Seatext library / BotRefund evidence
Which User Behavior Signals Complement Click-to-Conversion Timing for Fraud Detection?
Click-to-conversion timing alone misses sophisticated bots that mimic human pacing. Adding form interaction patterns, mouse movement entropy, scroll behavior, copy-paste detection, autocomplete usage, timezone mismatches, and session replay analysis creates a multi-signal model that...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Click-to-conversion timing measures how fast a user moves from ad click to conversion event. Bots increasingly simulate realistic delays, so timing by itself produces false negatives. The signals that complement it fall into three groups: input dynamics (how users type, click, and paste), navigation patterns (scroll depth, field focus order, dwell time), and environmental consistency (timezone, language, device fingerprint alignment). Together they reveal whether a session follows the micro-behaviors of a real person or the macro-patterns of automation.
Why Timing Alone Fails Against Modern Bots
Velocity checks assume bots move faster than humans. Modern botnets use residential proxies, headless browsers with randomized delays, and human-in-the-loop farms that deliberately slow down. A 2024 BotRefund audit found that 34% of flagged invalid clicks had click-to-conversion times within the 10th–90th percentile of genuine users. Timing catches only the clumsy fraction. You need signals that are expensive for attackers to fake at scale.
Input Dynamics: Typing, Pasting, and Autocomplete
Form Field Interaction Time
Real users hesitate, backspace, and switch fields. Bots either fill instantly via script or use fixed delays. Measure keystroke intervals per field, total form dwell, and correction frequency. A legitimate checkout form typically shows 2–8 seconds per field with at least one correction; scripted fills often show uniform sub-second intervals and zero corrections.
Copy-Paste Detection
Legitimate users paste coupon codes, emails, or addresses. Bots paste everything or nothing. Track paste events on each input. A session that pastes the email but types the name and address manually is normal. A session that pastes every field including the coupon code injected by an extension (see BotRefund's coupon overlay research) signals automated form completion.
Autocomplete Usage
Browsers offer autocomplete for known fields. Humans accept suggestions; bots often ignore them or trigger them programmatically. Monitor autocomplete attribute interactions and whether the browser's native suggestion UI was invoked. Absence of autocomplete on a returning device is a mild anomaly; presence on a new device with no saved profile is a stronger one.
Navigation Patterns: Scroll, Focus, and Dwell
Scroll Behavior and Depth
Bots that land on a conversion page often skip content. Measure scroll depth percentage, scroll velocity, and direction changes. Real users scroll down, pause, scroll up to re-read. Bot sessions frequently show zero scroll events or a single instantaneous scroll to bottom. BotRefund's session telemetry flags sessions with no scroll on pages longer than two viewports.
Field Focus Order and Tab Navigation
Humans tab through fields in visual order. Scripts may set values directly without focus events or focus fields in DOM order that differs from visual order. Capture focus and blur sequences. A mismatch between visual tab index and actual focus order suggests programmatic filling.
Meaningful Time on Offer Page
S4's Meta invalid traffic guide lists "no meaningful time on the offer page" as a key signal. Define meaningful as: at least one scroll, one mouse move, and 5+ seconds before conversion trigger. Sessions that convert in under 3 seconds with zero engagement events are high-risk regardless of click-to-conversion timestamp.
Pointer and Motion Entropy
Mouse Movement Entropy
Human mouse paths contain micro-tremors, curved trajectories, and variable velocity. Bots using automation frameworks (Puppeteer, Playwright) often move in straight lines or grid-aligned steps. S2 documents "robotic linear mouse movements" and "grid-aligned movement patterns" as primary bot indicators. Calculate path entropy: sum of angle changes per pixel traveled. Low entropy = automated.
Absence of Humanlike Tremor
Even steady hands produce sub-pixel jitter. S2 notes "absence of humanlike mouse tremor" as a detection vector. Sample pointer coordinates at 60Hz; compute high-frequency variance. Near-zero variance at rest or during movement indicates synthetic input.
Superhuman Input Speed
Clicks or keystrokes under 1ms between events are physiologically impossible. S2 flags "superhuman input speed (<1ms)". Set a floor: any action sequence faster than 50ms per discrete event (click, keypress, paste) gets maximum risk score.
Environmental Consistency Signals
Timezone and Language Mismatch
Compare the user's browser timezone (Intl.DateTimeFormat().resolvedOptions().timeZone) and navigator language against the IP geolocation and ad campaign targeting. A user clicking a US-targeted ad from a residential IP in Germany but reporting timezone "America/New_York" and language "en-US" is either traveling or spoofing. Persistent mismatches across sessions indicate proxy/VPN use.
Device Fingerprint Alignment
Check that screen resolution, color depth, hardware concurrency, and battery API (if available) match the claimed device type. Bots often run in headless mode with default fingerprints (e.g., 800x600, 24-bit, 4 cores) that don't match the user-agent string. S2's "VPN Detection" and device fingerprinting layer catch this.
Session Replay and Holistic Scoring
Individual signals produce false positives. A user with motor impairments may have low mouse entropy. A power user may tab rapidly. The solution is session replay analysis: reconstruct the full event stream and score the session holistically. BotRefund's client-side telemetry logs millisecond-resolution event timelines (S1) and feeds them into a scoring model that weights each signal by its false-positive rate in your traffic. The model outputs a single risk score per session, not a binary flag.
Tradeoff Table: Signal Coverage vs. Implementation Effort
| Signal | Catches | False-Positive Risk | Implementation Effort | Maintenance | Best For |
|---|---|---|---|---|---|
| Form interaction time | Scripted form fills, auto-complete abuse | Low (accessibility exceptions) | Low (event listeners on inputs) | Low | Lead gen, checkout |
| Copy-paste detection | Coupon extension overlays, credential stuffing | Low (legitimate paste is normal) | Low (paste event capture) | Low | E-commerce, coupon-heavy verticals |
| Autocomplete usage | New-device bots, profile-less automation | Medium (privacy modes disable autocomplete) | Medium (requires autocomplete attribute monitoring) | Low | Returning-customer funnels |
| Scroll behavior | Landing-page bots, zero-engagement conversions | Low (single-page apps need adjustment) | Low (scroll event sampling) | Low | Content-heavy landing pages |
| Mouse movement entropy | Headless browsers, Puppeteer/Playwright | Medium (accessibility tools, mobile touch) | High (60Hz sampling, entropy math) | Medium (model retraining) | High-value conversions, fraud-prone verticals |
| Tremor detection | Synthetic input injection | Medium (high-DPI mice, trackpads vary) | High (sub-pixel coordinate capture) | Medium | Desktop-heavy traffic |
| Superhuman speed floor | Direct API calls, zero-delay scripts | Very low | Very low (timestamp diffs) | Very low | All funnels as baseline filter |
| Timezone/language mismatch | Residential proxy farms, VPN users | Medium (travelers, expats) | Low (browser APIs + IP geo) | Low | Geo-targeted campaigns |
| Device fingerprint alignment | Headless mode, spoofed user-agents | Low (legitimate devices are consistent) | Medium (fingerprint library) | Medium (browser updates) | All paid traffic |
| Session replay scoring | Composite evasion, human-in-the-loop farms | Low (model learns your traffic) | High (event pipeline, model ops) | High (continuous labeling) | Enterprise spend, >$50k/mo ad budget |
Implementation Framework: From Signals to Score
- Instrument the funnel. Add lightweight event listeners for:
focus,blur,input,paste,scroll,mousemove(throttled to 60Hz),click,keydown. Capture timestamps in UTC milliseconds. - Collect environmental context. On page load, record: timezone, language, screen resolution, devicePixelRatio, navigator.hardwareConcurrency, user-agent, IP geolocation (via edge function), and battery status if available.
- Compute per-signal features. For each session, derive: median keystroke interval, paste count per field, scroll depth %, mouse path entropy, tremor variance, min action interval, timezone/IP delta, fingerprint consistency score.
- Calibrate thresholds on clean traffic. Run 2–4 weeks on known-human traffic (logged-in customers, CRM-matched leads). Set per-signal thresholds at the 99th percentile of clean distribution.
- Train a lightweight scorer. Use gradient-boosted trees (XGBoost/LightGBM) on labeled data: confirmed conversions vs. confirmed fraud (chargebacks, refund disputes, BotRefund-verified bot clicks). Start with 10–15 features; avoid deep learning unless you have >1M labeled sessions.
- Deploy real-time blocking or flagging. For scores above threshold: block conversion pixel fire (protects Smart Bidding), flag in CRM for manual review, or trigger step-up challenge (CAPTCHA, SMS). BotRefund's real-time filtering (S7) does this at the edge.
- Close the loop. Feed dispute outcomes (Google/Meta refund approvals, chargeback results) back as labels. Retrain monthly.
Limitations and When This Advice Does Not Apply
- Mobile app traffic. No mouse events; touch entropy differs. Use accelerometer variance, touch pressure, and gesture fluidity instead.
- Single-page apps with virtual scrolling. Scroll depth metrics break. Track virtual list index changes and render timing.
- Accessibility users. Screen readers, switch controls, and voice input produce atypical patterns. Maintain an allowlist for known assistive-tech user agents or let users self-identify.
- Low-volume funnels (<1k sessions/mo). Model training needs volume. Use rule-based thresholds (superhuman speed, zero scroll, timezone mismatch) until you have labels.
- Privacy regulations. GDPR/CCPA may restrict fingerprinting and session replay. Anonymize IDs, drop IP after geo lookup, and honor Do Not Track for non-essential signals.
- Human-in-the-loop click farms. Real humans on real devices following scripts. Behavioral signals degrade; rely on CRM outcome correlation (S4: "no calls connected, demos booked") and network-level clustering (shared device fingerprints across accounts).
Key Facts from BotRefund Source Pack
| Fact | Source | Context |
|---|---|---|
| 20% of ad traffic is bots | S2 | Homepage headline claim |
| 14% of clicks are invalid on average | S6 | Aggregated client data |
| 83% refund success rate for high-volume advertisers | S2 | Google/Meta billing disputes |
| 40-60% true ROAS improvement after cleaning traffic | S6 | Within 6-8 weeks |
| Behavioral detection catches sophisticated bots using residential proxies | S7 | IP blacklists alone miss modern fraud |
| Coupon extensions overwrite tracking cookies after cart load | S1 | Last-click commission hijacking |
| Meta Audience Network drives high CTR, near-instant bounce bot traffic | S3 | Third-party app placements |
| Residential proxy botnets hide behind consumer IPs | S5 | Malware on household devices |
| Click farms use real smartphones to bypass IP filters | S5 | Low-cost labor + automation |
| BotRefund captures GCLIDs/FBCLIDs with behavioral evidence for refunds | S2, S7 | Dispute-ready reports |
Terminology
- Click-to-conversion timing: Elapsed time between ad click (GCLID/FBCLID capture) and conversion event fire.
- Mouse movement entropy: Shannon entropy of direction changes in a pointer path; low values indicate straight-line or grid movement.
- Tremor variance: High-frequency positional variance during stationary or slow movement; near-zero suggests synthetic input.
- Superhuman speed floor: Minimum physiologically plausible interval between discrete input events (~50ms).
- Session replay: Full reconstruction of DOM events, timestamps, and environmental state for a single session.
- Pixel poisoning: Invalid sessions firing conversion pixels, causing bidding algorithms to optimize toward bot traffic.
- GCLID/FBCLID: Google Click ID / Facebook Click ID — query parameters that attribute a session to a paid click.
FAQ
How many signals do I need before seeing fraud detection improvement?
Start with three: superhuman speed floor (zero effort), zero-scroll detection (low effort), and timezone/IP mismatch (low effort). These catch ~60% of crude bots. Add form interaction time and copy-paste detection next. Mouse entropy and tremor require engineering investment; deploy when you exceed $50k/mo ad spend or see sophisticated fraud in dispute evidence.
What is the false-positive rate of a multi-signal model?
BotRefund's production model (S2) maintains <2% false positives on human traffic by calibrating per-signal thresholds on clean data and using a tree ensemble that learns signal interactions. Rule-only stacks typically run 5–15% false positives.
Do I need session replay if I have a scoring model?
Yes. The model gives a score; replay explains it. When you dispute a refund with Google or Meta, you submit the replay timeline as evidence. S2 and S7 emphasize "behavioral evidence" and "compliance-ready refund reports" — both require replay.
How does this differ from Google's built-in invalid traffic filtering?
Google filters known-bad IPs and simple patterns. It does not see your on-page behavior (mouse, scroll, form dynamics) and cannot link a specific GCLID to a behavioral anomaly. S7 notes: "Tools that rely solely on IP blacklists or rate limiting will miss modern click fraud."
What does implementation cost in engineering time?
Basic five-signal rule engine: 1–2 engineer-weeks. Full replay pipeline with model: 6–12 engineer-weeks plus ongoing labeling. BotRefund's one-minute install (S2) provides the pipeline as a service.
When should I escalate to a refund dispute vs. just blocking?
Block in real time to protect bidding (S7: "Real-Time Filtering"). Dispute when you have accumulated 100+ flagged clicks with behavioral evidence and GCLIDs. S2 reports 83% success rate for high-volume advertisers who submit structured evidence.
Can these signals detect coupon extension abuse?
Yes. S1 describes how extensions inject affiliate cookies after cart load. Copy-paste detection catches the coupon code paste; form interaction time shows zero manual entry; timezone mismatch may appear if the extension runs in a background context. BotRefund's client-side telemetry flags "coupon extension cookie set after the customer has already completed shopping steps."
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.