Can a bot detection tool tell the difference between a real user on a VPN and an automated browser?

It can, when it does not rely on a single signal. A VPN can change network details, but it does not fully explain hardware and audio inconsistencies in the same way an automated browser does. BotRefund uses the audio channel mismatch as evidence and compares it with other independent checks. The full pattern lets it separate a genuine visitor using privacy tools from an actual bot.