If you've built a survey, a lead form or a feedback widget then some of the data that ends up in your database wasn't actually written by a human. Bots used to be easy to spot: nonsense text, identical responses, a form completed in 2 seconds. AI agents have completely changed the game. They can now write fluent open ended responses and pass simple attention checks.
I work in B2B market research where a single fake 'IT decision maker' can completely skew a study so we deal with that on a daily basis. Here's what still works.
1. Donโt trust client side checks alone
A hidden 'honeypot' field is a good starting point (real users will never see it, bots will fill it in). If the check only happens in the browser though then any bot that posts directly to your endpoint will just go ahead and skip it. You need to validate on the server as well (reject any submission where the honeypot has a value or the form comes back quicker than a human could possibly read it).
2. Look at the whole response, not one answer
AI answers often look fine one at a time. The tells show up in the pattern:
- Every answer the same length and tone
- Open-ended answers that are polished but never specific
- Claims that donโt hang together, like a โCTOโ at a 3-person company who manages a 200-person IT team
3. Ask questions only the real respondent can answer
For a niche audience a short knowledge check is better than an attention check. Ask something a real member of that group would know off the top of their head and that's very difficult to guess.
4. Check the boring metadata
Duplicate devices, impossible locations, disposable email domains and a whole bunch of submissions arriving in a tight burst. None of it by itself is conclusive but taken together they're very strong indicators.
5. Avoid false positives
Every check will also catch some of the genuinely honest people (fast readers, non-native speakers, people on their phones). Don't just reject on one signal, combine the signals and keep a log of why you've removed each response so you can go back and review the decisions.
The takeaway
There's no single bot test anymore. Stack on the cheap server-side checks, the response pattern checks, and the audience-specific questions and see what you end up removing.
We've written a longer guide on this too, with the checks we use and the questions we ask of any data supplier: How to prevent survey fraud and AI bots.
What are you seeing in your own forms? I'd be interested to hear what's worked for you.
Top comments (0)