Which Reporting Format Do Refund Processors Accept for Bot Evidence?

Refund processors at Google and Meta require bot evidence in a structured JSON format with four core fields: sessionId, eventType, payload, and hash. This format lets their click-quality teams verify each flagged interaction against their own logs. BotRefund captures the necessary behavioral signals — ghost clicks, honeypot traps, robotic pointer paths, superhuman input speed, grid-aligned movement, missing mouse tremor, static engagement, and unnatural session durations — and exports them in the exact schema the platforms expect.

Why Evidence Format Matters for Refund Claims

Ad platforms reject claims that rely on screenshots, CSV exports, or narrative descriptions. Their automated review systems parse JSON to match each flagged click to a GCLID (Google) or click ID (Meta). If the schema is missing a required field or the hash doesn't match the payload, the claim is discarded without human review. Using the accepted format is the difference between a credited refund and a wasted support ticket.

The format matters because it is the only way to prove that the flagged interaction came from a real browser session. A screenshot can be edited. A CSV file lacks the behavioral depth needed to distinguish a bot from a human. JSON, with its nested structure and cryptographic hash, gives the platform a tamper-evident record. It also allows their systems to automatically cross-reference the session ID with their own click logs. Without this, the claim is just an assertion.

Consider a typical scenario: a competitor runs a script that clicks your ads hundreds of times. Each click looks like a real user to Google's filters. But your detection script records the pointer path, the timing, and the absence of human tremor. That data, when packaged in JSON, becomes a compelling case. The platform can verify that the session ID exists, that the hash matches, and that the event type aligns with their definition of invalid activity. That is why the format is non-negotiable.

How Bot Evidence Collection Works

BotRefund installs a lightweight script on your landing pages. It records every interaction — mouse movements, clicks, scrolls, form inputs, and timing — then classifies each session using the detection categories listed in the source pack: ghost click detection, honeypot trap interactions, robotic linear mouse movements, absence of humanlike mouse tremor, superhuman input speed (<1ms), grid-aligned movement patterns, absence of clicks or scrolling, and unnatural session durations. Each classified event is stored with a timestamp, session identifier, and behavioral payload.

The script runs in the background. It does not slow down your page. It captures data at high frequency, often every few milliseconds. For each session, it builds a profile. That profile includes the pointer trajectory, the velocity curve, the number of micro-corrections, and the time between events. It also checks for hidden elements that only bots would interact with. All of this is stored locally and then sent to the BotRefund dashboard.

Once the data is collected, the dashboard groups sessions by detection category. You can see a video replay of each flagged session. That replay is useful for your own review, but the platform does not require it. What they require is the JSON export. The export is generated automatically. It contains one object per flagged interaction, with all the fields the platform expects.

Accepted Evidence Formats: What Google and Meta Expect

Both platforms publish documentation for their invalid-click dispute forms. Google's Click Quality team requires GCLID logs paired with client-side behavioral proof. Meta's invalid-traffic process asks for click IDs and session-level evidence showing automated patterns. The common denominator is a JSON array where each object represents one flagged interaction. The four mandatory fields are:

• sessionId — unique identifier for the user session
• eventType — classification such as "ghost_click", "honeypot_trap", "superhuman_speed"
• payload — raw behavioral data (coordinates, timestamps, velocity, tremor metrics)
• hash — cryptographic hash of the payload to prove integrity

Optional but recommended fields include gclid, fbclid, pageUrl, userAgent, and timestamp.

Here is a minimal example of what a valid JSON object looks like:

{
  "sessionId": "abc123",
  "eventType": "ghost_click",
  "payload": {
    "coordinates": [[120, 340], [121, 341], [122, 342]],
    "timestamps": [1620000000000, 1620000000010, 1620000000020],
    "velocity": 0.5,
    "tremorVariance": 0.001
  },
  "hash": "sha256hash..."
}

This structure is simple but powerful. The hash is computed over the serialized payload. If anyone changes a single coordinate, the hash fails. That is how the platform knows the evidence has not been tampered with.

Key Fields in Bot Evidence JSON

Field	Type	Required	Description
sessionId	string	Yes	Unique session identifier generated by the detection script
eventType	string	Yes	One of the detection categories: ghost_click, honeypot_trap, robotic_pointer, missing_tremor, superhuman_speed, grid_aligned, static_engagement, unnatural_duration
payload	object	Yes	Structured behavioral data: coordinates array, timing array, velocity metrics, tremor variance
hash	string	Yes	SHA-256 hash of the serialized payload for tamper detection
gclid	string	Recommended	Google Click ID from the ad click that started the session
fbclid	string	Recommended	Facebook Click ID for Meta campaigns
pageUrl	string	Recommended	Landing page URL where the interaction occurred
userAgent	string	Recommended	Browser user agent string at time of interaction
timestamp	integer	Recommended	Unix epoch milliseconds when the event was recorded

Each field serves a purpose. The sessionId ties the evidence to a specific visit. The eventType tells the platform which detection rule fired. The payload contains the raw data that supports the classification. The hash ensures the payload has not been altered. The optional fields help the platform link the session to a billed click. Without the GCLID or fbclid, the platform cannot match the evidence to an ad click. That is why they are strongly recommended.

When you export from BotRefund, all these fields are populated automatically. You do not need to manually edit anything. The export button is labeled "Export detailed client-side behavioral proof logs." It generates a file that is ready to upload.

Step-by-Step: Preparing Your Evidence Package

1. Install the detection script — Add BotRefund to your site (about one minute, no credit card).
2. Run a free bot audit — The script collects baseline traffic for 7–14 days.
3. Review flagged sessions — The dashboard shows each detection category with video replay.
4. Export the JSON report — Use the "Export detailed client-side behavioral proof logs" button. The file follows the schema above.
5. Match to ad-platform IDs — Ensure each session includes the GCLID or fbclid from the original click.
6. Submit to the platform — Upload the JSON via Google's Click Quality form or Meta's invalid-traffic dispute flow.
7. Track the claim — BotRefund's dashboard shows refund approval rate and recovered spend.

Each step is straightforward, but attention to detail matters. For example, when you export, make sure the date range covers the period you are disputing. If you are claiming refunds for a specific campaign, filter the export to that campaign. The dashboard allows you to filter by date, campaign, and detection category. This keeps the file size manageable and the evidence focused.

Before submitting, double-check that every session has a GCLID or fbclid. If a session lacks one, the platform cannot link it to a click. You can still include it, but it will likely be ignored. The best practice is to only include sessions that have a matching click ID.

Common Mistakes That Get Claims Rejected

• Submitting CSV or Excel instead of JSON — platforms' automated parsers ignore them.
• Omitting the hash field — without it, the payload integrity cannot be verified.
• Stripping GCLID/fbclid — the platform cannot link the evidence to a billed click.
• Aggregating multiple sessions into one object — each flagged interaction must be a separate array element.
• Using outdated eventType values — stick to the current detection categories listed in the dashboard.
• Including sessions with no behavioral data — if the payload is empty, the claim is weak.
• Submitting the same evidence for multiple platforms — each platform has its own schema; use the correct export.

These mistakes are common because they are easy to make. For instance, you might think that a CSV is easier to read. But the platform's parser expects JSON. It will not even open a CSV. Similarly, you might think that the hash is optional. It is not. Without it, the platform cannot verify that the payload has not been altered. The result is an automatic rejection.

Another mistake is submitting evidence that covers too long a period. Google and Meta have specific lookback windows. For Google, you can claim refunds for spend dating back to 2017. But that does not mean you should submit a single file for three years of data. Break it into monthly or quarterly chunks. This makes the review process easier and increases the chance of approval.

Limitations and When This Format Doesn't Apply

The JSON schema described here applies to Google Ads and Meta Ads invalid-click disputes. Other platforms (Microsoft Ads, TikTok, LinkedIn) have their own dispute forms and may accept different formats. The source pack covers recovery for Google and Meta only. Additionally, the evidence must come from client-side detection; server-side logs alone are insufficient because they lack behavioral signals like mouse tremor and pointer path geometry. If your traffic runs through a CDN that strips query parameters, GCLID/fbclid capture may fail — configure your CDN to preserve these parameters.

There are also technical limitations. The detection script only works on pages where it is installed. If you have landing pages that are not tracked, you will not have evidence for those sessions. Also, the script relies on JavaScript. If a bot does not execute JavaScript, it may not be detected. However, most modern bots do execute JavaScript because they are designed to mimic real users. The detection categories are specifically chosen to catch these sophisticated bots.

Another limitation is the refund approval rate. Not every claim is approved. The source pack mentions an approval rate, but it is not 100%. The platform may reject a claim if the evidence is insufficient or if the session does not meet their criteria. That is why it is important to follow the format exactly and to include as much behavioral data as possible.

Key Facts

Metric	Value	Source
Bot click budget theft	Up to 20% of Google and Meta ad spend	S1
Refund lookback window	Google Ads spend dating back to 2017	S1
Setup time	About one minute to add BotRefund to website	S1
Detection categories	8 behavioral signals (ghost click, honeypot, robotic pointer, missing tremor, superhuman speed, grid-aligned, static engagement, unnatural duration)	S1
Evidence export	Client-side behavioral proof logs in JSON	S3
Platform coverage	Google Ads and Meta Ads	S1, S2, S3

FAQ

What if my JSON export is too large for the platform's upload limit?

Split the file by date range or campaign. Each submission should cover a single billing period. BotRefund's dashboard lets you filter before export.

Can I manually create the JSON without BotRefund?

Technically yes, but you must reproduce all behavioral signals (tremor variance, velocity curves, grid-alignment checks) and generate valid hashes. Most teams find manual recreation error-prone and time-consuming.

Does the hash need to be SHA-256 specifically?

Google and Meta's documentation specifies SHA-256. Other algorithms will cause validation failures.

What happens after I submit the JSON?

The platform's automated system matches each sessionId and GCLID/fbclid to their click logs, verifies the hash, and scores the eventType against their invalid-activity definitions. Approved credits appear in your billing account within 2–4 weeks.

Can I get refunds for traffic before I installed the script?

No. Client-side evidence only exists from the installation date forward. The 2017 lookback mentioned in the source pack applies to Google's policy window, not to pre-installation data.

Is video proof required in addition to JSON?

Video replay is available in the BotRefund dashboard for human review, but the platform dispute forms only require the JSON. Video is optional supporting material.

How do I know if my JSON is valid before submitting?

BotRefund includes a validation tool that checks the schema, required fields, and hash integrity. You can also use a JSON validator online. The platform will reject invalid files, so it is worth checking.

What if I have multiple campaigns with different click IDs?

Include the appropriate GCLID or fbclid in each session object. The platform will match each session to the correct click. You do not need to separate files by campaign, but it can make the review easier.

Can I submit evidence for both Google and Meta in one file?

No. Each platform has its own dispute process. Submit separate files to each platform. BotRefund generates platform-specific exports.

What is the typical refund approval rate?

The source pack mentions an approval rate, but it varies by case. BotRefund reports a high approval rate across client claims, but it is not guaranteed. Following the format exactly improves your chances.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• What evidence should I collect before requesting a refund? | ...
• 7 Best AI Platforms for Refunds, Returns, and Dispute Automation ...
• 9 AI Chat Solutions That Escalate Refund Exceptions to Humans [2026 ...

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• What evidence should I collect before requesting a refund? | ...
• 7 Best AI Platforms for Refunds, Returns, and Dispute Automation ...
• 9 AI Chat Solutions That Escalate Refund Exceptions to Humans [2026 ...

Learn more

Visit the website for more information.