

Once you see the signs, follow these steps. They increase your chance of a refund.

1. Gather the metrics from the readiness checklist. Export your ad platform data showing the spike in clicks or leads.
2. Run a BotRefund audit. The free audit gives you a report with video evidence. It takes one minute to set up.
3. Document the impact. Show how cost-per-lead or cost-per-acquisition changed. Compare before and after the suspicious traffic started.
4. Submit the report through the BotRefund support portal. They will help you file a claim with Google or Meta.
5. Respond to any questions from the ad platform. BotRefund provides a compliance-ready report. This speeds up the process.

Do not change your campaign settings before collecting evidence. Pausing campaigns may delete the data you need. Let the audit run first.

FAQ

• What counts as evidence for a refund claim? Video proof of bot behavior, such as linear mouse paths or superhuman speed, along with a report showing the traffic pattern. BotRefund provides both.
• Are Google or Meta refunds automatic? No. You must file a claim. Google and Meta have automated systems, but they miss many bots. You need to submit evidence to get paid.
• How far back can refund claims go? Google allows claims for invalid activity dating back to 2017, but only if you have evidence from that time. Meta has a 60-day limit for most claims. Install BotRefund now to protect future spend.
• What does the 83% success rate mean? That is the percentage of BotRefund clients who successfully received a refund after submitting a claim. It means the evidence is strong enough most of the time.
• What if I see a spike but my conversion rate stays steady? The spike could be harmless. But run a BotRefund audit to confirm. Some bots mimic human behavior and still convert at a low rate.
• How long does the audit take? Setup is about one minute. The first report is ready within minutes of traffic collection. You see results fast.
• Do I need a paid plan to get help? No. The free audit provides enough data to decide if a refund claim is viable. Paid plans offer more features, but the free tier is sufficient for initial evaluation.
• Can BotRefund recover spend from past months? Yes, if the tracking code was active during those months. It can generate evidence for historic campaigns and help you file claims retroactively.

You should reach out to Botrefund support when cross-checking stops producing correlated evidence across browser, network, device, and behavioral signals — especially if refund reports show gaps or the prediction AI returns low-confidence scores. The platform's 99% detection accuracy relies on every one of its 106 independent checks feeding the AI model; a single broken signal path can degrade the entire corroboration chain.

Quick Readiness Checklist: Signs You Need Support

• Refund evidence reports show missing signal categories — no browser, network, device, or behavioral data appearing in dispute packages.
• Prediction AI confidence scores drop below normal thresholds — the dashboard shows "low confidence" or "insufficient corroboration" flags on visits that should be clear.
• Setup validation fails repeatedly — the installation health check reports signal collection errors after you've verified tag placement and CSP headers.
• Cross-checking logic appears to ignore known-good signals — for example, impossible tab speed anomalies are recorded but not weighed against mouse tremor or session duration data.
• Refund submission to Google or Meta fails due to evidence format issues — GCLID/FBCLID capture works but the behavioral proof package doesn't meet platform requirements.

When to Wait Before Opening a Ticket

Not every anomaly warrants immediate support contact. Wait 24–48 hours if:

• You've just installed or updated the tracking script — signal calibration takes one full traffic cycle.
• Traffic volume is below the statistical threshold for reliable cross-checking (typically under 1,000 daily sessions).
• A known platform incident (Google Ads API outage, Meta Pixel reporting delay) is documented on their status pages.
• You're testing in a staging environment without real ad traffic — cross-checking needs live click IDs to correlate.

How Cross-Checking Works in Botrefund

Botrefund collects 106 independent signals across four categories: browser (user agent, canvas fingerprint, extension presence), network (IP reputation, VPN/proxy detection, ASN analysis), device (hardware concurrency, battery API, screen properties), and behavior (mouse tremor, scroll patterns, input timing, tab focus). Each signal is an objective fact — not a verdict. The prediction AI weighs the complete pattern instead of trusting any single rule. As the documentation states: "A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps this signal as evidence — not a verdict — and cross-checks it against independent browser, network, device, and behavior data." (S1)

Common Mistake: Treating Cross-Checking as a Binary Switch

The most frequent error is assuming cross-checking either works or doesn't. In reality, it degrades gradually. A misconfigured Content Security Policy might block only the behavioral telemetry endpoint while browser and network signals continue flowing. The dashboard still shows "active" status, but the AI receives incomplete patterns — producing false negatives on sophisticated bots that mimic browser fingerprints but fail behavioral checks. Another mistake: disabling individual signals to "reduce noise." Each removed signal weakens corroboration. The system needs all 106 checks to maintain 99% accuracy.

Key Facts from Botrefund's Detection Architecture

Typical Cross-Checking Failure Modes

Signal Collection Gaps

CSP headers, ad blockers, or browser privacy settings (ITP, ETP) can silently drop specific telemetry endpoints. The dashboard may show green status because the main heartbeat succeeds, but behavioral signals like mouse tremor or scroll depth never arrive. Support can provide a CSP allowlist and verify endpoint reachability from your domain.

Click ID Correlation Breaks

GCLID/FBCLID capture requires the script to execute before navigation or form submission. Single-page apps, consent management platforms, or server-side tag managers can separate the click ID from the session payload. Support helps map your specific tech stack to the required initialization sequence.

AI Confidence Drift

If your traffic composition shifts — new campaign sources, geographic expansion, mobile/desktop ratio change — the prediction model may need recalibration. Support can trigger a model refresh using your recent labeled data (confirmed bots/humans from CRM outcomes).

Limitations of Automated Cross-Checking

• Statistical dependence on volume: Low-traffic campaigns (<1,000 sessions/day) produce sparse signal matrices; cross-checking loses power.
• Adversarial adaptation: Sophisticated bot operators now simulate mouse tremor and variable scroll — behavioral signals alone can be spoofed. Cross-checking with device and network signals remains essential.
• Privacy tool interference: Legitimate users on VPNs, Tor, or hardened browsers (Brave, Firefox with RFP) generate anomalous device/network signals that mimic bots. The AI handles this via pattern weighting, but false positives rise without manual review.
• No retroactive repair: Missing signals from past sessions cannot be recovered. Refund evidence for those clicks is permanently weakened.

Terminology Quick Reference

• Cross-checking: Correlating independent signal categories (browser vs. behavior vs. network vs. device) to confirm or reject a bot hypothesis.
• Impossible Tab Speed: One of 106 checks — detects clicks/scrolls occurring faster than humanly possible given tab focus timing.
• GCLID/FBCLID: Google Click ID / Facebook Click ID — unique identifiers attached to paid clicks, required for refund claims.
• Pixel poisoning: Invalid bot traffic triggering conversion pixels, causing ad algorithms to optimize toward fraud.
• Prediction AI: The model that weighs all 106 signals into a single bot/human probability score.

Practical Scenarios: Escalate vs. Monitor

FAQ

How long does a typical cross-checking support ticket take to resolve?

Most configuration issues (CSP, tag sequencing, click ID capture) resolve in 1–2 business days. Model recalibration requests take 3–5 days as they require labeled data review.

Can I test cross-checking health without opening a ticket?

Yes. Use the "Installation Health Check" in the dashboard — it validates each signal endpoint and reports which categories are actively transmitting. Run it after any site deployment.

What information should I include when contacting support?

Provide: affected domain, date range of anomalies, specific signal categories missing (browser/network/device/behavior), recent deployment changes, and example click IDs where refund evidence failed.

Does Botrefund support help with Google/Meta dispute filing?

Yes. The team prepares compliance-ready refund reports with GCLID/FBCLID linked to behavioral evidence, then submits and manages the dispute process. High-volume advertisers see 83% success rates (S2).

What if my traffic uses heavy VPN/corporate proxy — will cross-checking falsely flag users?

The AI weights network anomalies against behavioral consistency. A VPN user with natural mouse tremor, varied scroll, and human input timing scores as human. False positives rise only when multiple independent categories align anomalously.

Is there a minimum ad spend to justify cross-checking support engagement?

No formal minimum, but campaigns under $10K/month typically resolve issues via self-service health checks. Enterprise tiers ($250K+/month) include dedicated support for cross-checking optimization.

Can cross-checking be disabled for specific pages or campaigns?

Not recommended. Disabling signals on any page creates blind spots where bots enter untracked. Instead, use the "low-risk" mode which reduces behavioral sampling rate but keeps all 106 checks active.

Contact BotRefund the moment you notice signs of invalid traffic: sudden CTR spikes with no conversions, identical form submissions, placement-level anomalies, or CRM leads that never respond. Google and Meta only honor refund requests filed within their invalid-traffic windows — usually 30 to 60 days from the click. Waiting lets bot sessions train the bidding algorithms to chase more bots, compounding the waste.

The Critical Time Window: Platform Refund Deadlines

Google Ads and Meta each run their own invalid-traffic review processes. Both require advertisers to submit specific click IDs (GCLIDs for Google, FBCLIDs for Meta) paired with behavioral evidence that the session was non-human. Those windows close fast — typically 30 days for Google, 60 days for Meta — and the platforms have no incentive to flag their own revenue. Refunds happen almost exclusively when an advertiser contests specific charges with specific evidence. Most marketing teams never file because producing court-grade session evidence is prohibitively difficult without automated tooling.

Google Ads reviewers expect GCLID-level dossiers that show headless browser leaks, mouse dynamics, GPU fingerprints, and server-log correlation for each contested click. Meta's manual billing dispute system demands FBCLIDs linked to behavioral proof such as VPN/proxy detection, geo spoofing, and click-farm patterns. The platforms treat these submissions as adversarial proceedings — they approve only when evidence meets a high technical bar. Missing the deadline by even a day means the claim is permanently barred.

Early Warning Signs That Trigger a BotRefund Audit

You don't need certainty to start. You need a pattern worth investigating. Common triggers include:

• Click-through rates that look too good while conversion rates tank
• Form completions in seconds with identical field structures
• Sudden traffic spikes from a single placement or Audience Network app
• CRM leads that bounce, use disposable emails, or never reply
• Geo mismatches: clicks billed at top-tier US CPCs but originating from data centers overseas
• Meta Audience Network placements delivering high CTRs and near-instant bounce rates
• Residential proxy traffic hiding bot clicks behind legitimate consumer IPs
• Click farms using real smartphones to simulate human taps
• Affiliate cookie stuffing that hijacks attribution and inflates conversion counts

These patterns appear in the Visa case study: Cloudflare showed only 5–6% bot traffic, yet BotRefund's on-site behavioral analysis doubled the detection rate, revealing a 15% average bot click rate across search campaigns. The same audit lifted conversion rates by 35% once bot traffic was suppressed.

Why Waiting Costs Money: The Compounding Effect of Pixel Poisoning

Every bot session that fires your conversion pixel teaches Google's Smart Bidding or Meta's Advantage+ to find more users who behave exactly like that bot. The first 48–72 hours of a campaign are disproportionately critical — this learning window sets the trajectory. If bots contaminate early data, the algorithm optimizes toward bot fingerprints, and your CPA climbs while real customers get crowded out. Real-time pixel suppression stops this feedback loop before it starts.

Machine learning models on both platforms use reinforcement learning. They treat every pixel fire as a positive reward signal. Bots that dwell, scroll, and click buttons mimic high-intent behavior. The algorithm then shifts budget toward audiences, placements, and creatives that attract more of those bot profiles. Within days, a campaign can become structurally dependent on invalid traffic. Reversing that drift requires clean data and a reset — both harder the longer you wait.

The Mechanics of Bot Detection: 110+ Forensic Signals

BotRefund captures over 110 behavioral and technical signals per session. These include headless browser leaks (missing Chrome APIs, automation flags), mouse tremor analysis (human micro-movements vs. linear bot paths), GPU integrity checks (detecting virtualized or emulated environments), VPN and geo-spoofing defense (exposing foreign clicks charged at domestic CPCs), and ad-click server log audits (tracing GCLIDs and FBCLIDs through forensic request logs). The system builds compliance-grade evidence dossiers linked to each click ID.

Detection happens client-side during the session, not after the fact. This timing matters: real-time analysis can suppress the conversion pixel before it fires, preventing the poisoning entirely. Delayed analysis — common in log-based tools — means the pixel has already sent its signal to the ad platform. The 99% accuracy claim across these signals comes from continuous validation against known botnets and human baselines.

What BotRefund Needs From You to File a Claim

The process is designed to be low-friction:

1. Add one script tag to your site (~1 minute, no ad-account credentials required)
2. BotRefund captures 110+ forensic signals per session — headless leaks, mouse tremor, GPU integrity, VPN/geo spoofing, click ID traces, server request logs
3. The system builds compliance-grade evidence dossiers linked to each GCLID/FBCLID
4. BotRefund negotiates refunds directly through the platforms' own invalid-traffic channels

You pay 32% of recovered spend only when money comes back. Enterprise engagements have $0 upfront — fees come out of the recovery. No long-term contracts. The script loads asynchronously and does not affect page speed. GDPR-aligned data handling is standard.

How the Recovery Process Works: From Audit to Refund

After the script is live, BotRefund runs a free traffic audit that maps your actual bot rate against industry benchmarks (9–20% of paid clicks). The audit replaces illustrative estimates with your account's real numbers. If recoverable spend is detected, the evidence dossiers are submitted to Google and Meta reviewers. Across filed claims, BotRefund sees an 83% approval rate. Over $100M in wasted spend has been recovered for 2,500+ brands ranging from fintech enterprises to DTC companies.

The audit covers Search, Performance Max, Display, Meta Advantage+ Shopping, and Audience Network placements. It produces a per-session bot probability score, a recoverable-spend estimate by campaign, and a prioritized list of click IDs for dispute. You review the findings before any submission. The recovery estimator on the website accepts any monthly Google + Meta spend level and returns a projected recovery range.

Platform-Specific Refund Processes: Google vs. Meta

Google Ads invalid-click refunds flow through the platform's automated and manual review queues. Reviewers expect GCLID-level evidence dossiers showing behavioral non-human patterns. The 30-day window starts at click time. Meta's process is more manual: advertisers file billing disputes with FBCLIDs and supporting evidence. Meta's window extends to roughly 60 days. Both platforms approve only when evidence meets their internal standards — which is why automated, court-grade dossiers outperform manual screenshots or CSV exports.

Performance Max and Advantage+ campaigns are fully covered. The forensic signals capture invalid clicks across all placement types, including those where the advertiser has no placement-level visibility. Audience Network traffic — a major bot source on Meta — is analyzed at the session level, not just the placement level.

Real-World Recovery Scenarios

The Visa case study illustrates the gap between network-layer and on-site detection. Cloudflare's WAF caught 5–6% bot traffic. BotRefund's behavioral layer found 15% — a 2.5x increase. The recovered spend came from search campaigns where bots mimicked sign-up conversions. After suppression, conversion rates rose 35%.

Other patterns from the source pack: fintech enterprises recovering from high-CPC emulator surges by submitting forensic GCLID session proof to Google reviewers. SaaS companies cleaning HubSpot pipelines and stopping headless crawlers from submitting fake enterprise trials. E-commerce brands using real-time pixel suppression to stop non-human events from corrupting Meta lookalike models. Travel and hospitality accounts uncovering overseas proxy disguises that routed foreign automated visits through US data centers charged at top domestic rates.

When BotRefund Isn't the Right First Step

Not every performance dip is bot fraud. A weak offer, broken landing page, or audience mismatch can look like bad traffic. If your CRM shows real people who simply aren't ready to buy, suppressing traffic hurts more than it helps. Start with a structured audit that compares ad-platform data, website sessions, and CRM outcomes before changing targeting or filing disputes. BotRefund's free audit provides that baseline without commitment.

Lead quality variation is normal. A campaign can attract real people who don't convert immediately. Bot traffic and form spam leave repeatable technical patterns: unusually fast form completion, identical field structures, sudden placement-level spikes, conversion events with no meaningful page engagement. The key distinction is evidence. Treat every unresponsive contact as fraud and you risk excluding valuable audiences. The free audit separates signal from noise.

Key Facts at a Glance

Frequently Asked Questions

How fast do I need to act after noticing suspicious traffic?

Immediately. The 30–60 day platform windows are hard deadlines. Evidence degrades as sessions age and click IDs expire.

What if I'm not sure it's bots versus just bad targeting?

Run the free audit first. It compares your traffic against behavioral baselines and shows the bot probability per session without any contract.

Does BotRefund work on Performance Max and Advantage+ campaigns?

Yes. The forensic signals capture invalid clicks across Search, PMax, Display, Meta Advantage+ Shopping, and Audience Network placements.

What evidence does Google or Meta actually accept?

Compliance-grade dossiers linking each GCLID/FBCLID to behavioral proof: headless browser leaks, mouse dynamics, GPU fingerprints, VPN/proxy detection, and server-log correlation.

Can I use BotRefund alongside Cloudflare or other WAF tools?

Yes. The Visa case study showed Cloudflare caught 5–6% bot traffic while BotRefund's on-site behavioral layer doubled detection. They operate at different layers.

What happens if a refund claim is denied?

You pay nothing. The 32% fee applies only to successfully recovered spend.

Is there a minimum ad spend to qualify?

The recovery estimator accepts any monthly Google + Meta spend. The free audit runs regardless of budget size.

How does real-time pixel suppression work technically?

The script evaluates each session before the conversion pixel fires. If bot probability exceeds the threshold, the pixel event is blocked for that session only. Human sessions fire normally.

What about affiliate fraud and cookie stuffing?

The Affiliate Fraud Shield detects cookie stuffers and scrapers that hijack attribution. It logs invalid affiliate clicks and prevents them from triggering your pixels.

How long does the audit take?

The script starts collecting data immediately. A meaningful audit typically requires 7–14 days of traffic, depending on volume.

Can agencies manage multiple clients?

Yes. The unified multi-client recovery portal provides audit reports and recovery tracking across all managed accounts.

Decide: Direct Dispute or Automated Recovery?

The short answer depends on your budget size and technical patience. If you are spending under $1,000 a month and have time to manually build a legal-grade evidence dossier, you can contact Google Ads support directly. However, this path is slow and has a low success rate because Google rarely refunds money without overwhelming proof.

If you spend over $5,000 monthly or want to recover funds dating back years, use an automated tool. Services like BotRefund detect non-human traffic in real-time, capture video proof of every bot click, and handle the negotiation with Google for you. This approach typically recovers up to 20% of wasted ad spend with an 83% approval rate.

Quick Comparison

Why This Decision Matters Now

Invalid clicks are not just a nuisance; they actively destroy your campaign performance. When bots click your ads, they trigger conversion events that poison your machine learning algorithms. Google’s Smart Bidding and Meta’s Advantage+ systems see these fake conversions as "success" and begin optimizing your ads to find more people who look like bots.

This leads to a vicious cycle: your Cost Per Acquisition (CPA) spikes, your Return on Ad Spend (ROAS) drops, and your daily budget is exhausted by non-human traffic before real customers ever see your ad. Ignoring this problem means paying for clicks that never happened while simultaneously training your ad account to perform worse.

How Invalid Traffic Detection Works

To understand which route to take, it helps to know how detection works. Traditional tools rely on IP blacklists—blocking known bad addresses. This is outdated because modern bots use residential proxies that look like legitimate home users.

Modern automated solutions use client-side behavioral verification. They install a lightweight script on your website that analyzes visitor behavior in real-time. It checks for 110+ forensic signals, such as mouse movement patterns, browser fingerprinting, and network latency. If a visitor fails these checks, the tool flags them as a bot and captures video evidence of their session. This evidence is what Google requires to approve a refund.

Option 1: Contacting Google Directly

You might consider contacting Google Ads support if you have a very specific, isolated incident. For example, if you notice a massive spike in clicks from a single IP address at 3 AM, you can try to dispute it through the Google Ads Help Center.

The Process

1. Gather Data: Export your click reports and identify suspicious IP addresses.
2. Check Logs: Compare those IPs against your server logs to see if they visited your site.
3. Submit Appeal: File a billing dispute with Google, attaching your evidence.

The Reality Check

Google’s automated filters already remove many invalid clicks. If you are still seeing them, it means they passed Google’s initial filters. Proving that a click was "invalid" to a human reviewer at Google is difficult. Without forensic behavioral data, your appeal is likely to be rejected. Furthermore, Google limits claims to the past 60 days, meaning you cannot recover older losses.

Option 2: Using an Automated Tool

For most businesses, an automated tool is the superior choice. These platforms act as a bridge between your website and the ad platform’s billing department. They do not just block clicks; they prove fraud.

Key Capabilities

• Real-Time Protection: The tool blocks bots before they trigger your conversion pixels, protecting your algorithm from poisoning.
• Forensic Evidence: It records video sessions of flagged bots, providing undeniable proof of non-human activity.
• Managed Negotiation: The service submits the evidence to Google or Meta on your behalf, handling the complex paperwork.

BotRefund, for instance, offers a free audit to show you exactly how much of your spend is recoverable. Their model is zero-risk: you pay nothing upfront, and fees are taken only from the refunds they successfully secure.

Decision Framework: Which Path Is Right for You?

Use this checklist to decide. If you check two or more boxes in either column, follow that recommendation.

Choose Direct Contact If...

• Your monthly ad spend is under $1,000.
• You have a dedicated marketing analyst who can spend hours building evidence.
• You only need to recover the last 60 days of spend.
• You are comfortable writing formal billing disputes.

Choose an Automated Tool If...

• Your monthly ad spend is over $5,000.
• You want to recover funds from previous years (some tools go back to 2017).
• You lack the technical resources to analyze server logs.
• You want to protect your future campaigns from pixel poisoning immediately.
• You prefer a performance-based fee structure (pay only on success).

Limitations and Exceptions

No solution is perfect. Even with an automated tool, refunds are not guaranteed for every single click. Google and Meta reserve the right to deny claims if the evidence is inconclusive. Additionally, some advanced bot networks may mimic human behavior closely enough to bypass detection, though this is rare with 99% accurate AI models.

Another limitation is timing. While tools can detect bots in real-time, the actual refund process from Google can still take several weeks to months. Patience is required during the negotiation phase.

FAQ

Can I get a refund for clicks from more than 60 days ago?

Google’s official policy limits direct claims to the past 60 days. However, automated tools that submit comprehensive forensic dossiers can sometimes negotiate exceptions or recover older spend through different channels, depending on the severity of the fraud.

Does using a tool hurt my ad account standing?

No. In fact, it helps. By blocking bots from triggering conversion events, you prevent your account from being optimized for low-quality traffic. This improves your long-term ROAS and keeps your account healthy.

How much does it cost to use a recovery tool?

Many reputable services, including BotRefund, operate on a contingency basis. There is no upfront cost. They take a percentage of the refund amount they successfully recover for you. If they don’t get you money back, you don’t pay.

What if the bots are coming from my competitors?

Competitor click fraud is common. Automated tools can detect these patterns by analyzing the source of the traffic. Once identified, the tool captures the evidence needed to dispute these charges specifically.

Do I need to give the tool access to my Google Ads account?

No. Most modern tools work by adding a script to your website. They analyze traffic on-site and generate reports. They do not need login credentials to your ad account, which enhances security.

Learn more about this service

See how this page can help with your next step.

Learn more

When to Enable a Silent Audio Trap in Your WAF Policy

The decision trigger: enable before go-live, not after

Turn on audit logging for bot detection before your production traffic starts. The best time is during staging, when you can test the logging pipeline without risking live data. Promote the same configuration to production as part of your launch checklist.

Why so early? Bot detection works by comparing behavior against a baseline. If you wait until after launch, you miss the clean window where real users are the only traffic. Later, when bots arrive, you have no normal pattern to compare against.

Audit logs are the evidence trail. They record what the detection system saw, what it decided, and why. Without them, you are guessing. With them, you can review decisions, dispute false positives, and build refund claims.

Readiness checklist: are you ready to enable audit logging?

Use this checklist before you flip the switch in production. Each item reduces the chance of noisy logs, missed events, or compliance gaps.

• Staging test complete. You have run the logging pipeline in a staging environment for at least one full traffic cycle.
• Log schema defined. You know which fields to capture: timestamp, session ID, IP, user agent, detection signals, decision, and confidence score.
• Retention policy set. You have decided how long to keep logs. For ad refund claims, Google limits claims to the past 60 days, so keep at least that window.
• Access controls in place. Only authorized staff can view or export audit logs. This protects user privacy and meets compliance rules.
• Alerting configured. You have set thresholds for unusual bot activity, so logs trigger alerts instead of sitting unread.
• Storage cost estimated. You know the volume of logs you will generate and have budgeted for storage.
• Integration tested. If you use a SIEM or analytics tool, you have confirmed the logs flow into it correctly.

If you can check all seven boxes, you are ready to enable audit logging in production.

Signs you should wait

Sometimes enabling audit logging too early creates more problems than it solves. Wait if any of these apply:

• No staging environment. If you cannot test the logging pipeline first, you risk breaking production with a misconfigured logger.
• Unclear log schema. If you do not know which fields matter, you will collect noise. Noise makes real bot signals harder to find.
• No retention plan. Logs grow fast. Without a retention policy, you may pay for storage you never use or delete evidence you need later.
• Compliance review pending. If your legal or security team has not approved the logging of IP addresses or user agents, wait for that sign-off.
• Budget not approved. Audit logging has a real cost. If the storage or tooling budget is not approved, enabling it now may cause a surprise bill.

Waiting is not the same as skipping. It means fixing the blocker first, then enabling logging as soon as possible.

The exception: emergency bot attack

There is one case where you enable audit logging immediately, even without full readiness: an active bot attack on a live production system.

If you see a sudden spike in fake signups, form spam, or invalid clicks, turn on logging right away. Capture whatever you can. The evidence you collect during the attack may be the only way to prove what happened and recover lost ad spend.

In this exception, accept imperfect logs. A partial record is better than no record. You can clean up the schema and retention later.

Why audit logging matters for bot detection

Bot detection without audit logging is a black box. The system may block a bot, but you cannot see why. If it blocks a real user, you cannot fix the false positive. If it misses a bot, you cannot improve the rules.

Audit logs turn bot detection into a reviewable process. They answer three questions for every decision:

• What did the system see? (request details, session behavior, device signals)
• What did it decide? (bot, human, uncertain)
• Why did it decide that? (which signals triggered the decision)

This matters for three practical reasons. First, you can tune the detection rules. Second, you can defend your decisions to stakeholders. Third, you can build evidence for ad platform refund claims. Google and Meta require proof that clicks were non-human before they issue refunds.

How audit logging works in practice

Audit logging for bot detection typically captures events at three layers:

1. Request layer. IP address, user agent, referrer, timestamp, and click ID if available.
2. Behavior layer. Mouse movements, keystroke timing, scroll depth, time on page, and form interaction speed.
3. Decision layer. The bot score, the threshold used, the final classification, and any suppression action taken.

Each event is written to a log store. The store can be a simple database, a cloud storage bucket, or a SIEM. The key is that every decision is traceable back to the raw signals that produced it.

For example, a bot detection system might log: "Session 8f3a2c, IP 203.0.113.7, user agent headless Chrome, form fill time 0.2 seconds, mouse movement none, bot score 0.97, decision: block." That single line is enough to explain the decision and defend it later.

Main options and trade-offs

You have three main choices for audit logging in bot detection:

Choose built-in logging if you need to move fast. Choose a custom pipeline if you have strict data residency or retention rules. Choose SIEM integration if bot detection is one of many security signals you monitor.

Step-by-step decision framework

Use this framework to decide when to enable audit logging for your specific situation:

1. Identify your production launch date. Work backward from that date.
2. Schedule staging enablement at least one week before launch. This gives you time to test and fix issues.
3. Define your log schema and retention policy during staging. Do not wait until production.
4. Run a simulated bot attack in staging. Confirm the logs capture the signals you need.
5. Enable logging in production as the first step of your launch checklist. Do not launch without it.
6. Review the first 24 hours of production logs. Confirm the baseline looks like real human traffic.
7. Set a recurring review cadence. Weekly for small teams, daily for high-traffic campaigns.

This framework works for new campaigns, new websites, or new bot detection tools. The principle is the same: enable early, test in staging, promote to production before go-live.

Common mistakes to avoid

Practical scenarios

Here are three realistic situations and the right timing for each:

Scenario 1: New e-commerce store launching next month. Enable audit logging in staging this week. Test the pipeline with simulated traffic. Promote to production on launch day. Review logs daily for the first week.

Scenario 2: Existing SaaS product adding bot detection. Enable logging in a staging environment that mirrors production. Run a shadow test for one week. Then enable in production during a low-traffic window. Compare the first day of logs to staging baselines.

Scenario 3: Active bot attack on a live campaign. Enable logging immediately, even if the schema is incomplete. Capture raw request data and behavior signals. Use the logs to block the attack and build a refund claim later.

Limitations and when this advice does not apply

This advice assumes you have a bot detection system that supports audit logging. If your tool does not log decisions, you cannot enable what does not exist. In that case, switch to a tool that does, or build a custom logging layer.

The advice also assumes you have some engineering or technical capacity. If you are a solo marketer with no developer, built-in logging from a vendor is your best option. Custom pipelines are not realistic.

Finally, audit logging is not a substitute for bot detection itself. Logs record decisions; they do not make them. If your detection rules are weak, logs will faithfully record weak decisions. Fix detection first, then log it.

Key facts

Terminology

Audit log: A record of events, decisions, and supporting data from a system. In bot detection, it shows what the system saw and why it classified a session as bot or human.

Baseline: The normal pattern of traffic before bots arrive. Audit logs capture this baseline so anomalies stand out.

False positive: A real user incorrectly classified as a bot. Audit logs help you find and fix these.

SIEM: Security Information and Event Management. A central platform that collects and analyzes logs from multiple systems.

Retention policy: The rule for how long logs are kept before deletion.

FAQ

Why can't I just enable audit logging after launch?

You can, but you lose the clean baseline. Once bots mix with real users, it is harder to tell normal from abnormal. Early logs give you a reference point.

How long should I keep bot detection audit logs?

At least 60 days. Google limits refund claims to the past 60 days, so you need that window of evidence. Longer retention helps with trend analysis.

What does audit logging cost?

It depends on volume and storage. Cloud log storage is usually cheap per gigabyte, but high-traffic sites generate a lot of data. Estimate your daily event count before enabling.

What should I compare when choosing a bot detection tool with audit logging?

Compare the log schema, retention options, export formats, and SIEM integrations. Also check whether the tool logs the raw signals behind each decision, not just the final bot score.

Can I enable audit logging without a developer?

Yes, if you use a vendor tool with built-in logging. BotRefund's free diagnostic tier includes audit logging and requires no ad account credentials.

What happens if I ignore audit logging?

You cannot prove bot activity, cannot tune detection rules, and cannot build refund claims. You are left with a black box that may block real users or miss bots silently.

Enable behavioral signal detection after you have at least two weeks of baseline traffic so the model can learn normal user patterns. Turning it on too early means the system has no reference for what human behavior looks like on your specific pages.

What Behavioral Signal Detection Actually Does

Behavioral signal detection watches how visitors interact with your site after they click an ad. It looks for patterns that humans make naturally and patterns that automation leaves behind. The system tracks mouse tremor, click timing, scroll depth, form completion speed, and session flow. When a visit lacks the tiny imperfections of human input — like micro-jitter in mouse movement or natural pauses between keystrokes — it flags that session as non-human.

BotRefund uses 110+ forensic signals across click behavior, pointer behavior, motion behavior, speed behavior, path behavior, engagement behavior, and session behavior. These include ghost click detection (clicks without human intent sequence), honeypot trap interactions (bots responding to hidden elements), robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed under 1 millisecond, grid-aligned movement patterns, absence of clicks or scrolling, and unnatural session durations.

Why Timing Matters: The Learning Window Problem

The first 48 to 72 hours of any campaign are disproportionately critical. During this learning window, ad platform algorithms are most impressionable. They watch every conversion signal and adjust bidding to find more users who look like the converters. If bots trigger your conversion pixels during this window, the algorithm learns to chase bot fingerprints instead of human buyers.

This is called pixel poisoning. Automated bots — including competitive price scrapers, content crawlers, and residential proxy clickers — routinely simulate high-intent browsing behaviors. They spend dwell time on landing pages, navigate product categories, and execute DOM interactions that trigger standard tracking pixels. Because pixels cannot inherently verify human consciousness, they transmit positive feedback to the ad network. The algorithm interprets these bot sessions as successful conversions and automatically shifts your campaign's bidding parameters to acquire more users matching that exact bot fingerprint.

Once the algorithm locks onto a bot pattern, unwinding it takes weeks of clean data. That's why enabling detection before the learning window closes protects your campaign trajectory from the start.

Readiness Checklist: Are You Ready to Enable?

• Two weeks of clean baseline traffic — The system needs enough human sessions to build a statistical model of normal behavior on your specific pages.
• Conversion pixels firing correctly — Verify Google Ads and Meta conversion tags are implemented and recording events in their respective platforms.
• Sufficient traffic volume — At least 1,000 sessions per week gives the model enough data points to distinguish signal from noise.
• Stable page layout — No major redesigns, form changes, or navigation overhauls planned in the next 30 days. Layout changes reset the behavioral baseline.
• Single-domain tracking — If your funnel spans multiple domains or subdomains, confirm cross-domain tracking is configured so sessions stay stitched together.
• No active bot mitigation — Disable any existing IP blocklists, CAPTCHA challenges, or JavaScript challenges during the baseline period. They distort the natural behavior the model needs to learn.

Signs You Should Wait Longer

• New campaign or new landing page — No historical baseline exists yet. Wait for two weeks of traffic on the current page version.
• Recent site redesign or form rebuild — The behavioral baseline from the old layout doesn't transfer. Reset the clock.
• Traffic spike from a new source — A sudden influx from a new channel (influencer, PR, new ad network) skews the baseline. Let it stabilize.
• Seasonal anomaly — Black Friday, holiday sales, or industry events create atypical behavior patterns. Wait for normal conditions.
• Technical issues — Broken analytics, tag firing errors, or page load problems corrupt the baseline data. Fix first, then wait two clean weeks.

How the Detection Works (Technical Overview)

BotRefund runs continuous, DOM-level behavioral telemetry on your pages. It tracks millisecond keypress offsets, pointer jitter, and hardware rendering profiles. The lightweight edge script evaluates traffic on-site with zero access to your ad account margins or bids. No ad-account logins are needed.

When a session is flagged, the system captures the Google Click ID (GCLID) or Facebook Click ID (FBCLID) linked to behavioral proof of invalidity. This evidence is packaged into compliance-grade dispute reports and submitted through the platforms' own invalid-traffic channels. Across filed claims, BotRefund sees an 83% approval rate from Google and Meta.

Detection happens in real time during the session, not after the fact. This prevents invalid sessions from triggering your conversion pixels in the first place — protecting Smart Bidding and Advantage+ algorithms from learning from bot traffic.

Key Facts at a Glance

Limitations and When This Advice Doesn't Apply

• Brand-new domains with zero traffic — You cannot establish a baseline without visitors. Enable detection immediately upon launch if you expect bot pressure, but accept a 7-10 day learning period before the model reaches full accuracy.
• Extremely low volume campaigns — Under 500 sessions per week, the statistical model has insufficient data. Consider pooling data across similar campaigns or using a longer baseline period (4-6 weeks).
• Single-page applications with heavy client-side routing — Session stitching across virtual page views may require custom configuration. The standard two-week baseline assumes traditional page loads.
• Campaigns using server-side conversion APIs exclusively — If no client-side pixels fire, behavioral signals on the landing page cannot be linked to click IDs for refund evidence. The detection still works for protection, but recovery is limited.
• Regulated industries with strict data processing restrictions — GDPR, CCPA, or sector-specific rules may limit behavioral telemetry. Verify compliance before deploying.

Terminology Quick Reference

• Behavioral signal detection — Real-time analysis of user interaction patterns (mouse movement, click timing, scroll behavior, form completion) to distinguish humans from automation.
• Pixel poisoning — When bot traffic triggers conversion pixels, causing ad algorithms to optimize toward bot-like user profiles.
• GCLID / FBCLID — Google Click ID and Facebook Click ID. Unique identifiers appended to landing page URLs that link a click to a specific ad interaction.
• Learning window — The first 48-72 hours of a campaign when ad platform algorithms are most sensitive to conversion signals.
• Honeypot trap — A hidden page element (invisible link, form field) that humans never interact with but bots often trigger.
• Ghost click — A click event that occurs without the natural sequence of human intent (no hover, no approach movement, no dwell).
• Superhuman input speed — Form completions or interactions faster than physically possible for a human (under 1 millisecond per field).
• Pointer jitter / mouse tremor — The microscopic, involuntary variations in mouse movement that characterize human motor control.

FAQ

What happens if I enable detection before the two-week baseline?

The system will still run, but it won't have a calibrated model of normal human behavior on your pages. This increases false positives (flagging real users) and false negatives (missing sophisticated bots). You'll see a learning period of 7-10 days before accuracy reaches the 99% confidence level.

Can I use behavioral detection alongside my existing IP blocklist?

Yes, but disable the blocklist during the baseline period. IP blocklists filter traffic before it reaches your site, which means the behavioral model never sees those sessions. This creates a blind spot in the baseline. After the baseline is established, you can re-enable the blocklist as a first line of defense.

Does this work for Meta Advantage+ and Google Performance Max campaigns?

Yes. These automated campaign types are especially vulnerable to pixel poisoning because they rely entirely on conversion signals to steer spend. Behavioral detection protects the conversion signals that feed these algorithms. BotRefund specifically calls out protection for Performance Max, Meta Advantage+ Shopping, and Advantage+ Leads campaigns.

How much budget can I realistically recover?

Industry audits consistently place automated traffic between 9% and 20% of paid clicks. Across millions of audited visits, non-human traffic consumes 15% to 25% of paid advertising budgets. Recovery depends on your specific bot exposure, campaign mix, and how quickly you file claims. Google limits claims to the past 60 days.

What if my traffic drops after enabling detection?

Reported traffic in Google Analytics or Meta Ads Manager won't drop — the script doesn't block visitors. What changes is conversion pixel firing for flagged bot sessions. Your conversion count may decrease, but the remaining conversions are human. This is the intended effect: cleaner data for algorithm optimization.

Do I need to share my Google Ads or Meta login credentials?

No. BotRefund operates with zero ad-account access. The edge script runs on your site, captures behavioral evidence and click IDs, and submits refund claims through the platforms' public invalid-traffic dispute channels. Your margins, bids, and campaign structure remain private.

How long does a refund claim take?

Claims are filed through Google and Meta's own invalid-traffic channels. Approval timelines vary by platform and claim complexity, but the 83% approval rate reflects claims filed with compliance-grade behavioral evidence. The free audit shows you exactly what's recoverable before you commit.

Cookie-locking is one of the most effective ways to stop affiliate attribution fraud. But turning it on at the wrong time can create new problems. You need to know exactly when to enable it, when to wait, and what to check first.

This guide gives you a practical readiness checklist, explains the mechanics, and shows real scenarios where cookie-locking makes sense — and where it might not.

Readiness Checklist: Are You Ready to Turn On Cookie-Locking?

Before you flip the switch, verify that your program has these five conditions in place. If even one is missing, fix it first.

• You have a coupon code or cashback program active. Coupon extensions like Capital One Shopping activate when a user checks out. They inject their own affiliate cookie at the last second. If you run coupon codes, you are already exposed.
• You see browser extensions like Capital One Shopping in your conversion data. Check your affiliate reports for clicks from domains like capitaloneshopping.com or similar. If you see many conversions with a very short time-to-checkout, those are likely extension-driven.
• You notice a drop in sales attributed to your affiliates without a change in traffic. A sudden decrease in commission credit while overall sales stay flat is a classic sign that someone else is taking the last click.
• You have identified cookie-stuffing patterns, such as clicks after cart updates. If you see affiliate clicks that occur after a user has already added an item to the cart, that is not a real referral. That is a silent cookie drop.
• You want to protect organic and paid traffic from stolen attribution. Cookie-locking ensures that the first click gets credit, not the last. That protects the channels that actually brought the visitor to your site.

If all five are true, you are ready. If not, address the gaps first.

When to Wait Before Enabling Cookie-Locking

Cookie-locking relies on accurate first-click tracking. If your tracking is not set up correctly, you could lock a cookie from a bot or a misconfigured link.

Wait if you have not yet verified that your affiliate platform records the first click correctly. Run a few test conversions with known referrers and compare the timestamps.

Also wait if you have not communicated the change to your partners. Some affiliates rely on last-click credit. They may have built strategies around final-click attribution. Explain the policy before you flip the switch so they can adjust.

If your affiliate network does not support cookie-locking natively, do not try to hack it with custom scripts. That often creates more problems than it solves. Use the platform's built-in setting or a third-party solution.

The Exception: When Cookie-Locking Might Hurt

Cookie-locking is not always the right answer. In some situations it can distort your attribution and cause under-reporting of other channels.

Consider a user who clicks an affiliate link, leaves, then returns later through a paid search ad and buys. With cookie-locking, the affiliate still gets credit because they had the first click. But the paid ad actually drove the conversion. You might under-count your paid ad performance and over-credit the affiliate.

In that case, you may want a hybrid model that gives partial credit to both touchpoints. Or you could shorten the cookie window so the affiliate credit expires sooner. Full locking is not the only option.

Another exception: if you have a very small program with no known fraud, cookie-locking can add unnecessary complexity. You might not need it yet. But as soon as you scale or launch coupon campaigns, the risk rises.

What Is Cookie-Locking and How Does It Stop Attribution Hijacking?

Cookie-locking is a setting in affiliate platforms that assigns the commission to the first affiliate click, not the last. It freezes the attribution path as soon as the first click happens. Later clicks from other affiliates or browser extensions cannot overwrite that initial cookie.

This matters because most affiliate fraud happens after the click, according to BotRefund's analysis. Click-level fraud tools catch bots in the traffic, but the commissions that cost you most come from real sessions where an affiliate manipulates the attribution path in the final seconds before conversion.

Here are the three common manipulation patterns cookie-locking blocks:

• Last-click hijacking: An affiliate fires a redirect or drops a cookie in the final seconds before a user converts, stealing credit from whoever actually drove the signup or sale.
• Cookie stuffing: Tracking cookies are placed silently via hidden images or iframes, with no user interaction and no real referral. The commission is claimed anyway.
• Coupon extension overwrites: Browser extensions like Capital One Shopping inject their cookie at the moment of purchase, claiming commission on a sale the affiliate had no part in.

These patterns look like legitimate conversions. They do not show up as bot traffic. Without cookie-locking, they get paid.

By locking the first click, you prevent these overwrites. The original referrer keeps the credit, and the manipulation is ignored.

Key Facts About Affiliate Attribution Fraud

These patterns often appear together. A single session might involve both a cookie stuffer and a coupon extension. Cookie-locking addresses all of them because it ignores any later cookie.

Limitations of Cookie-Locking

Cookie-locking alone cannot stop all affiliate fraud. It only fixes the last-click problem. It does not catch sophisticated schemes that happen outside the cookie path, such as click fraud from botnets or lead fraud where bots fill out forms.

According to BotRefund, most affiliate fraud happens after the click. Click-level tools catch bots, but the commissions that cost you most come from real sessions where an affiliate manipulates the attribution path. Cookie-locking addresses the last-click issue, but you still need behavioral analysis to catch manipulation that occurs after the click but before the cookie is set.

Also, cookie-locking will not help if your tracking is set to first-click incorrectly. If you have a bug that sets the first click to a bot or a misconfigured link, locking it will just protect that wrong data. You must validate your tracking first.

Finally, cookie-locking can reduce the credit some affiliates receive. Honest affiliates who drive the first visit will still get credit, but those who relied on last-click hijacking will lose revenue. That is a good thing, but it may cause friction. Communicate clearly and monitor partner feedback.

Terminology to Know

• Attribution path: The sequence of clicks and touchpoints that lead to a conversion.
• Last-click attribution: Crediting the final click before purchase with the commission.
• First-click attribution: Crediting the first click that brought the visitor to your site.
• Cookie stuffing: Placing tracking cookies without user interaction.
• Coupon extension overwrite: Browser extensions that inject affiliate cookies at checkout.
• Cookie-locking: A setting that freezes the first click and ignores later overwrites.

FAQ

What exactly does cookie-locking do?

It locks the affiliate cookie to the first click, so later clicks from other affiliates or extensions cannot overwrite the credit.

How does cookie-locking stop coupon extensions?

Extensions like Capital One Shopping inject their cookie right before checkout. With locking, that injection is ignored because the first click is already set.

Will cookie-locking reduce my affiliate partners' earnings?

It can, if a partner previously earned commissions from last-click hijacking. Legitimate partners who drive the first visit will keep their credit. It may also help attract honest affiliates who want fair compensation.

How do I know if I need cookie-locking?

Check for the three patterns: last-click hijacking, cookie stuffing, or coupon extension overwrites. If you see a drop in attributed sales or notice extension-driven conversions, you need it.

What is the difference between first-click and last-click attribution?

First-click gives credit to the original referrer; last-click gives credit to the final click before purchase. Cookie-locking relies on first-click attribution.

How quickly can I see results?

You should see a shift in which affiliates get credit within one billing cycle. The exact timing depends on your affiliate platform and cookie duration.

Can I use cookie-locking with a hybrid attribution model?

Some platforms allow both. But full locking is binary: it either locks or it does not. If you need split credit, consider a custom model or a shorter cookie window.

Does cookie-locking affect organic search traffic?

It protects organic search by ensuring that if a user clicks an affiliate link before a later organic visit, the affiliate still gets credit. That can under-report organic performance, so monitor your analytics.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• All about affiliate program cookie window - how long should you ...
• Cookie Duration in Affiliate Marketing: Find Your “Sweet Spot”
• Affiliate Marketing Cookie Duration Explained 2026

Enable disposable-email blocking the moment you start a campaign that attracts high-volume sign-ups, or as soon as you see a spike in low-quality leads. Waiting until after your payout cycle means you may already have paid commissions on fake or non-converting signups.

Disposable email addresses are a common sign of lead fraud. Bots and low-quality affiliates use them to register fake accounts, fill forms, and earn commissions on conversions that never become real customers. When your campaign is just starting, you may not have enough data to know if disposable emails are a problem. But once volume increases or lead quality drops, blocking them becomes a priority.

When to Turn On Disposable-Email Blocking

Activate disposable-email blocking when you cross any of these triggers:

• High-volume campaigns: If you run a lead generation or signup campaign that pulls in hundreds or thousands of registrations per day, the risk of fake submissions rises sharply.
• Spike in low-quality leads: When your sales team reports unreachable contacts, invalid email domains, or repeated addresses, disposable-email blocking can stop the bleed.
• Affiliate program launches: New affiliates may try to game the system early. Turning on blocking before you approve affiliates keeps your baseline clean.
• Before payout cycles: If you pay commissions monthly or weekly, enable blocking at least a few days before the cutoff to catch fraud in that period.

The exact moment depends on your campaign's scale and your lead-quality data. The checklist below helps you decide with confidence.

The Readiness Checklist: Deciding When to Enable Blocking

Use this checklist to evaluate whether your account is ready for disposable-email blocking. You should enable it when you can say “yes” to most of these items.

• Do you have a live campaign that generates signups? If you're not getting any conversions, blocking emails won't matter. Wait until there's traffic.
• Have you reviewed your recent lead quality? Look for bounce rates, invalid domains, and unresponsive contacts. If more than a few percent of leads look suspicious, it's time.
• Are you tracking attribution correctly? BotRefund reads UTM and click IDs from your traffic. Make sure those are in place so you can verify which affiliates drive real signups.
• Can you distinguish between a disposable email and a legitimate one? Reliable blocking uses up-to-date domain lists and real-time checks. If you only rely on a static list, you may block valid customers.
• Have you warned your affiliates? Let them know you're enforcing email quality. This alone can deter some fraud.
• Is your payout process ready? When blocking is on, some legitimate signups might be held for review. Make sure you have a process to manually approve valid leads.

If you answered “no” to most of these, wait until you have more data or your setup is complete.

Signs You Should Wait Before Enabling Blocking

Not every affiliate account needs disposable-email blocking right away. Here are signs to wait:

• Very low traffic: If you get fewer than a few dozen signups a week, the fraud risk is low. Blocking could annoy a legitimate user who happens to use a temporary email.
• No affiliate fraud history: If you've never seen a fake signup or invalid email in your reports, you can postpone blocking until you have evidence.
• Campaigns that target real, verified customers: If your product requires a business email or manual approval, disposable emails are less of a threat.
• You haven't vetted your affiliates: If you haven't reviewed who your affiliates are, blocking emails may not address the root cause. Better to audit your affiliate list first.

Blocking too early can block a few real users. But if you wait until fraud is obvious, you've already lost commission money. The key is to watch your lead-quality metrics.

How BotRefund Fits Into Your Lead-Quality Strategy

BotRefund audits every affiliate conversion using behavioral signals, attribution path analysis, and click-to-conversion timing. It tells you which commissions to approve, hold, or reject before payout. This complements disposable-email blocking: while email blocking stops obvious fake submissions, BotRefund catches more subtle fraud like last-click hijacking and cookie stuffing — patterns that don't involve disposable emails at all.

For example, an affiliate might send real traffic but manipulate the attribution path in the final seconds before conversion. BotRefund flags that. Disposable-email blocking alone would never catch it. So think of disposable-email blocking as a first filter. BotRefund is the second, deeper audit.

When you enable disposable-email blocking, you reduce the volume of fake leads that reach your CRM. Then BotRefund checks the remaining conversions for behavioral anomalies. Together, they give you a much cleaner payout process.

Key Facts About Affiliate Fraud and Lead Quality

Limitations and When the Checklist Doesn't Apply

Disposable-email blocking is not a silver bullet. It only stops signups that use known temporary email domains. Affiliates can switch to other tactics, such as using real email addresses from bots or hijacking sessions.

The checklist also assumes you have enough traffic to make blocking worthwhile. If you're running a niche offer with a handful of signups per month, the overhead may not justify the risk of blocking a legitimate user.

Some legitimate users do use disposable emails for privacy. For example, a user testing a free trial might use a temporary address. If your business relies on trial signups that later convert, blocking could hurt your funnel. In that case, you might want to hold those conversions for manual review instead of rejecting them outright.

Finally, the checklist doesn't replace a full fraud audit. Even with blocking enabled, you still need to monitor attribution paths, click timing, and session behavior. Use BotRefund's evidence dashboard to review suspicious conversions before each payout.

FAQ: Disposable Emails and Affiliate Protection

What is a disposable email address?

A disposable email address is a temporary inbox that expires after a short period. Anyone can create one without providing personal information. Fraudsters use them to register fake accounts and earn affiliate commissions.

How do I know if an email is disposable?

You can check the domain against known disposable email provider lists. Many fraud prevention tools offer real-time checks. Some email validation services also flag temporary addresses based on domain age and behavior.

Will blocking disposable emails affect my conversion rate?

It might. A small percentage of legitimate users use temporary emails for privacy. However, if your product targets businesses or requires a lasting account, the loss is usually negligible compared to the money saved from fake commissions.

How does BotRefund help beyond email blocking?

BotRefund uses behavioral signals, attribution path analysis, and click-to-conversion timing to detect fraud that email blocking misses. It examines the entire conversion path, including last-click hijacking and cookie stuffing.

Can I enable blocking after a payout cycle starts?

You can, but you risk paying out on fake commissions earned before blocking was active. It's better to enable blocking before you begin a new campaign or before each payout cycle.

What should I do if I accidentally block a legitimate lead?

Keep a manual review queue. If a user contacts you, you can verify their email and approve the commission. Most blocking tools allow allowlisting domains or email addresses.

How often should I review my blocking settings?

Review them whenever you launch a new campaign or change your affiliate program. Also check after any spike in lead volume or quality complaints. Fraud tactics evolve, so your filters need updating.

The Escalation Trigger

Escalation is a serious step. It should be reserved for systemic issues, not minor fluctuations. You should trigger an escalation to Meta support when your monitoring tools detect that more than 5% of your traffic consistently exceeds high-confidence bot thresholds over a three-day period. Alternatively, escalate immediately if the financial impact—calculated by multiplying invalid click volume by your average cost-per-click—surpasses your internal threshold for acceptable variance.

Readiness Checklist for Escalation

Before contacting Meta support, ensure your evidence is ready. Meta requires proof, not just suspicion. Use this checklist to verify your readiness:

• Forensic Evidence: Do you have a list of specific Click IDs (FBCLIDs) associated with the flagged sessions?
• Behavioral Logs: Have you documented the specific signals (e.g., zero-scroll sessions, impossible click rhythms, or identical device fingerprints) that define these sessions as non-human?
• Impact Analysis: Can you clearly demonstrate the correlation between the bot activity and the degradation of your campaign performance (e.g., spike in bounce rate, drop in conversion quality)?
• Timeline: Is your data set spanning at least three consecutive days to prove this is a persistent issue rather than a transient anomaly?

When to Wait

Do not escalate if you are seeing isolated spikes in traffic that do not correlate with a drop in lead or conversion quality. Occasional bot activity is a reality of digital advertising. If the traffic is not impacting your bottom line or poisoning your pixel data, focus on internal suppression first. Escalating prematurely can lead to support fatigue and may result in your future, more critical requests being deprioritized.

The Role of Behavioral Signals

Behavioral signals are the measurable interactions—such as scroll depth, dwell time, and click rhythm—that distinguish human users from automated scripts. When these signals are ignored, Meta’s machine learning algorithms may interpret bot activity as "successful" conversions. This leads the system to optimize your targeting toward bot-like profiles, effectively training your campaigns to find more fake traffic.

Why Ignoring Signals Costs You

If you ignore behavioral signal alerts, you are essentially paying for "junk" traffic that will never convert. Beyond the immediate loss of ad spend, the long-term damage is to your account's intelligence. By feeding your pixel data from bots, you corrupt your Lookalike audiences and Advantage+ models, making it harder for the platform to find your actual customers in the future.

Key Facts: Meta Traffic Quality

Exceptions to the Rule

There are scenarios where the 5% threshold may not apply. If you are running a high-stakes, short-term campaign where even a 1% deviation in traffic quality could jeopardize your entire budget, you may choose to escalate sooner. Additionally, if you identify a specific, malicious click-farm pattern that is clearly targeting your brand, report it immediately regardless of the volume, as this constitutes active fraud rather than standard publisher-network noise.

How to Build Your Evidence Dossier

Meta support needs hard proof. A simple screenshot of a spike in clicks will not work. You need a dossier that includes:

• Click IDs (FBCLIDs): Every click on a Meta ad gets a unique ID. Capture these for every flagged session. Tools like BotRefund auto-capture these IDs for you.
• Session Recordings: Show that the user did not scroll, did not move the mouse, or filled a form in under one second. This proves non-human behavior.
• Device Fingerprints: Log the browser, OS, screen resolution, and IP address. Bots often reuse the same fingerprint across many sessions.
• Timestamps: Record the exact time of each click. Bots often click in rapid bursts, such as 50 clicks in one minute from the same IP.

Organize this data in a spreadsheet. Include one row per flagged click. Meta reviewers need to see the pattern, not just one example.

What Happens After You Escalate

Once you submit your evidence, Meta’s team reviews it. They compare your data against their own logs. If they confirm invalid traffic, they issue a refund. The refund is usually a credit to your ad account, not a cash payout. The process can take one to four weeks. If Meta rejects your claim, you can appeal. Appeals require even more detailed evidence. Many advertisers fail at this stage because they did not capture enough data upfront.

Common Mistakes in Escalation

Many advertisers make the same errors. Avoid these:

• Escalating too early: A single bad day is not a pattern. Wait for three consecutive days of high bot traffic.
• Submitting vague evidence: "My bounce rate went up" is not proof. You need specific click IDs and session logs.
• Ignoring the revenue impact: Meta cares about financial harm. If the bot traffic did not cost you real money, they may not act.
• Not using a tool: Manual evidence collection is slow and error-prone. Use a service like BotRefund to automate the process.

Frequently Asked Questions

What is the 5% threshold based on?

It is a common industry benchmark. Across millions of audited visits, non-human traffic consistently consumes 15% to 25% of paid advertising budgets. The 5% threshold is a conservative trigger for escalation. It ensures you only escalate when the problem is clearly above normal noise.

Can I escalate for a single day of high bot traffic?

No. Meta requires a three-day pattern. A single spike could be a temporary glitch or a one-time attack. Three days of consistent high traffic proves the issue is systemic.

What if my revenue impact is small but the bot traffic is high?

Escalate anyway. Even if the immediate revenue loss is small, the long-term damage to your pixel data is significant. Bot traffic poisons your Lookalike audiences and Advantage+ models. This makes future campaigns less effective.

How do I capture FBCLIDs?

Use a tool like BotRefund. It automatically captures the FBCLID for every click on your landing page. You can also capture them manually by adding a URL parameter to your ad links, but this is error-prone at scale.

What is the approval rate for refund claims?

BotRefund reports an 83% approval rate across filed claims. This high rate is due to the quality of evidence they provide. Without solid evidence, your approval rate will be much lower.

How long does the refund process take?

Typically one to four weeks. Meta reviews the evidence, cross-references it with their logs, and issues a credit if the claim is valid. Appeals can take longer.

Can I escalate for bot traffic on Meta Audience Network?

Yes. The Audience Network is a common source of invalid traffic. Clicks from third-party apps and websites often show high CTRs and near-instant bounces. Include placement data in your evidence dossier.

What if Meta rejects my claim?

You can appeal. Appeals require even more detailed evidence. Many advertisers fail because they did not capture enough data initially. Use a tool to ensure you have comprehensive logs from the start.

Do I need to stop my campaigns while I escalate?

Not necessarily. You can pause the specific ad sets or placements that are generating the bot traffic. This stops the bleeding while you compile your evidence. Do not pause your entire account unless the problem is widespread.

Is there a cost to escalate?

No. Filing a claim with Meta is free. However, the time and effort to compile evidence can be significant. Many advertisers use a service like BotRefund to automate the process. BotRefund charges a fee only when you receive a refund.

When to Escalate a Denied Refund Request

You should escalate a denied refund request after you receive a formal denial letter or email and you meet at least one of three conditions: you have new evidence that was not available during the first review, the denial cites a policy you believe was applied incorrectly, or the disputed amount is large enough to warrant the additional effort. Escalating too early wastes your time; escalating too late can close your window permanently.

The decision to escalate is not about persistence for its own sake. It is about matching your case to the right channel at the right moment. A denial that ignores new documentation, for example, is a different situation from a denial that simply says "no" without explanation. Each requires a different approach.

What Triggers the Need to Escalate

Not every denial needs escalation. Some denials are correct and final. But certain signals tell you that pushing further is worth the effort.

• New evidence appears after the denial. If you discover documents, logs, or communications that support your original claim and were not part of the first review, escalation is appropriate.
• The denial cites a policy you believe was misapplied. Sometimes a company applies a blanket rule without considering your specific circumstances. If you can show the policy does not fit your situation, escalate.
• The amount justifies the effort. Small disputes may not be worth the hours of work. But when the sum is significant, escalation becomes a financial decision, not just a procedural one.
• The first review was rushed or incomplete. If you suspect the reviewer did not examine all the evidence, escalation gives your case a second look.

Readiness Checklist Before You Escalate

Use this checklist to confirm you are prepared before you file an escalation. Each item reduces the risk of your appeal being rejected again.

1. You have the original denial in writing. Do not escalate based on a verbal rejection. You need the formal decision document.
2. You have gathered all supporting documents. Collect receipts, correspondence, screenshots, logs, and any other evidence that supports your claim.
3. You can clearly state why the denial was wrong. Your escalation should explain, in plain language, what went wrong in the first review and why your case deserves a different outcome.
4. You checked the deadline for escalation. Many companies and platforms impose a window for appeals. Missing it closes the door.
5. You have tried the standard resolution path. Escalation is a second step. Make sure you have already filed the initial request through the proper channel.

Signs You Should Wait Before Escalating

Escalation is not always the right move. Watch for these signals that suggest waiting or taking a different approach.

• The denial is clear and the policy is unambiguous. If the company applied its stated policy correctly and you simply do not like the outcome, escalation is unlikely to change the result.
• You are still within the original review window. If the company has not yet finished its initial review, filing an escalation prematurely can slow things down.
• You lack new evidence. If you are escalating only because you are frustrated, and you have no new information, the appeal will likely fail.
• The amount is too small to justify the effort. Sometimes the cost of your time exceeds the potential recovery.

The Escalation Path: Where to Send Your Appeal

The escalation path depends on who denied your request. For ad platform refunds, the process typically starts with the platform's formal billing dispute system. Meta, for example, has a formal billing dispute process for advertisers billed for invalid clicks. Google similarly limits claims to the past 60 days, so timing matters.

For general consumer refunds, escalation usually moves from customer service to a supervisor, then to a formal complaints department, and potentially to a third-party mediator or consumer protection agency. The key is to follow the chain in order. Skipping steps can result in your escalation being returned unread.

When you escalate, address your appeal to the specific department or person named in the denial. Generic letters get routed back. Use the contact information provided in the denial notice, and keep a copy of everything you send.

Evidence You Need to Support Your Escalation

An escalation without evidence is just an opinion. Build a clear, organized case.

• Original request and denial documents. Show what you asked for and what you received.
• Supporting documentation. Include anything that proves your claim: contracts, receipts, screenshots, timestamps, communication records.
• A written summary. Explain in three to five sentences what happened, why the denial was incorrect, and what outcome you are seeking.
• Technical evidence when available. For digital ad disputes, platform-level data such as click identifiers, session logs, and behavioral signals can strengthen your case significantly.

Timeline and What to Expect

Escalation does not produce an instant result. Expect the following:

• Initial acknowledgment. The escalation team should confirm receipt within a few business days.
• Review period. Depending on the organization, a full review can take anywhere from a few days to several weeks.
• Decision notification. You will receive a written decision. If the escalation is successful, the denial is reversed and the refund is processed. If it is denied again, you will receive a final response that may reference further options.
• Next steps after a second denial. If you receive a final denial, you may have options such as filing a chargeback, requesting mediation, or contacting a consumer protection agency.

Key Facts

Limitations and When This Advice Does Not Apply

This guidance applies to situations where a formal denial has been issued and you are considering whether to appeal. It does not apply if you have not yet filed an initial request, if the denial is still under review, or if the company has not yet responded to your original claim.

Escalation timelines, evidence requirements, and available channels vary by organization. The steps described here are general and should be adapted to the specific process outlined by the company or platform that denied your request. Deadlines matter: missing a platform's claim window, such as Google's 60-day limit, can eliminate your options entirely.

This article does not provide legal advice. If your dispute involves significant sums or complex regulatory issues, consult a qualified professional before escalating.

Frequently Asked Questions

How long do I have to escalate after a denial?

The window varies by company and platform. Some give 30 days, others give 60 or more. Check the denial notice for the exact deadline. For Google ad refund claims, the limit is 60 days from the date of the charge.

What happens if my escalation is denied again?

A second denial does not necessarily end your options. You may be able to file a chargeback through your payment provider, request mediation through a consumer protection agency, or pursue the matter through small claims court depending on the amount and jurisdiction.

Do I need a lawyer to escalate a refund request?

For most disputes, you do not need a lawyer. The escalation process is designed to be handled by the customer or advertiser directly. However, for large or complex cases, legal guidance can help you build a stronger case and navigate formal procedures.

Can I escalate a denied refund request more than once?

Most organizations allow one escalation per denial. If you receive a final denial, your next step is usually outside the company's internal process, such as a chargeback or third-party complaint.

What is the difference between a refund request and an escalation?

A refund request is your initial ask for a return of funds. An escalation is a formal appeal of a denial, sent to a higher authority or specialized department within the organization. Escalation implies the first review did not produce the outcome you wanted.

Does escalating a refund request affect my account or relationship with the company?

In most cases, no. Escalation is a standard process and companies expect it. However, if you are making repeated unfounded claims, it could affect your standing. Focus on building a strong, evidence-based case rather than escalating repeatedly without new information.

Escalate a denied refund to a platform support team right after the first denial when you have something a person can actually review: new proof, a detailed click log, or a claim amount that exceeds the platform’s automatic approval ceiling. The smarter trigger is “what changed” not “I’m angry.” If you have no new evidence and the claim is small, an early escalation often gets you the same template answer.

A platform support team is a person who sees a limited set of fields in front of them. They approve refunds when the paperwork lines up with the platform’s own rules for invalid traffic: competitor clicks, publisher fraud, or bot and scraper activity. Build your case before you ask for a human to look.

Escalate when: the two go/no-go signals are present

• New evidence was not present in the original claim – this could be an extra click log, a screen recording of a ghost click, or a exporting the server-side vars for the session.
• The refund amount is above the auto-approval cut-off. Most platforms auto-approve small, routine credits. If your claim is above that invisible cap, months of tickets skip the queue and sit with a human. That’s when you formally escalate.

The readiness checklist: to check before you click “send”

• Did you capture the full session? – Check that your beacon fires on every click with a timestamp and a session ID. If Google’s Click Quality team asks for a specific GCLID, you must deliver that exact value.
• Is the click packet in your proof? – Pull the device type, user agent, and IP. Mobile proxies often shift mid-session; that is exactly the pattern platform teams want to see.
• Do you have video screen recording? – Provide a video that shows the bot interacting with the page. A still screenshot is rarely enough.
• Is the same pattern repeated on multiple claims? – Escalation gets stronger with a pattern, not an anomaly. One case is noisy; three cases of the same fake-finger pattern is a signal.
• Did you reset your ad region and IP after the first denial? – Sometimes typos make it appear a real visitor, and a human will re-litigate the same claim. Change the claim ID cadence and add a replay older estimate.
• Do you have a contact name/person? – Send it to a named support lead (sales rep, account manager, or a named ticketing owner). Support teams decide claims faster when they have a point of contact.

When waiting is the right call

Don’t escalate just because “no” feels wrong. Wait when the denial is consistent with your own setup: for example, your ad schedule runs 24/7 while your site produces zero conversions overnight. In that case, even a perfect 3-second visit can look valid to a platform.

Also wait if you haven’t checked the original claim for a simple mistake. A missing UTM, a mis-typed click ID, or a charge that existed before the fraud event is a common fix, not an escalation.

What platform support teams actually check

When your claim reaches a human, they do three things: verify the charge exists, compare the user agent, and review the full click life cycle. They reject a refund if your log only shows the click launch but not a page idle. They also check for a mix of mouse movement: a manual user has tremor and micro-movements; a bot has grid-aligned lines or superhuman speed. Those are behavioral signals your export needs to show.

Let the evidence speak. If your collected logs cover every click in that session, not just the one ad, the support team can see the whole sequence. That is usually the difference between an approval and a second denial.

How BotRefund closes the evidence gap

BotRefund’s service catches the two problems most businesses face: no click-level proof and no proof pattern. They detect ghost clicks, trap interactions, missing tremor, superhuman input speed, and grid-aligned paths, then assemble that into an audit report you can send to Google or Meta directly. The setup steps are: add a snippet to your site, run the audit for one minute, and export the report. No credit card is required to start the monitoring.

Key facts about the BotRefund model

Common reasons refunds are denied — and how to counter them

• “Clicks look human” – lazy fix: add a mouse-tremor dataset and show the discrepancy.
• “The proof is not complete” – counter by exporting a session start-to-end, not a screenshot.
• “We see no fake click” – counter by sending a video replay that shows a hidden element interaction.
• “Not covered under invalid click policy” – show exact type: competitor click activity or publisher fraud, which Google lists as legitimate credits.

Practical scenarios

Scenario 1: You run a small local business and your Sunday remote clicks returned a denial. Your volume is too low for attention, so escalation should be delayed. First, add a macro to track and log clicks for a week; then re-claim.

Scenario 2: Your B2B company spends $40k/mo on Google and Meta. You saw a race of bot clicks. Escalate immediately after the first denial with your bot audit file, and get your account reps involved. At that size, platform reps have a direct connection to the Click Quality team.

Scenario 3: You suspect your partner publisher is front-running. Capture a repeating pattern: identical user-agent with 0 event duration, 8 times an hour. That is new evidence; escalate at once.

Frequently asked questions

How long after a denial should I wait to escalate?

If you have new evidence, escalate the same business day. The window for ad refunds is not always formal, but waiting too long reduces the chance they still hold the cached click logs. Give yourself no more than one week to prepare a second package.

Is escalation the same as a chargeback?

No. Escalation is a formal request to the platform’s own quality team. A chargeback happens before your bank and is a last resort. Chargebacks can hurt your ad account relationship.

What exact evidence do I need to prove a bot click?

Prove that the click lacks human tremor, or takes under a millisecond to complete. A screenshot does not prove that. A log with the difference in speed and movement is the strongest proof.

Was this a “simple” threshold in the refund policy?

Each platform publishes its own internal approval rules. The CLI-level data in the source clearly shows that “is invalid activity” covers accidental clicks only if the user double-clicks or fat-fingers. Real bot behaviour falls outside that.

What is the cost of escalation?

Escalation to a platform support team is usually free — it’s a request inside your ad account. The cost is the time you spend preparing proof. There is no charge for a standard escalation ticket.

Exclude known invalid domains, IPs, and app IDs before training a new Meta campaign so the algorithm optimizes against a clean baseline. Do this when you have documented evidence of invalid traffic from prior campaigns, before launching new campaigns, before scaling spend, after tracking or pixel changes, or when performance drops unexpectedly.

Why Excluding Invalid Traffic Before Training Matters

Meta's learning system trains on every recorded click and conversion event. When invalid traffic — bots, scrapers, click farms, or accidental clicks — generates those signals, the algorithm learns to find more of the same low-quality visitors. This creates a feedback loop where the campaign spends budget on traffic that cannot convert. As BotRefund notes, "bot clicks steal up to 20% of your Google and Meta ad budget" and "poison your Meta Pixel data" so that "Meta's machine learning systems optimize targeting for bots rather than real buyers."

The damage compounds during the learning phase. A new campaign with no history relies entirely on early signals. If those signals include invalid traffic, the model builds its targeting profile around noise. Cleaning the training data before launch prevents this contamination.

Readiness Checklist: When to Exclude Old Invalid Traffic Data

Use this checklist to decide whether to carry exclusions into a new campaign's training data. Check each item that applies to your situation.

• You have completed a structured audit comparing Meta Ads Manager data, website sessions, and CRM outcomes for the previous campaign.
• You have identified specific invalid domains, IP ranges, or app IDs with behavioral evidence (e.g., superhuman input speed, grid-aligned mouse movements, absence of humanlike mouse tremor).
• You have preserved click identifiers, campaign context, timestamps, URL parameters, and CRM records for the flagged traffic before changing any campaign settings.
• You are launching a new campaign, scaling spend significantly, or have recently changed tracking or pixel configuration.
• Performance has dropped unexpectedly without a clear creative or offer change.

If you checked at least three items, exclude the documented invalid segments before the new campaign enters learning.

Signs You Should Wait Before Excluding

Do not apply exclusions based on assumptions or broad industry statistics. Imperva reported that automated traffic represented more than half of web traffic in 2025, but BotRefund cautions: "that does not mean half of a Meta advertiser's clicks are fraudulent. Treat broad industry statistics as context, then measure the quality of your own sessions and leads."

Wait if:

• You have not yet compared platform delivery, landing-page evidence, lead verification, and sales outcome feedback across placements, audiences, creatives, devices, geographies, and times.
• The quality gap appears in only one cluster with low volume. "Avoid eliminating an entire audience from a small sample; use enough volume to see a consistent quality pattern."
• Click-to-session gaps have ordinary explanations such as in-app browsers, tracking consent flows, slow page loads, or analytics configuration issues.
• You cannot distinguish between low-intent human traffic and automated traffic. "Not every bad lead is a bot, and that matters. Treating every unresponsive contact as fraud can make a team exclude a valuable audience."

Exception: When Historical Data Helps the New Campaign

Keep valid historical data in the training set when the new campaign shares the same offer, audience, creative style, and landing page as a previous campaign that produced verified, contactable, qualified leads. Meta's learning benefits from volume. Removing clean data reduces the signal pool and can extend the learning phase or trigger "Learning Limited" status.

Only exclude segments you have proven invalid through the four-layer audit: platform delivery, landing-page evidence, lead verification, and sales outcome feedback. Document the evidence for each excluded domain, IP, or app ID so you can defend the exclusion if Meta support requests justification.

How Invalid Traffic Poisons Meta's Learning Phase

Meta divides traffic quality into valid and invalid. Valid traffic consists of human visitors. Invalid traffic consists of automated interactions. When bots trigger conversion events — form submissions, button clicks, page views — they send conversion signals to the Meta Pixel. The algorithm then optimizes delivery toward users who behave like those bots.

Common invalid traffic sources on Meta include:

• Audience Network: Third-party mobile apps and websites where publishers use bots to click ads for artificial revenue. These clicks show high CTR and near-instant bounce rates.
• Profile scrapers and directory bots: Automated crawlers that follow outbound links on posts and ads to discover content.
• Click farms and competitor click networks: Human or automated operations paid to exhaust budgets or inflate metrics.
• Accidental clicks: Unintentional taps on mobile placements.

BotRefund's detection system identifies these through behavioral signals: "Ghost click detection catches click activity that happens without the natural sequence of human intent," "Honeypot trap interactions watch for bots that respond to hidden or intentionally deceptive page elements," and "Superhuman input speed (<1ms) identifies interactions that happen faster than a person could realistically perform."

Practical Investigation Workflow Before Excluding

Follow this sequence before adding exclusions to a new campaign:

1. Preserve attribution before changing the campaign. Keep campaign, ad set, creative, placement, and click identifiers intact while you investigate.
2. Compare platform delivery. Check reach, link clicks, landing-page views, placements, and spend. A cheap placement is not a win unless it produces contacts that can be reached and qualified.
3. Measure landing-page evidence. Track page loads, redirects, consent behavior, form start, form completion, time to completion, and meaningful engagement (scrolling, field corrections, time on page).
4. Verify leads. Record email deliverability, phone connectivity, duplicate details, and prospect confirmation of interest. Add qualification questions that reveal fit.
5. Feed sales outcome feedback. Use a small, mandatory set of dispositions: verified, contacted, qualified, disqualified, duplicate, invalid details, no response.
6. Cluster findings by placement, audience, creative, device, geography, landing page, and time. A sudden gap in one cluster is more useful than a site-wide average.
7. Document behavioral evidence for each invalid segment. Capture Click IDs, session recordings, and behavioral logs showing automation (linear mouse paths, absent tremor, superhuman speed, grid-aligned movement).
8. Apply exclusions at the account or campaign level before the new campaign launches. Use Meta's block lists for domains, IPs, and app IDs.

Key Facts

Limitations and When This Advice Does Not Apply

• This guidance applies to Meta lead-generation and conversion campaigns using the Meta Pixel or Conversions API. It does not cover brand-awareness campaigns optimized for reach or video views where conversion signals are not the primary training target.
• Exclusions based on IP addresses have diminishing returns as residential proxies and mobile carrier NATs rotate IPs frequently. Domain and app-ID exclusions are more durable.
• Meta's block lists have limits (e.g., maximum number of blocked domains). Prioritize the highest-volume invalid sources.
• If you lack server-side analytics, CRM integration, or behavioral tracking, you cannot reliably distinguish invalid from low-quality human traffic. Install client-side behavioral verification before auditing.
• New accounts with no history have no invalid traffic data to exclude. Focus on placement exclusions (e.g., opt out of Audience Network) and monitor early signals closely.

FAQ

How long does Meta's learning phase last, and when is it safe to apply exclusions?

The learning phase typically requires 50 optimization events within 7 days. Apply exclusions before the campaign launches, not during learning. Changing targeting or exclusions mid-learning resets the phase.

Can I use Google Ads invalid traffic exclusions for Meta campaigns?

No. Invalid traffic sources differ by platform. Google's data center IP lists and click-farm patterns do not map directly to Meta's Audience Network app IDs or Facebook scraper behaviors. Audit each platform separately.

What if Meta denies my refund claim for invalid clicks?

Meta's process is less structured than Google's. Behavioral logs showing automation — not just suspicious patterns — make the difference between approved and denied claims. Capture video proof, Click IDs, and session recordings for each disputed click.

Should I exclude all Audience Network placements by default?

Only if your audit shows consistent invalid traffic from Audience Network across multiple campaigns. Some advertisers get valid leads from Audience Network. Test with a small budget, measure lead quality through the four-layer audit, then decide.

How often should I refresh my exclusion lists?

Review quarterly or after any significant campaign structure change. Bot operators rotate domains and app IDs. Stale exclusions block clean traffic; missing exclusions let new invalid sources poison learning.

What is the minimum data volume needed to justify an exclusion?

No fixed number, but "avoid eliminating an entire audience from a small sample; use enough volume to see a consistent quality pattern." Look for repeated quality gaps across multiple days or weeks in the same cluster.

Can I automate exclusion updates based on real-time detection?

Yes. BotRefund's client-side tracking captures behavioral evidence in real time and can feed block lists via API. This keeps exclusions current without manual review cycles.

What the Unusual Device Flag Means

BotRefund flags a device when its behavior or configuration does not match what a real human browsing session would normally produce. The most common triggers are mismatched user agent and screen size, superhuman input speed, and rapid-fire requests that no person could realistically perform.

Think of it as a single piece of evidence. BotRefund does not call a device a bot just because one signal looks odd. It cross-checks that signal against browser, network, device, and behavior data before making a prediction.

The flag is not a verdict. It is a data point. BotRefund uses 106 independent checks to build a reliable picture of whether a visit is human or automated. Each check adds one objective fact about the visit. The system then tests whether other signals support the same story.

Readiness Checklist: Signs to Watch For

• Mismatched user agent and screen size: A device claiming to be a mobile phone but displaying a desktop-sized viewport, or vice versa.
• Superhuman input speed: Interactions that happen in under 1 millisecond—faster than any human could click or type.
• Rapid-fire requests: Multiple clicks or page loads in a burst that no person could generate naturally.
• Impossible tab speed: Switching tabs or scrolling at a pace that does not match human reading and decision-making.
• Robotic linear mouse movements: Pointer paths that are unnaturally straight, without the jitter and curves of a real hand.
• Grid-aligned movement patterns: Movement that snaps to precise lines or blocks instead of natural curves.
• Absence of humanlike mouse tremor: No tiny imperfections or jitter—the pointer moves too perfectly.
• Lack of UI focus states: Form fields are populated without mouse coordinate swaps, focus triggers, or page scroll telemetry.
• Unnatural session durations: Visit lengths that are too short, too long, or too uniform to be human.
• Absence of clicks or scrolling: Sessions that stay too static to match a real browsing journey.

When to Wait Before Acting

Do not treat a single flag as a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps the signal as evidence—not a verdict—and cross-checks it against independent browser, network, device, and behavior data.

If you see one anomaly, wait. If multiple independent signals support the same story, then the device is more likely to be automated.

For example, the Impossible Tab Speed check looks for a mismatch that a real browsing session does not normally create. Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people.

How BotRefund Builds the Picture

BotRefund uses 106 independent checks to build a reliable picture of whether a visit is human or automated. Each check adds one objective fact about the visit. The system then tests whether other signals support the same story.

For example, the Impossible Tab Speed check looks for a mismatch that a real browsing session does not normally create. Scripts can send clicks and scrolls, but they struggle to reproduce the varied timing, movement, and hesitation of real people.

BotRefund sends each signal into its prediction AI, which evaluates the complete pattern across browser, network, device, and behavior evidence. By seeing how all signals fit together, it identifies a visit as bot or human with 99% accuracy.

Accuracy comes from corroboration, not one browser tell. A single anomaly is never enough. The system weighs the complete pattern instead of trusting a raw rule.

Key Facts at a Glance

Practical Scenarios

Scenario 1: A Real User on a Corporate VPN

A genuine employee browsing through a corporate VPN might show an IP address that does not match their physical location. BotRefund would flag this as a network anomaly, but it would cross-check the device's behavior. If the user scrolls naturally, pauses to read, and moves the mouse with human jitter, the flag is dismissed.

Scenario 2: A Bot Using a Residential Proxy

A bot network using residential proxies might have a clean IP address, but it will still show superhuman input speed and robotic mouse movements. Multiple independent signals would point to automation, and BotRefund would flag the device as a bot.

Scenario 3: A Headless Browser Filling a Form

A script using Puppeteer to fill a SaaS signup form would populate multiple inputs instantly. There would be no focus states, no mouse coordinate swaps, and no page scroll telemetry. BotRefund would flag this as a bot based on the lack of UI focus states and superhuman input speed.

Scenario 4: A Click Farm Using Real Phones

Click farms use rows of real smartphones to click ads. Because they use actual mobile hardware, they bypass standard IP-range filters. But the clicks still show unnatural timing patterns and robotic movement. BotRefund flags these devices based on behavior, not hardware.

Scenario 5: A Scraper on a Meta Audience Network Placement

Third-party apps and websites in the Meta Audience Network often run automated bots to click ads and generate artificial publisher revenue. These clicks show high click-through rates and near-instant bounce rates. BotRefund flags them as unusual devices based on the rapid-fire request pattern.

Limitations and When the Advice Does Not Apply

BotRefund's flags are not absolute. A single anomaly is never a bot verdict. The system is designed to avoid false positives by cross-checking every signal against independent data.

If you are a genuine user with an unusual device—such as a privacy-focused browser, a corporate network, or a travel VPN—you may see a flag, but it should not result in a block unless multiple signals agree.

For advertisers, the advice is different. If you see a spike in clicks from a device with mismatched user agent and screen size, or rapid-fire requests, you should investigate. BotRefund can help you prove which clicks were bots and recover your ad spend.

Not every bad lead is a bot. Treating every unresponsive contact as fraud can make a team exclude a valuable audience. Start with a structured audit that compares ad-platform data, website sessions, and CRM outcomes before changing targeting or making a refund request.

FAQ

What does BotRefund consider an unusual device?

A device that shows anomalies like mismatched user agent and screen size, superhuman input speed, or robotic mouse movements. These are signals that a real human browsing session would not normally produce.

Will I be blocked if BotRefund flags my device?

Not necessarily. A single flag is evidence, not a verdict. BotRefund cross-checks the signal against independent browser, network, device, and behavior data before making a prediction.

How fast does BotRefund flag a device?

Detection happens during the session, not after the fact. BotRefund runs continuous, DOM-level behavioral telemetry on your pages, so flags appear in real time.

What is the most common trigger for an unusual device flag?

Mismatched user agent and screen size is a common trigger, along with superhuman input speed and rapid-fire requests. These are signs that a script, not a person, is interacting with the page.

Can a real user be flagged as an unusual device?

Yes, but only temporarily. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. BotRefund keeps the signal as evidence and cross-checks it before any action.

What should I do if I see an unusual device flag?

If you are an advertiser, investigate the clicks. If you are a user, check your browser settings and network. If multiple signals agree, the device is likely automated.

How does BotRefund avoid false positives?

By cross-checking every signal against independent data. A single anomaly is never enough. The system weighs the complete pattern across browser, network, device, and behavior evidence.

What is the difference between a flag and a verdict?

A flag is one piece of evidence. A verdict is the final prediction after all 106 checks are weighed together. BotRefund never makes a verdict based on a single flag.

Can a bot pass all 106 checks?

Very unlikely. Bots can fake some signals, but they struggle to reproduce the varied timing, movement, and hesitation of real people. The combination of checks makes it extremely difficult to pass all of them.

What should advertisers do when they see a spike in unusual device flags?

Investigate immediately. A spike in flags from devices with mismatched user agent and screen size, or rapid-fire requests, is a strong sign of bot traffic. BotRefund can help you prove which clicks were bots and recover your ad spend.

File a chargeback if the company refuses a valid refund, ignores you, or if you suspect fraud. A refund request should always be your first step — it resolves the issue directly with the merchant, usually within days, and costs nothing. A chargeback pulls your bank into the process, takes weeks or months, and can hurt the merchant's standing with card networks. Use a chargeback only when the merchant won't cooperate or the charge is genuinely unauthorized.

Understanding the Core Difference

A refund is a voluntary agreement between you and the merchant. The merchant returns your money, and the transaction is closed. A chargeback is a forced reversal initiated by your card issuer. The bank withdraws funds from the merchant's account and credits you, often with a fee attached. The merchant can fight back with evidence, but the process is adversarial and formal.

Refunds keep the relationship intact. Chargebacks create a dispute record that can affect the merchant's ability to accept cards. For you, a chargeback offers legal protection under the Fair Credit Billing Act when a merchant won't play fair. But it's a heavier tool — use it when the lighter one fails.

When to Start with a Refund Request

Most legitimate issues resolve with a direct request. Contact the merchant if:

• The product arrived damaged, defective, or not as described
• The service wasn't delivered as promised
• You were charged twice for the same purchase
• You returned an item within the return window
• A subscription renewed without clear consent

Give the merchant a reasonable window — typically 7 to 14 business days — to respond. Keep records: emails, chat logs, return tracking numbers, screenshots of policies. If they agree, the refund usually appears in 3 to 10 business days depending on your card issuer.

When to Escalate to a Chargeback

Move to a chargeback when the refund path is blocked. Common triggers:

• The merchant refuses a refund that their own policy or consumer law supports
• The merchant stops responding after multiple good-faith attempts
• You don't recognize the charge — possible fraud or identity theft
• The merchant went out of business before fulfilling the order
• You were charged for a recurring subscription you cancelled properly
• The product was never shipped and the merchant won't cancel the order

Act quickly. Most card networks require you to file within 60 to 120 days of the statement date. The clock starts when the charge posts, not when you notice the problem.

The Chargeback Process vs Refund Process

Refund Path

1. Contact merchant support (email, chat, phone)
2. Provide order details and reason
3. Merchant approves and processes refund
4. Funds return to your original payment method
5. Case closed — no third party involved

Chargeback Path

1. Call your card issuer or use their online dispute form
2. Select a reason code (fraud, not received, not as described, etc.)
3. Issuer files the chargeback with the card network
4. Merchant's bank notifies the merchant
5. Merchant can accept or fight with evidence (representment)
6. If fought, issuer reviews evidence and decides
7. Possible pre-arbitration and arbitration stages
8. Final decision — funds stay with winner

A chargeback can take 30 to 90 days or longer if the merchant contests it. During that time, the disputed amount may be temporarily credited to you, but it can be reversed if you lose.

Key Differences at a Glance

Takeaway: Refunds are faster, simpler, and collaborative. Chargebacks are slower, formal, and adversarial. Exhaust the refund path first unless fraud is involved.

Special Case: Ad Spend Recovery for Advertisers

If you run paid ads on Google or Meta, you may face a different kind of "refund" scenario: invalid bot traffic draining your budget. Platforms like Google Ads and Meta Ads have formal billing dispute processes for clicks that violate their invalid traffic policies. But these aren't standard consumer chargebacks — they're platform-specific claims requiring forensic evidence.

BotRefund helps advertisers detect non-human traffic using 110+ browser and network signals, capture click identifiers like GCLIDs and FBCLIDs, and prepare evidence dossiers that meet Google and Meta's strict documentation requirements. Their data shows non-human traffic consistently consumes 15% to 25% of paid advertising budgets across audited accounts. The service negotiates refunds directly with the platforms and operates on a zero-risk model — you pay only when a refund arrives.

This is a specialized refund channel, not a chargeback. You don't involve your card issuer; you work within the ad platform's own dispute system. The principle is similar: gather evidence, file a structured claim, and recover money for charges that shouldn't have happened.

Common Mistakes to Avoid

• Filing a chargeback before asking for a refund. This burns the merchant relationship and may violate card network rules that require good-faith resolution attempts first.
• Using a chargeback for buyer's remorse. "I changed my mind" isn't a valid reason code. You'll likely lose and waste time.
• Not keeping records. Screenshots, emails, tracking numbers, and policy pages are your evidence. Without them, both refunds and chargebacks fail.
• Missing the deadline. Most issuers enforce a 60-to-120-day window from the statement date. Mark your calendar when a dispute starts.
• Double-dipping. If you get a refund after filing a chargeback, tell your issuer immediately. Otherwise the merchant pays twice and you may face penalties.
• Confusing a billing error with fraud. A wrong amount or duplicate charge is a billing error — easier to prove. Fraud claims trigger stricter investigation and may require a police report.

Limitations and When This Advice Doesn't Apply

• Debit cards: Chargeback rights exist but are weaker than credit cards. Funds leave your checking account immediately. Resolution can take longer, and you may be without the money during the dispute.
• Peer-to-peer payments (Venmo, Zelle, Cash App): These typically offer no chargeback protection. You're relying on the platform's goodwill or the recipient's cooperation.
• Wire transfers and crypto: Generally irreversible. No chargeback mechanism exists.
• Business-to-business purchases: Commercial cards may have different rules and shorter windows. Check your card agreement.
• International merchants: Cross-border disputes add complexity. Card networks still apply, but time zones, languages, and local laws can slow things down.
• Services already rendered: If you received and used the service, a chargeback for "not as described" is much harder to win unless you can prove material misrepresentation.

Terminology Quick Reference

• Chargeback: A bank-initiated reversal of a card transaction, governed by card network rules and the Fair Credit Billing Act.
• Refund: A merchant-initiated return of funds, voluntary or policy-driven.
• Representment: The merchant's formal response to a chargeback, submitting evidence to overturn it.
• Reason code: A standardized category (e.g., 10.4 for fraud, 13.1 for merchandise not received) that frames the dispute.
• Pre-arbitration: A second review stage if the issuer rejects the merchant's representment.
• Arbitration: Final binding decision by the card network, with fees often exceeding $500 paid by the losing party.
• Friendly fraud: A cardholder files a chargeback for a legitimate purchase — either by mistake or intentionally. Merchants track this pattern.
• GCLID / FBCLID: Click identifiers (Google Click ID, Facebook Click ID) used to trace ad clicks to specific sessions. Critical evidence in ad platform refund claims.

FAQ

Will a chargeback hurt my credit score?

No. A chargeback is a dispute between you, the merchant, and the banks. It doesn't appear on your credit report. However, if you lose and refuse to pay, the issuer could send the debt to collections — that would hurt your score.

Can the merchant ban me for filing a chargeback?

Yes. Merchants can blacklist customers who file chargebacks, especially if they view them as illegitimate. This is common in digital goods, subscriptions, and travel. A refund request rarely triggers this.

What if the merchant offers store credit instead of a refund?

You can accept it or decline and pursue a chargeback if the original purchase terms promised a cash refund. Check the merchant's refund policy and your card network's rules — some require the original payment method be credited.

How much does a chargeback cost the merchant?

Typically $20 to $100 per dispute in fees, plus the transaction amount if they lose. High chargeback ratios can lead to higher processing fees or account termination. This is why merchants prefer refunds.

Can I file a chargeback for a subscription I forgot to cancel?

Only if the merchant violated their own terms — for example, they didn't send a renewal notice required by law, or they made cancellation unreasonably difficult. "I forgot" isn't a valid reason code.

What evidence do I need for a chargeback?

At minimum: the transaction details, your communication with the merchant, proof of return or cancellation, and any policy screenshots. For "not as described," photos comparing what was promised vs. delivered. For fraud, a police report helps.

Is there a limit on how many chargebacks I can file?

No hard limit, but issuers monitor patterns. Excessive disputes can flag your account for review, lead to card closure, or make future disputes harder to win. Use the tool sparingly and legitimately.

File within 30–60 days of detecting the anomaly while logs are fresh, but wait until you have at least 7–14 days of clean comparative data showing the traffic pattern has normalized or been blocked. Meta evaluates claims case-by-case and does not refund for poor performance, so evidence quality matters more than speed.

The Timing Window That Actually Works

Meta's billing dispute process has no public deadline, but practical constraints create a narrow window. Google explicitly limits claims to the past 60 days, and Meta's systems retain granular click data for a similar period. After 60 days, FBCLID-level detail — the click identifiers Meta requires — often disappears from reporting interfaces. Filing within 30 days preserves the richest evidence. Filing before you have 7–14 days of clean baseline data leaves you unable to prove the anomaly was temporary and external, not a campaign quality shift.

The sweet spot: detect the spike, block the placement or deploy client-side filtering, collect two weeks of normalized traffic, then file with both the "before" forensic evidence and the "after" control period. This sequence shows Meta the damage was discrete, measured, and contained.

Readiness Checklist Before You File

• Placement-level anomaly confirmed: Audience Network shows disproportionate click volume, near-instant bounce, or conversion events with zero downstream CRM activity.
• Forensic signals captured: 110+ browser and network signals (headless browser flags, residential proxy fingerprints, emulator patterns) tied to FBCLIDs for the suspect period.
• Mitigation in place: Audience Network opted out, BotRefund pixel suppression active, or IP/exclusion lists updated — with 7–14 days of post-mitigation data showing normalization.
• CRM reconciliation complete: Lead records for the suspect period tagged with campaign, ad set, creative, placement, FBCLID, landing-page URL, and timestamp; outcome fields show zero qualified pipeline.
• Comparative baseline documented: Same campaign, same creative, same audience — but clean placement mix — delivering normal engagement and conversion rates during the control window.
• Evidence dossier structured: Chronological narrative, signal heatmaps, FBCLID export, CRM outcome mismatch table, and mitigation timeline — formatted to Meta's dispute intake expectations.

Signs You Should Wait

• You only have platform-reported metrics (CTR, CPC) without client-side behavioral verification. Meta treats platform data as self-reported; they need independent proof.
• The traffic spike coincides with a creative refresh, audience expansion, or bidding change. You cannot separate fraud impact from optimization noise.
• Your CRM import overwrites FBCLIDs or landing-page URLs. Without click-level traceability, Meta cannot match your evidence to their billing records.
• You have not yet blocked or suppressed the suspect placement. Filing while bad traffic continues signals you haven't contained the problem.
• The anomaly is under 15% of spend. Meta's discretionary threshold for manual review tends to favor larger, clearer cases.

The Exception: When to Move Faster

If you detect a sudden, high-volume bot surge — residential proxy botnet or click farm hitting Audience Network placements at scale — file a preliminary claim within 7 days with whatever forensic evidence you have, then supplement. Meta's reviewers sometimes flag accounts for "unauthorized activity" review when they see rapid, high-velocity invalid traffic. Early notice creates a paper trail. But still gather the 7–14 day clean window before expecting approval.

What Meta Actually Requires for a Claim

Meta's Self-Serve Ad Terms state you are responsible for orders placed through your ad account. Unauthorized activity "can be considered" but is not automatically refundable. Refunds, when granted, may be issued as ad credits rather than cash; monthly-invoiced accounts may receive credit memos. Meta does not refund for poor ad performance or ROI. The claim must demonstrate discrete, measurable invalid traffic that bypassed Meta's filters — not campaign underperformance.

Evidence Meta reviewers look for: FBCLID-level click IDs, timestamps, placement identifiers (Audience Network vs. Facebook Feed vs. Instagram), behavioral proof of non-human interaction (zero scroll, instant form submit, headless browser signals), and CRM outcome mismatch. Vendor folklore about "invalid click forms" does not exist on Meta — there is no Google-style credit report. The burden of proof is entirely on the advertiser.

How Audience Network Fraud Differs from Search Click Fraud

On Google Search, you pay per click. An invalid click is a discrete billable event. Google built a credit process around that unit. Meta campaigns are optimized and billed around delivery and results — impressions served to audiences the system thinks will convert. The click charge, if there even is one, is trivial next to what fraud costs: pixel poisoning, lookalike corruption, smart bidding distortion, and wasted impression budget on bot audiences.

Audience Network amplifies this. Publishers on the network use automated bots to click ads in their apps to generate artificial revenue. These clicks show high CTRs and near-instant bounce. Worse, when bots trigger conversion events (Add to Cart, Lead, Purchase), they poison the Meta Pixel. The algorithm then optimizes for more bot-like users. The refund claim must therefore cover not just the click spend but the downstream algorithmic damage — a harder argument without client-side pixel suppression logs showing the exact events blocked.

Evidence Collection Framework

1. Deploy client-side detection before or immediately after detecting the anomaly. BotRefund's edge script evaluates 110+ signals on-site with zero ad account access.
2. Auto-capture FBCLIDs for every session. Store them alongside CRM lead records.
3. Flag bot sessions in real time and suppress Meta Pixel firing for those sessions. This creates a clean "what would have happened" dataset.
4. Export suspect-period data: FBCLIDs, timestamps, placements, signals, CRM outcomes.
5. Run mitigation: Opt out of Audience Network, enable pixel suppression, update exclusions.
6. Collect 7–14 days clean data under the same campaign settings.
7. Build the dossier: Signal heatmap, FBCLID list, CRM mismatch table, mitigation timeline, before/after comparison.
8. Submit via Meta's billing dispute channel with the structured evidence package.

Common Mistakes That Kill Claims

Limitations and When This Advice Does Not Apply

• Monthly-invoiced accounts only: Credit memos apply to invoiced billing; self-serve credit-card accounts may receive only ad credits, if anything.
• No guarantee of approval: Meta's 83% approval rate (BotRefund's negotiated claims) reflects curated, evidence-rich submissions. Raw self-filed claims see lower success.
• 60-day hard ceiling: Granular FBCLID data expires. Claims for traffic older than 60 days rarely succeed.
• Small-spend campaigns: Cases under ~$5,000 in suspect spend often fall below manual review thresholds.
• Non-Audience Network placements: This framework targets Audience Network publisher fraud. Feed/Stories/Reels fraud follows different patterns.

Key Facts

FAQ

How long does Meta take to review a claim?

No published SLA. Evidence-rich claims negotiated through BotRefund typically resolve in 2–6 weeks. Self-filed claims can take longer or stall without reviewer follow-up.

Can I claim refund for pixel poisoning damage, not just click spend?

Yes, but you need pixel suppression logs showing exactly which bot-triggered events were blocked, plus before/after algorithm performance data. This is harder to prove than click-level fraud.

What if I already opted out of Audience Network?

File for the period before opt-out. The opt-out itself is mitigation evidence. You still need the 7–14 day clean window post-opt-out to show normalization.

Does Meta refund as cash or ad credits?

Usually ad credits. Monthly-invoiced accounts may receive credit memos. Cash refunds are rare.

Can I file without a tool like BotRefund?

Technically yes. Practically, you need 110+ signal forensic capture, FBCLID auto-capture, pixel suppression, and structured dossier generation. Manual collection rarely meets Meta's evidence bar.

What if my CRM doesn't store FBCLIDs?

Fix the CRM integration first. Without click-level traceability, Meta cannot match your evidence to their billing records. Claims without FBCLIDs are almost always denied.

Is there a minimum spend threshold to bother filing?

Cases under ~$5,000 in suspect spend often fall below manual review thresholds. The effort-to-reward ratio improves significantly above $10,000.

File a refund claim as soon as you detect a pattern of invalid clicks — ideally within 30 days of noticing the issue — because Google and Meta only honor claims for the most recent 60 days. Waiting longer than 30 days risks losing evidence and exceeding the platform's lookback window.

Readiness Checklist: Are You Prepared to File?

• You have identified a repeatable pattern — not a single bad day. Look for consistent timing (budget exhausts at the same hour daily), geographic concentration matching a competitor's location, regular click intervals (every 5, 10, or 15 minutes), high CTR with zero conversions, or spikes on weekends and holidays.
• You have captured click identifiers — GCLIDs for Google Ads, FBCLIDs for Meta — tied to on-site behavioral evidence (scroll depth, dwell time, form interactions). BotRefund's edge script captures these automatically across 110+ forensic signals.
• You can show the traffic is sophisticated invalid traffic (SIVT) — the kind Google's automated filters miss. Google's own filters catch less than 50% of invalid traffic; the remainder requires manual evidence submission.
• You are within the 60-day platform window.. Google limits claims to the past 60 days. Meta operates on a similar rolling window. Every day you wait shrinks the recoverable period.
• You have ruled out campaign-quality issues. Poor targeting, weak creative, or low conversion rates do not qualify for refunds. The distinction matters: a weak campaign attracts real people who don't buy; bot traffic leaves technical fingerprints.
• You have a compliance-ready dispute package — timestamped click IDs, landing-page URLs, placement data, device info, and behavioral logs formatted for Google's or Meta's manual review teams.

Why Timing Matters: The 60-Day Hard Limit

Both Google and Meta impose a rolling 60-day lookback on invalid-click refunds. Clicks older than 60 days are simply not eligible, regardless of how strong your evidence is. This is not a guideline — it is a platform policy enforced at the billing-system level.

The 30-day internal target gives you a buffer. Evidence degrades: logs rotate, click IDs expire, placement reports become harder to reconcile. Starting the audit at day 10-15 after you first suspect a problem leaves enough time to compile a dossier before the 60-day cliff.

Timing is also critical because of how machine learning works. When bots click your ads, the platform's algorithm sees these as successful engagements. It then optimizes your campaign for more bot-like users. If you wait until day 55 to claim, the algorithm has already spent two months training on low-quality data. Filing early allows you to stop the 'poisoning' of your conversion pixels before damage compounds.

How to Know You Have a Valid Claim

Not every wasted dollar qualifies. Platforms distinguish between general invalid traffic (GIVT) — known bots, crawlers, data-center IP ranges that their filters already catch — and sophisticated invalid traffic (SIVT) that mimics human behavior well enough to slip through automated defenses. Only SIVT that the platform missed is refundable.

Key signals that separate SIVT from a poorly performing campaign:

• Behavioral uniformity: no scrolling, no field corrections, identical click paths, near-zero dwell time.
• Placement-level anomalies: a single placement or audience expansion driving disproportionate clicks with zero downstream CRM activity.
• Temporal regularity: clicks arriving at fixed intervals, or budget exhaustion at the same hour each day.
• Geographic mismatch: traffic spikes from regions you don't target, or that align with a known competitor's office location.
• Conversion-pixel poisoning: bots triggering "Add to Cart" or lead events, which then trains smart-bidding algorithms to chase more bot-like users.

If you see several of these patterns together, you likely have SIVT that the platform missed — and a refund claim is warranted.

Understanding the Mechanics: SIVT vs. GIVT

To win a refund dispute, you must understand the technical difference between traffic types. General Invalid Traffic (GIVT) consists of 'obvious' bots. These include search engine crawlers, known scripts, and data center IP addresses. Google and Meta have massive databases to block these automatically. You rarely need to manually file for GIVT because the platform already credits your account.

Sophisticated Invalid Traffic (SIVT) is the real threat. SIVT uses residential proxies to make traffic look like legitimate home users. These bots use headless browsers to simulate human movements. Because they look like people, the platform's automated filters fail. To get a refund for SIVT, you must provide forensic evidence that the platform did not capture on its own.

Forensic Signals: What Evidence Matters

Automated filters look for simple patterns. To prove SIVT, you need deeper technical signals that the standard pixel misses. These signals are the 'digital fingerprints' of a bot.

• Mouse Movements: Humans move mice in curved, erratic paths with varying speeds. Bots often move in perfectly straight lines or teleport between coordinates. Capturing the physics of mouse movements proves non-human interaction.
• Scroll Depth: A real reader scrolls through a page at varying speeds. Bots often jump to the bottom or do not scroll at all. Tracking the percentage of the page viewed reveals intent.
• Device Fingerprinting: Screen resolution, installed fonts, and battery level. Bots often spoof these values or provide inconsistent data that doesn't match the reported user-agent.
• Form Interaction Timing: Humans type with varying rhythms and pauses. Bots paste text instantly or type with perfectly mechanical consistency. Measuring the milliseconds between keystroke is a key signal.

These signals are fed into machine learning algorithms. When you provide this data in a refund claim, you are showing the manual reviewer that the platform's automated model was deceived by high-fidelity bot mimicry.

Evidence You Need Before Filing

Platforms do not accept screenshots of Ads Manager. They require structured, click-level evidence that connects a billed click to a non-human session. The minimum viable dossier includes:

• Click ID (GCLID / FBCLID) for each disputed click
• Timestamp, landing-page URL, campaign, ad set, creative, placement, device
• Client-side behavioral signals: mouse movement, scroll depth, touch events, form interaction timing, session duration
• CRM outcome: no call connected, no demo booked, no qualified opportunity, no repeat engagement
• Aggregated summary showing the pattern across hundreds or thousands of clicks

BotRefund automates this capture with a lightweight edge script that evaluates traffic on-site without ad-account logins. It produces audit-ready logs formatted for Google's or Meta's manual review teams.

Step-by-Step: From Detection to Submission

1. Confirm the pattern using the checklist above. Do not confront competitor — that alerts them to change tactics.
2. Deploy client-side detection if you haven't already. Server logs and platform reports lack the granularity needed for SIVT.
3. Accumulate 7-14 days of clean evidence. A larger sample strengthens the pattern and improves approval odds (BotRefund sees 83% approval rate on direct claims).
4. Generate the dispute package: click IDs, behavioral logs, placement breakdown, CRM reconciliation.
5. Submit via the platform's manual dispute channel — Google Ads: "Invalid clicks form"; Meta: "Billing dispute" in Ads Manager.
6. Track the claim. Approvals typically arrive as account credits within 2-4 weeks. If denied, you can re-submit with additional evidence.

Common Mistakes That Delay or Kill Refunds

When to Wait (and When Not)

Wait if: you have only 1-2 days of suspicious data, you haven't ruled out tracking bug (e.g., double-firing pixel), or you're in the middle of a campaign restructure that could explain the anomaly.

Do not wait if: you see repeatable patterns, you're approaching day 45-50 of the 60-day window, or your daily budget is being exhausted by noon consistently. Every day of delay is money you cannot recover.

Key Facts

Limitations & Exceptions

• Refunds are issued as account credits, not cash payouts.
• Google and Meta each make the final determination; no third party can guarantee approval.
• Claims for clicks older than 60 days are automatically rejected.
• General invalid traffic (known bots, data-center IPs) is already filtered — you cannot claim refunds for traffic the platform already caught.
• Campaigns running on brand-new domains with no historical baseline may need a longer observation period before a pattern is statistically meaningful.

FAQ

How long does a refund claim take to process?

Typically 2-4 weeks after submission. Complex cases or high-volume accounts can take longer. Credits appear in the billing section of Ads Manager.

Can I file a claim for Meta (Facebook/Instagram) ads the same way?

Yes. Meta's manual dispute system works similarly. You need FBCLIDs, behavioral evidence, and a compliance-ready report. The 60-day window also applies.

What if Google denies my claim?

You can re-submit with additional evidence. Many denials happen because the initial submission relied only on platform reports. Adding client-side behavioral logs often changes the outcome.

Does filing a claim risk my ad account?

No. Filing a legitimate invalid-click dispute is a standard advertiser right. Accounts are not penalized for using the official dispute process.

How much does it cost to run a forensic audit?

BotRefund offers a free audit. The service operates on a zero-risk model: you pay only when a refund arrives, as a percentage of the recovered amount.

What's the difference between GIVT and SIVT?

General Invalid Traffic (GIVT) is known, easily identifiable non-human traffic (data-center crawlers, known botnets) that platforms filter automatically. Sophisticated Invalid Traffic (SIVT) mimics human behavior — residential proxies, click farms, competitor scripts — and requires manual evidence to prove.

Can I handle this without a tool?

Technically yes, but you need to capture 110+ browser and network signals per session, tie them to click IDs, and format the output for each platform's dispute queue. Most teams find the engineering lift prohibitive compared to a 2-minute script install.

Learn more about this service

See how this page can help with your next step.

Learn more

When to Flag a Lead as Bad vs. Unqualified: A Readiness Checklist

If your refund hasn't arrived after 10 business days, contact BotRefund support with your case ID. Most refunds process within this window once Google or Meta approves the claim. Use the checklist below to confirm you have everything needed before reaching out.

How BotRefund's Refund Process Works

BotRefund detects invalid clicks across 110+ behavioral signals, builds evidence dossiers with GCLIDs and FBCLIDs, and submits those dossiers directly to Google and Meta compliance reviewers. The platform operates on a contingency model: you pay 32% only when money is recovered, and historical approval rates sit at 83%.

Once a claim is submitted, the timeline depends on the ad platform's review queue. Google and Meta each have their own compliance teams and review cycles. BotRefund manages the submission and follow-up with those teams, but the final payout timing sits with the platforms.

Readiness Checklist: Should You Follow Up Yet?

Before you contact support, verify each item. If you can check every box, it's time to follow up.

• 10 business days have passed since BotRefund confirmed your claim was submitted to Google or Meta.
• You have your case ID (format: BRF-XXXXXX) from the BotRefund dashboard or submission confirmation email.
• The dashboard shows "Submitted to Platform" or "Under Review" status, not "Draft" or "Evidence Gathering."
• You have not received a platform decision notification (approval, denial, or request for more info) in your email or dashboard.
• Your ad account shows no credit or refund line item in the billing section for the claimed period.
• You have not changed ad account ownership, billing currency, or agency linkage since the claim was filed.

If any item is unchecked, wait. The platform may still be processing, or BotRefund may be gathering additional evidence.

What to Have Ready When You Contact Support

Gather these details before opening a ticket. They let the support team locate your case instantly and give you a precise status.

• Case ID (BRF-XXXXXX)
• Ad platform (Google Ads, Meta Ads, or both)
• Campaign names or IDs covered by the claim
• Date range of the claimed invalid clicks
• Amount you expected to recover (shown in your BotRefund dashboard)
• Screenshot of your ad account billing page showing no refund posted

Typical Timeline Expectations

Most claims follow this pattern:

• Days 1-3: BotRefund completes forensic analysis, captures click IDs, and builds the evidence dossier.
• Days 3-5: Dossier submitted to Google Ads or Meta compliance reviewers.
• Days 5-15: Platform review. Google typically responds in 7-10 business days; Meta can take 10-14 business days.
• Days 15-20: If approved, the platform issues a credit to your ad account. BotRefund invoices its 32% success fee.

Complex cases (high spend, multiple campaigns, cross-platform claims) can add 5-7 business days. Holiday periods and platform policy updates also extend review times.

When to Escalate Beyond Standard Support

Escalate if:

• 15 business days have passed with no platform decision and no communication from BotRefund.
• The platform denied the claim but BotRefund's evidence appears to meet the platform's published invalid-click criteria.
• You received a partial refund that doesn't match the approved amount in the platform's decision letter.
• Your agency manages the account and needs a consolidated status report for multiple client cases.

For escalations, reply to your existing support thread with "ESCALATION REQUEST" in the subject line and include the case ID. BotRefund's senior recovery team reviews escalation requests within 2 business days.

Common Scenarios and What They Mean

Key Facts

Limitations and When This Advice Doesn't Apply

• This checklist covers BotRefund-managed claims submitted to Google Ads and Meta Ads. Direct platform disputes filed without BotRefund follow different timelines.
• If your ad account is suspended or under policy review, refund processing pauses until the account status resolves.
• Claims involving ad networks outside Google and Meta (TikTok, LinkedIn, programmatic DSPs) are not currently supported by BotRefund.
• Historical claims older than the platform's lookback window (typically 60-90 days) cannot be submitted.
• The 10-business-day follow-up trigger assumes standard review queues. Platform-wide incidents (outages, policy rollouts) can extend this window.

Terminology

• GCLID / FBCLID: Google Click ID and Facebook Click ID. Unique identifiers attached to each ad click that let platforms trace a click back to a specific campaign, ad, and keyword.
• Evidence dossier: A compiled report linking click IDs to behavioral signals (mouse tremor, headless browser fingerprints, VPN/proxy detection, GPU integrity checks) that prove a click was non-human.
• Pixel suppression: Real-time blocking of conversion pixel fires for sessions flagged as bots, preventing poisoned data from entering Google's or Meta's optimization algorithms.
• Contingency fee: A percentage of recovered funds paid only when money is actually returned to your ad account. No recovery means no fee.
• Case ID: BotRefund's internal tracking number (format BRF-XXXXXX) assigned when a claim moves from draft to submitted status.

FAQ

What if I don't have a case ID?

Log into your BotRefund dashboard. Cases in "Submitted" or "Under Review" status display the case ID next to the campaign name. If you only see "Draft" cases, your claim hasn't been submitted yet—contact support to ask why.

Can I follow up directly with Google or Meta instead of BotRefund?

You can, but BotRefund's team has direct channels to compliance reviewers and knows the exact evidence format each platform expects. Duplicate inquiries can confuse the review queue. Let BotRefund handle platform communication unless they ask you to provide additional documentation.

Does the 10-business-day rule apply to both Google and Meta?

Yes, but Meta's review queue often runs 2-4 days longer than Google's. If your claim is Meta-only, wait 12 business days before following up. The dashboard shows which platform each case was submitted to.

What happens if the platform denies the claim?

BotRefund will share the denial reason. Common reasons: insufficient behavioral evidence, clicks classified as low-quality but not invalid, or clicks outside the platform's lookback window. You can discuss a resubmission with additional signals, but there's no guarantee of a different outcome.

How do I know the refund actually posted to my ad account?

Check your Google Ads or Meta Ads billing section for a line item labeled "Invalid Click Refund," "Credit Adjustment," or similar. The amount should match the approved amount in the platform's decision email. BotRefund's dashboard also updates to "Refunded" status once the credit posts.

Can I speed up the platform review?

Not directly. Platform review times are set by Google and Meta. BotRefund ensures the initial dossier is complete and formatted to the platform's specifications, which avoids back-and-forth requests for more information—that's the main lever for speed.

What if I'm an agency managing multiple client accounts?

Use the unified multi-client portal. Filter cases by "Submitted" status and "Days Since Submission" column. Follow up on any case past 10 business days (12 for Meta). You can bulk-export a status report for client updates.

Generate the proof report as soon as you have collected sufficient bot-click evidence and before the advertising platform's refund window closes.

Filing the refund claim starts the deadline clock; the report must be ready for submission prior to that cutoff. Acting promptly ensures your evidence is accepted and maximizes recovery.

Why Timing Matters for Refund Claims

Ad platforms like Google and Meta set strict deadlines for refund requests. These windows are not flexible. Once the deadline passes, your claim is rejected. You lose the money.

The proof report is your main evidence. It shows which clicks were non-human. It links those clicks to the ad spend you want back. Without it, the platform has no reason to approve your refund.

Timing is not just about the final deadline. It is about the quality of your evidence. Bot-click data can change. New suspicious clicks may appear. Old data may become less reliable. Generating the report too early can miss important evidence. Generating it too late can miss the deadline entirely.

The best approach is to generate the report immediately after filing the claim, but only when your evidence is complete. This balances speed with accuracy.

Decision Trigger: File the Refund Claim

The moment you submit a refund request to Google or Meta, the platform starts counting down the refund window. Treat this filing as the trigger to begin preparing your proof report.

Do not wait for the platform to respond. Do not wait for a preliminary inquiry. The clock is already running. Every day you delay reduces your chance of success.

In most cases, the refund window is 30 to 45 days after the claim is filed. Some platforms have shorter windows, such as 14 days. Check the specific policy for your platform before you file.

Once you file, your first task is to verify that your evidence is ready. If it is not, you need to move quickly to complete it.

Readiness Checklist: Are You Ready to Generate the Report?

Before you generate the report, run through this checklist. If you can answer yes to every item, you are ready.

• You have exported the bot-click evidence dossier from BotRefund.
• The evidence includes click IDs, timestamps, and behavioral signals.
• You have verified that the report covers the full claim period.
• You have confirmed the platform's refund deadline (usually 30-45 days after claim).
• You have prepared a cover letter linking the evidence to the claim.
• You have checked that no new suspicious clicks have appeared since your last export.
• You have confirmed that the evidence is formatted correctly for the platform's review system.

If any item is missing, do not generate the report yet. Fix the gap first. A partial report may be rejected. A complete report is much more likely to be approved.

Signs You Might Need to Wait

Sometimes you should wait before generating the report. Waiting is not always bad. It can improve the quality of your evidence.

• Evidence collection is still ongoing. New suspicious clicks are appearing. You want to include them in the report.
• You are awaiting a response from the ad platform on a preliminary inquiry. The platform may ask for more information.
• Legal or compliance review requires additional documentation. You need to gather more proof before submitting.
• You have not yet confirmed the exact refund window for your account. Different accounts may have different deadlines.

If you are waiting, set a reminder. Do not let the deadline pass while you wait. Check the deadline every few days.

Exception: When Early Reporting Is Required

Some advertisers must submit interim reports to maintain account standing. In those cases, generate a partial report as soon as the first batch of evidence is ready. Supplement it later with additional evidence.

This is common for large accounts with high ad spend. The platform may require regular updates. It may also apply to accounts with a history of disputes.

Early reporting shows the platform that you are serious. It also protects your account from suspension. Even a partial report is better than no report.

If you are in this situation, generate the report immediately after filing the claim. Then update it as new evidence becomes available.

What Is a Proof Report for Ad Refunds?

A proof report is a structured dossier. It shows which clicks were non-human. It uses forensic signals to prove that the clicks were not from real users.

The report includes click IDs, timestamps, and behavioral signals. It may also include IP addresses, device information, and session data. The goal is to give the platform reviewer everything they need to approve the refund.

BotRefund generates these reports automatically. It monitors traffic with 110+ signals. It flags bot clicks in real time. It assembles the evidence into a compliance-ready dossier.

The report is designed to meet Google and Meta's refund requirements. It is not a generic document. It is tailored to the specific platform and claim.

How BotRefund Generates Compliance-Ready Reports

BotRefund continuously monitors traffic with 110+ signals. These signals include headless browser detection, mouse tremor analysis, GPU integrity checks, and VPN and geo-spoofing defense.

When a bot click is detected, BotRefund captures the evidence. It records the click ID, timestamp, and behavioral signals. It stores this data in a secure dossier.

When you are ready to file a refund, BotRefund assembles the dossier into a report. The report is formatted for the platform's review system. It includes a cover letter that links the evidence to the claim.

BotRefund also negotiates with Google and Meta on your behalf. This increases your chance of approval. The service has an 83% refund approval success rate.

You do not need technical skills to use BotRefund. The service runs automatically. It provides ready-to-submit reports.

Key Facts

Limitations and When This Advice Does Not Apply

• If you are not using BotRefund, the timing may differ based on your evidence collection method.
• Some platforms have shorter refund windows (e.g., 14 days); adjust the checklist accordingly.
• The advice assumes you have already identified bot traffic as the cause of wasted spend.
• If your account is under investigation, the platform may extend the deadline. Check with the platform before assuming the standard window applies.
• If you are using a manual evidence collection method, the report may take longer to prepare. Start earlier to avoid missing the deadline.

Terminology

• Proof report: a document that evidences invalid clicks for a refund claim.
• Refund window: the period after filing a claim during which the platform accepts evidence.
• Bot-click evidence: data such as click IDs, timestamps, and behavioral signals that indicate non-human interaction.
• Forensic signals: technical indicators that distinguish bot behavior from human behavior.
• Compliance-ready: formatted to meet the specific requirements of the ad platform's review system.

FAQ

• When should I start collecting evidence? As soon as you notice abnormal click patterns or low conversion despite high spend.
• How long does it take to generate a report with BotRefund? The platform can produce a compliance-ready report instantly once the evidence dossier is complete.
• What happens if I miss the refund deadline? The platform may reject the claim, and you lose the opportunity to recover the spend.
• Can I generate a partial report? Yes, for interim reporting you can submit early evidence and supplement it later.
• Do I need technical skills to use BotRefund? No, the service runs automatically and provides ready-to-submit reports.
• What is the typical refund window for Google and Meta? Usually 30 to 45 days after the claim is filed. Some accounts may have shorter windows.
• Should I generate the report before or after filing the claim? Generate it immediately after filing, but only when your evidence is complete. Filing starts the deadline clock.
• Can I update the report after submission? In some cases, yes. Check with the platform. If updates are allowed, submit additional evidence as soon as it is available.