Ad Fraud Detection Metrics: What to Track and Why

To detect ad fraud, track a combination of metrics: click-through rate (CTR) versus conversion rate, average session duration, bounce rate, and suspicious IP addresses. No single metric is enough. When several of these point the same way, you likely have a bot problem. This guide explains each metric, what it reveals, and how to use them together. It also shows how to set up tracking and what to do when you find fraud.

Why Tracking Ad Fraud Metrics Matters

Ad fraud wastes money. Bot clicks can steal up to 20% of your Google and Meta ad budget, according to BotRefund. If you ignore the metrics, you keep paying for clicks that never become customers. Over a year, that can mean thousands of dollars lost.

Tracking the right metrics helps you spot the problem early. You can stop wasting spend, adjust your campaigns, and even recover money from ad platforms. Without these metrics, you are flying blind. You might see high click numbers and think your ads work well, but if those clicks never convert, you are burning cash.

Metrics also help you make better decisions. They show you which campaigns are truly driving value and which are attracting bots. You can then shift budget to high-performing ads and cut the rest. Metrics turn ad spend from a guess into a managed investment.

The Core Metrics That Reveal Ad Fraud

Here are the metrics that matter most. Watch them together, not in isolation. Each one gives a clue, but only combined do they paint a clear picture.

Click-Through Rate (CTR) vs. Conversion Rate

CTR tells you how often people click your ad. Conversion rate tells you how often those clicks lead to a desired action like a purchase, sign-up, or form fill. A high CTR with a very low conversion rate is a classic fraud signal. Bots click but never buy. For example, if your CTR jumps from 1% to 5% overnight but your conversion rate stays below 0.1%, something is wrong. Real users who click are interested; bots are not.

What a human does: A human clicks when the ad matches their intent. They may explore, read, and convert if the offer fits. Their CTR and conversion rate usually stay within a normal range for your industry—often 0.5% to 3% CTR and 2% to 5% conversion.

What a bot does: Bots generate high CTR because they are programmed to click repeatedly, but they never complete the desired action. They have no intention to buy or sign up. As a result, conversion rates near zero. A good alert threshold: if CTR is above 5% while conversion is below 0.1%, investigate immediately.

Average Session Duration

Real visitors spend time reading, scrolling, and exploring. Bots often leave in under a second. Unnatural session durations—too short, too long, or too uniform—can indicate automated traffic.

What a human does: A real user might spend 30 seconds to several minutes on a page, depending on content. Their session durations vary. Some bounce quickly, others stay longer. The average usually ranges from 1 to 3 minutes for content pages.

What a bot does: Bots often load the page and then instantly move to the next link or close the session. Many sessions last less than 2 seconds. Some bots are configured to wait random times, but they often produce suspiciously uniform durations. If you see a large batch of sessions all lasting exactly 0.2 seconds, that is a red flag. Alert threshold: if more than 30% of sessions last under 2 seconds and there is no clear reason (like a fast answer page), flag it.

Bounce Rate

A bounce happens when someone leaves after viewing one page. A very high bounce rate, especially on pages that should engage users, may mean bots are hitting your site and leaving immediately.

What a human does: A human may bounce if they find what they need quickly, but on a landing page with clear intent, they usually interact with more than one element. Bounce rates typically range from 40% to 60% for standard pages, but can be higher for blog posts where people read and leave.

What a bot does: A bot loads the page and immediately triggers a bounce. If your bounce rate on a high-intent page (like a pricing page) jumps to 90% or more, bots are likely. Alert threshold: bounce rate above 90% with no changes to the page or traffic source is a warning.

Suspicious IP Addresses

Watch for repeated clicks from the same IP, clicks from data centers, or IPs that don't match your target location. These are red flags.

What a human does: A human typically uses a residential IP from the region you target. They may click a few times, but not repeatedly from the same IP in a short period. Their IP usually matches the location of their device.

What a bot does: Bots often come from IP ranges owned by cloud providers or data centers. They may rotate IPs to avoid detection, but patterns still emerge. For example, if you see 100 clicks from one IP in an hour, that is not human. Also, if you target the US but see a cluster of clicks from a VPN server in another country, investigate. Alert threshold: any single IP generating more than 5 clicks per day on a campaign is suspicious, especially if conversions are zero.

Other Behavioral Signals

Beyond basic metrics, behavioral signals reveal automation. These are harder to see without special tools, but they are strong indicators. Here are four specific patterns:

Ghost Clicks

Ghost clicks are clicks that occur without the natural sequence of human intent. For example, a human clicks a button after moving the mouse to it and pausing. A bot may click on an element that is invisible to the user or click in a way that bypasses normal interaction. BotRefund catches ghost clicks by looking for clicks that don't correspond to any visible action or that happen in an impossible context. If you see clicks on a hidden element or clicks that occur without any preceding mouse movement, that is a ghost click.

Robotic Mouse Movements

Human mouse paths are curved and variable. Bots often move in straight lines. A robotic linear mouse movement is a perfect straight line from one point to another. BotRefund flags these because real users rarely produce straight paths. If your analytics show a series of mouse movements that are perfectly straight, you likely have a bot. For example, a human might move the mouse in a slight arc or jitter. A bot moves in a precise line.

Superhuman Speed

Superhuman input speed means actions occur faster than a human can perform. For instance, a click that happens less than 1 millisecond after a page load is impossible for a human to do on purpose. Humans have a reaction time of at least 100 milliseconds. BotRefund identifies interactions that happen in under 1 millisecond. If you see clicks or form submissions that occur in microseconds, that's automation.

Grid-Aligned Paths

Grid-aligned movement patterns are paths that snap to exact horizontal or vertical lines. Humans do not move that way. Bots often use coordinate systems that align to a grid. BotRefund detects movement that snaps to precise lines or blocks instead of natural curves. If your data shows mouse paths that are perfectly horizontal or vertical, it's a red flag. For example, a bot might move from coordinate (100,200) to (300,200) in a straight line—very unusual for a human.

How to Read These Metrics Together (Diagnostic Sequence)

Follow this sequence to diagnose ad fraud. It moves from coarse signals to fine-grained evidence.

1. Start with CTR vs. conversion rate. If CTR is high but conversions are near zero, flag the campaign.
2. Check session duration. If most sessions last under 2 seconds, that's suspicious.
3. Look at bounce rate. A bounce rate above 90% on a landing page with clear intent is a warning.
4. Review IP addresses. Group clicks by IP and look for clusters. Use tools like Google Analytics to segment by IP.
5. Examine behavior signals. Use tools that detect mouse movement, click patterns, and timing. Look for ghost clicks, robotic paths, and superhuman speed.
6. Cross-check with a fraud detection tool. A tool like BotRefund uses 106 independent checks and AI to confirm whether a visit is human or bot. It also captures video proof.

This sequence helps you move from suspicion to evidence. Once you have evidence, you can take action.

Diagnostic Checklist (Copy and Use)

Common Mistakes When Tracking Ad Fraud Metrics

Many marketers misinterpret these metrics. Here are real-world mistakes and how to avoid them.

• Relying on one metric. A single anomaly is not proof. Bots can mimic human behavior. For example, a high bounce rate might be due to a slow page loading, not a bot. Avoid drawing conclusions from one metric alone. Always cross-check with at least two others.
• Ignoring context. Privacy tools, corporate networks, and travel can create false positives. A user on a VPN or behind a corporate firewall might show a suspicious IP. Don't block or flag them without checking other signals. If a CEO from a client's office clicks twice, that's not fraud.
• Not checking IPs. Many fraudsters rotate IPs, but patterns still emerge. If you don't segment by IP, you miss clusters of clicks from the same source. Use IP filtering in analytics to see if a small group of IPs generates a disproportionate share of clicks.
• Forgetting to compare over time. A sudden spike in clicks with no change in conversions is a red flag. For example, if your normal CTR is 1% and it jumps to 4% in one day, but conversions stay flat, something is wrong. Always compare to previous periods.
• Assuming all bots are the same. Some bots are sophisticated and mimic human movement. They might vary session durations and mouse paths. But no bot can perfectly replicate human behavior over many sessions. Use a tool that looks at many signals, like BotRefund.
• Not setting up proper tracking. If you don't tag links and events correctly, your data is useless. Make sure your analytics integrates with your ad platforms and that you track key events like form submissions and purchases.

How to Set Up Metric Tracking

To track these metrics, you need analytics tools. Here is how to set them up for Google and Meta ads.

Google Analytics (GA4)

1. Create a GA4 property. Go to analytics.google.com and set up a new property for your website.
2. Install the tracking tag. Add the GA4 code to your website. Use a tag manager or paste it into the header.
3. Set up conversions. Define events like purchases, sign-ups, or clicks. Mark them as conversions.
4. Link Google Ads. In GA4, go to Admin > Property > Google Ads Linking. Follow the steps to connect your accounts.
5. Create a custom report. Build a report that shows sessions, bounce rate, average session duration, and conversion rate. Filter by source to see Google Ads traffic.
6. Enable IP exclusion. In GA4, go to Admin > Data Collection > IP Filters. Add known internal IPs and any suspicious IPs you want to ignore. This prevents them from inflating your metrics.

Meta Ads Manager

1. Install the Meta Pixel. In Meta Events Manager, create a pixel and add the code to your website.
2. Set up standard events. Track events like ViewContent, AddToCart, and Purchase. Ensure these fire correctly.
3. Link to Analytics. Connect your Meta account to GA4 or other analytics platforms so you can see cross-platform data.
4. Create custom conversions. If you need specific actions, define custom conversions based on URL or event parameters.
5. Use the breakdown feature. In Ads Manager, view performance by delivery, device, or IP (via ad-level data). While Meta doesn't show IPs directly, you can see device and location breakdowns.
6. Set up IP exclusion (via external tool). Meta doesn't offer IP exclusion directly, but you can use a third-party tool like BotRefund to block and filter bot traffic before it hits your site.

Regularly review these reports. Set up alerts for anomalies like a sudden spike in CTR or a drop in conversion rate.

Key Facts About Ad Fraud and BotRefund

Limitations: When These Metrics Don't Tell the Whole Story

These metrics are not perfect. A real user might have a high bounce rate if they find what they need quickly. A corporate VPN can make an IP look suspicious. Privacy tools can block tracking, so you might miss sessions entirely.

Also, these metrics only show symptoms. They don't prove fraud. To prove it, you need deeper evidence like video proof of bot behavior or server logs. That's where dedicated detection tools come in.

If your traffic is mostly from mobile apps or you run brand campaigns, some metrics may be less useful. For example, brand campaigns may have high bounce rates because people just want to check your site. Always combine metrics with your business context.

Another limitation: bots can vary their behavior. Sophisticated bots might adjust session durations or mouse movements to avoid detection. But they cannot perfectly mimic human behavior over many sessions. That's why you need multiple signals and AI.

Finally, metrics don't tell you the source of fraud. You might see that 10% of clicks are bots, but you don't know if it's a competitor, click farm, or automated script. That's okay—your goal is to stop the waste and recover money, not to identify the perpetrator.

Frequently Asked Questions

What is the single best metric for ad fraud?

There isn't one. The best approach is to track a combination of CTR vs. conversion rate, session duration, bounce rate, and IP patterns. No single metric is reliable enough to prove fraud.

How quickly should I check these metrics?

Check weekly at minimum. If you run high-volume campaigns, check daily. Fraud can happen fast. A bot attack might last only a few days, so frequent checks help you catch it early.

Can I detect ad fraud without a tool?

Yes, you can spot anomalies manually. But proving fraud for a refund usually requires detailed evidence that tools like BotRefund provide. Manual checks only show symptoms, not proof.

What does BotRefund cost?

BotRefund offers a free bot audit. Pricing depends on your ad spend. You can select a range on their site.

How long does it take to set up BotRefund?

About one minute. You add a script to your website and start the free audit.

Will these metrics work for Meta ads too?

Yes. The same principles apply to Google and Meta campaigns. BotRefund covers both.

How do I distinguish fraud from a bad landing page?

Look at engagement quality. If you get high CTR but very low conversion, check session duration and behavior. If sessions are short and there are no clicks or scrolls, that suggests bots. If real users stick around but don't convert, the page might be the problem. Use heatmaps and session recordings to see what humans do.

What is the role of IP analysis?

IP analysis helps identify clusters of clicks from the same source, such as data centers or VPNs. It's a useful red flag, but not definitive. A single IP can be shared by many users (e.g., corporate network). Always combine IP analysis with behavioral signals.

Can I recover money from Meta ads?

Yes, you can. Meta has a refund policy for invalid clicks. You need evidence like video proof of bot activity. BotRefund provides that and negotiates with Meta on your behalf. Many advertisers recover a significant portion of their wasted spend.