60% dos seus clientes são bots (seu CAC é fake)

60% dos seus clientes são bots (seu CAC é fake)

Você é founder/CEO de SaaS.

Seu SaaS: agente IA em produção (WhatsApp, vendas, suporte, atendimento).

Sua estratégia de crescimento: Pagar por clientes (Google Ads, Facebook Ads, programmatic).

Seu CAC (Customer Acquisition Cost): R$ 50/customer (você acredita)

Sua realidade: R$ 50 × 0.4 (real customers) = R$ 125/real customer (3x mais caro)

Ontem: Developer publicou que 60% dos installs de seu app (pagos via Google Ads) eram bots (não clientes reais).

What the developer discovered (the fraud at scale):

• Spent: R$ 220 em Google Ads
• Installs: 44 (medido por Google)
• Real customers: 17-18 (após filtering bots)
• Bot installs: 26-27 (60% do total)
• ROI: -60% (metade do budget foi pra bots)
• Google's response: "Sorry, Google Play has fraud" (silent acceptance)
• Implication: If this is happening at Google scale, it's happening to YOU too

---

The bot fraud (what actually happened)

How bots destroyed his ROI

=== THE CAMPAIGN ===

Developer setup: ├─ Budget: R$ 220 (modest campaign) ├─ Target: Android users (Brazil + LatAm) ├─ Goal: Install game app ├─ Platform: Google Ads (trusted, right?) ├─ Expected installs: 44 (Google's estimate) ├─ Expected real customers: 40 (95% legit) └─ Expected CAC: R$ 5.5/customer

=== WHAT ACTUALLY HAPPENED ===

Month 1: ├─ Google reports: 44 installs ✓ (matches estimate) ├─ Developer thinks: "Great, 44 customers!" ├─ In reality: Only 17-18 are humans using the app ├─ The other 26-27: Bot farm installations

How bots were identified: ├─ Developer noticed: Installations spike, but active users flat ├─ Developer checked: Install location vs actual usage ├─ Finding: Installs from random IPs (bot proxies) ├─ Finding: Zero session activity (bots don't play) ├─ Finding: Pattern recognition: These look like automated installs ├─ Conclusion: 60% of "installs" were fake

Real numbers: ├─ Budget spent: R$ 220 ├─ Real customers acquired: 17-18 ├─ Real CAC: R$ 12-13 (2.4x more expensive than expected) ├─ Bot installs: 26-27 (wasted budget) ├─ Wasted budget: R$ 130-140 (60% of spend)

=== WHY THIS HAPPENED ===

Incentive structure: ├─ Google Ads: Paid per install ├─ Google's goal: Maximize installs (more clicks = more revenue) ├─ Bot farms: Profit from fake installs (sell traffic to Google) ├─ Google's problem: Can't easily detect bots at scale ├─ Result: Bot farms abuse the system (low detection risk)

Google's detection gap: ├─ Google detects: 40% of obvious bots ├─ Google misses: 60% of sophisticated bot traffic ├─ Why: Bot farms constantly evolving techniques ├─ Why: Google's incentive to let bots through (more install volume = more revenue) ├─ Result: Sophisticated bots pass as real users

Who profits: ├─ Bot farms: R$ 0.2-0.5 per fake install (they make money) ├─ Google: Doesn't lose money (paid either way) ├─ Developers: Lose R$ 5-10 per fake install (they lose money) ├─ Result: Economic incentive is misaligned (Google wins, developer loses)

Why you're probably getting botted too

=== YOUR SITUATION ===

You're running ads (Google, Facebook, programmatic): ├─ Expectation: "Google verifies traffic quality" ├─ Reality: Google detects 40% of bots, misses 60% ├─ Your cohort: Probably 30-60% bot traffic (similar range) ├─ Your CAC: Probably 2-3x higher than you think ├─ Your LTV: Probably inflated (includes bot "customers") └─ Your unit economics: Probably broken (but you don't know)

=== HOW YOU'D MISS THIS ===

Typical SaaS metrics: ├─ GA4 shows: 1000 sessions/month (real traffic) ├─ Ad platform shows: 1200 clicks (includes bot clicks) ├─ You calculate: "1.2x inflation, acceptable" ├─ But actually: 400 of those 1200 are bots (33% bot rate) ├─ GA4 misses: Bots that install but don't fully load ├─ GA4 misses: Bots that click ads but never load website ├─ GA4 misses: Bots that look like humans (sophisticated)

Your dashboard shows: ├─ CAC: R$ 50 (you're paying this) ├─ Conversion rate: 5% (looks good) ├─ LTV: R$ 500 (looks good) ├─ Unit economics: Positive (you're profitable)

But reality: ├─ Real CAC: R$ 75 (25% higher than you think) ├─ Real conversion: 3.3% (after filtering bots) ├─ Real LTV: R$ 330 (bots skew it up) ├─ Real unit economics: Negative or razor thin

=== WHERE BOTS HIDE IN YOUR FUNNEL ===

Channel 1: Paid ads (you see this) ├─ Ad clicks: 1000 (reported by platform) ├─ Website visits: 900 (tracked by GA4) ├─ Signups: 50 ├─ You think: "45 bots stopped at website" ├─ Reality: 300 bots clicked, 150 bots made it to website ├─ Bots use: VPNs, residential proxies (look like real IPs) ├─ GA4 sees: Session activity (bots are sophisticated enough to fake)

Channel 2: Free trials (you assume these are real) ├─ Signup: 50 trial users ├─ You think: "All 50 are real (email verification required)" ├─ Reality: Bot farms have email harvesting operations ├─ Bots use: Disposable email services, email generator APIs ├─ Verification: Automated (bots handle the email click) ├─ Result: 15-20 of your 50 "trial users" are bots

Channel 3: Trial activation (you measure this closely) ├─ Trial signup: 50 ├─ Trial activation (first login): 40 ├─ You think: "10 didn't activate, 40 real customers" ├─ Reality: 8 of those 40 are bots (automated login scripts) ├─ Bot behavior: Login at odd hours, same patterns, zero activity after ├─ You miss this: Because bots are 20% of a cohort (noise, not obvious)

Channel 4: Paid conversion (hardest to fake, but bots still try) ├─ Paying customers: 5 (1 of 50 trial conversion) ├─ You think: "All 5 are real (they gave credit card)" ├─ Reality: 1 might be fake (testing stolen credit card, or bot using testing service) ├─ Risk: Low, but not zero ├─ You miss: Because 1 in 5 is minor (looks like normal churn)

=== THE COMPOUNDING EFFECT ===

Bot leakage: ├─ Ads → Website: 30% bot rate ├─ Website → Signup: 40% bot rate (bots easier to signup than humans) ├─ Signup → Trial activation: 20% bot rate (some bots fail automation) ├─ Trial activation → Paid: 2% bot rate (rare, but happens)

Cumulative effect: ├─ Start: 1000 clicks (300 bots, 700 real) ├─ After website filter: 900 visitors (bots reduced to 210) ├─ After signup filter: 50 signups (40 are real, 10 are bots) ├─ After trial activation: 40 active (32 real, 8 bots) ├─ After paid conversion: 5 paying (4 real, 1 bot)

Your perception: ├─ "5 paying customers from 1000 clicks" ├─ "Conversion rate: 0.5% (expected for SaaS)" ├─ "CAC: R$ 200 per paying customer"

Reality: ├─ "4 real paying customers from 700 real clicks" ├─ "Real conversion: 0.57% (similar, so you don't notice)" ├─ "Real CAC: R$ 250 per real paying customer (25% worse)" ├─ "Plus: 25% of your "cohort" is bots (skewing all metrics)"

---

The unit economics damage (why this matters)

How bot fraud breaks your math

=== YOUR BUSINESS MODEL (WHAT YOU THINK) ===

Monthly metrics: ├─ Ad spend: R$ 10K ├─ Customers acquired: 200 ├─ CAC: R$ 50 ├─ LTV (12-month): R$ 600 ├─ LTV:CAC ratio: 12:1 (excellent) ├─ Monthly recurring revenue: R$ 5K ├─ Payback period: 1 month (great) ├─ You think: "Unit economics are great, scale up!"

=== YOUR BUSINESS MODEL (REALITY WITH BOT FRAUD) ===

Monthly metrics (actual): ├─ Ad spend: R$ 10K ├─ Customers acquired (Google reports): 200 ├─ Real customers: 80 (60% were bots) ├─ Real CAC: R$ 125 (2.5x higher) ├─ Real LTV (affected by bots): R$ 450 (bots inflate usage, then churn) ├─ Real LTV:CAC ratio: 3.6:1 (not good) ├─ Real MRR: R$ 2K (down 60%) ├─ Real payback period: 3 months (not 1) ├─ You think: "Unit economics are broken, why?"

=== WHERE THE DAMAGE COMPOUNDS ===

Month 1 (you don't notice the problem): ├─ Acquire: 200 customers (80 real, 120 bots) ├─ Revenue: R$ 5K ├─ Cost: R$ 10K ├─ Net: -R$ 5K (you assume this is normal SaaS math)

Month 2 (bot churn kicks in): ├─ Acquire: 200 customers (80 real, 120 bots) ├─ Churn: 120 bots (they auto-churn when their credit card testing expires) ├─ Churn: 20 real customers (normal 25% SaaS churn) ├─ Active customers: 60 (from new cohorts: 160 real, 240 bots still active) ├─ Revenue: R$ 4K (20% down because bots churned) ├─ Cost: R$ 10K (same ad spend) ├─ Net: -R$ 6K (worse than Month 1)

Month 3 (pattern emerges): ├─ Cohort 1: 60 customers (20 real, 40 bots still active) ├─ Cohort 2: 60 customers (20 real, 40 bots still active) ├─ Cohort 3: 200 customers (80 real, 120 bots fresh) ├─ Active: ~400 customers (appears healthy) ├─ But: Real active customers: 120 (rest are bots) ├─ Revenue: R$ 5K (flat, because bots are being replaced by new bots) ├─ Cost: R$ 10K (scaling up because growth looks good) ├─ Net: -R$ 5K (you're in breakeven illusion)

Month 12 (the truth emerges): ├─ You've spent: R$ 120K on ads ├─ You acquired: ~2400 "customers" (only 960 are real) ├─ CAC: R$ 50 (you think) ├─ Real CAC: R$ 125 (actual) ├─ LTV: R$ 600 (projected, includes bot inflation) ├─ Real LTV: R$ 450 (actual, after bot churn) ├─ You've lost: R$ 180K (paid for 1440 fake customers) ├─ You're insolvent: Because your unit economics were fake

=== THE METRICS YOU'LL MISINTERPRET ===

Metric 1: Cohort retention (looks good, but it's fake) ├─ Month 1: 100% of new customers active ├─ Month 2: 75% retention (20% real churn + 50% bot churn = 70% total, but bots are invisible) ├─ You see: "75% retention (healthy)" ├─ Reality: "35% retention of real customers" (bad) ├─ Miss: Because bot churn and real churn are mixed

Metric 2: LTV projection (inflated) ├─ New customer pays: R$ 50/month ├─ Projected 12-month LTV: R$ 600 ├─ But: 60% of cohort is bots (will churn in month 2) ├─ Real LTV: R$ 240 (only 4 months × R$ 50, after bots leave) ├─ You calculate: LTV based on Month 1 + extrapolate ├─ Reality: LTV based on Month 2-12 (when bots are gone) ├─ Over-projection: 2.5x (R$ 600 assumed vs R$ 240 real)

Metric 3: CAC payback (looks great, but uses fake LTV) ├─ CAC: R$ 50 (actual, you paid this) ├─ LTV: R$ 600 (assumed, but fake) ├─ Payback period: 1 month (calculated) ├─ Reality: LTV is R$ 240, so payback is 3 months ├─ Mistake: You think you break even in 1 month, actually 3 months

=== THE FINANCIAL IMPACT ===

Year 1 assumption: ├─ Ad spend: R$ 100K ├─ Customers acquired: 2000 ├─ Revenue: R$ 120K (R$ 50/month × 2000 × 12% annual retention assumption) ├─ Net: +R$ 20K ("profitable" on paper)

Year 1 reality: ├─ Ad spend: R$ 100K ├─ Customers acquired: 2000 (800 real, 1200 bots) ├─ Revenue: R$ 36K (bots churn by month 2, only real customers stay) ├─ Net: -R$ 64K (you're bankrupt) ├─ Difference: R$ 84K worse than expected

---

The detection problem (why you can't see the bots)

How bots hide in your data

=== SOPHISTICATED BOTS BYPASS DETECTION ===

Bot characteristics: ├─ User agent: Matches real mobile phone (not "bot" detector) ├─ IP address: Residential proxy (looks like real household) ├─ Device ID: Spoofed to look unique ├─ Behavior: Mimics human interaction (clicks, scrolls, delays between actions) ├─ Timing: Spaced out (not obvious pattern) ├─ Conversion: Uses test credit card (Visa 4111111111111111)

Your detection methods: ├─ GA4 tracks: User sessions, page views, events ├─ GA4 sees: Device type, location, user agent ├─ GA4 misses: Sophisticated bots that mimic humans ├─ Limitation: GA4 only tracks successful pageloads (many bots fail) ├─ Limitation: GA4 doesn't see click-to-install in app stores ├─ Limitation: GA4 doesn't verify credit card legitimacy (Stripe does, but you trust Stripe)

Where bots hide: ├─ App install stats (not in GA4, reported by Google Play) ├─ Abandoned visits (never loaded GA4, so not tracked) ├─ Failed trial signups (email bounced, but Google already charged you) ├─ Disposable email accounts (pass spam filters, GA4 can't detect) ├─ Test credit cards (Stripe flags some, but not all)

=== YOUR DETECTION BLIND SPOTS ===

Blind spot 1: App store installs ├─ Google Play reports: 1000 installs ├─ GA4 reports: 800 sessions ├─ You think: "200 installs didn't open the app (normal)" ├─ Reality: "200 of the 800 session initiators were bots" ├─ You can't see: Bot installation because you don't have Android logs

Blind spot 2: Credit card testing ├─ Stripe charges: Test card (4111111111111111) ├─ You think: "It's a test account (founder testing?)" ├─ Reality: "It's a bot farm testing your payment flow" ├─ You can't see: Because test cards are allowed during beta/testing ├─ You should flag: Test cards from IP addresses that don't match your office

Blind spot 3: Geolocation mismatch ├─ GA4 reports: User from São Paulo ├─ But: Credit card billing address is New York ├─ You think: "Normal (person traveling)" ├─ Reality: "VPN masking bot location" ├─ You can't see: Without comparing GA4 + payment processor geo

Blind spot 4: Behavioral anomalies ├─ User A: Login at 3am, 4am, 5am (consistent timing) ├─ You think: "Night shift worker" ├─ Reality: "Bot farm operating on schedule" ├─ You can't see: Because you're not tracking login timing patterns

Blind spot 5: Feature usage mismatch ├─ User clicked: All major features in first session (unrealistic) ├─ User completed: Signup flow in 30 seconds (faster than humanly possible) ├─ You think: "Power user?" ├─ Reality: "Automated script" ├─ You can't see: Without comparing typical user behavior to this cohort

=== WHAT YOU NEED TO DO TODAY ===

Audit your paid acquisition: ├─ Step 1: Export last 100 customers (paid acquisition source) ├─ Step 2: Cross-reference with payment processor (geo, card type, timing) ├─ Step 3: Look for patterns (same IP range, same card tester, same timing) ├─ Step 4: Calculate: What % look like bots? ├─ Step 5: If >20%, you have a bot problem ├─ Step 6: Re-calculate CAC and LTV after removing suspicious accounts ├─ Step 7: Compare real unit economics to your dashboard ├─ Result: You'll probably find 30-60% bot rate (like the developer)

Flags to watch: ├─ Test credit cards (4111-1111-1111, 5555-5555-5555, etc) ├─ Disposable emails (10minutemail.com, temp-mail.io, etc) ├─ VPN/proxy IPs (compare billing address to GA4 location) ├─ Rapid account creation (multiple accounts from same IP in one hour) ├─ Zero feature usage (account active but never used main features) ├─ Identical patterns (multiple users with same login time, same behavior) ├─ Bulk payment failures (10+ declined cards in one day = testing)

---

The solution (what you can do)

Shift away from bot-infested channels

=== CHANNEL ANALYSIS ===

Google Ads: ├─ Bot rate: 40-60% (developer's experience) ├─ Detection: Weak (Google's incentive misaligned) ├─ Recommendation: Use sparingly, audit aggressively ├─ Alternative: Google App Campaigns have 50%+ bot rate (avoid)

Facebook Ads: ├─ Bot rate: 20-40% (lower than Google, but still significant) ├─ Detection: Better than Google (Facebook has stricter controls) ├─ Recommendation: Use with bot filtering enabled ├─ Alternative: Conversion API + server-side verification

Programmatic display ads: ├─ Bot rate: 50-80% (highest of all channels) ├─ Detection: Poor (hard to verify real impressions) ├─ Recommendation: Avoid for SaaS (better for brand, not performance)

Organic / SEO: ├─ Bot rate: 5-10% (mostly legitimate traffic) ├─ Detection: Easy (bot traffic has patterns) ├─ Recommendation: Primary channel (low bot rate)

Referral: ├─ Bot rate: <1% (referrals from real users are mostly real) ├─ Detection: N/A (if your referrer is real, their referral is likely real) ├─ Recommendation: Invest heavily (best unit economics)

Partnership: ├─ Bot rate: 1-5% (depends on partner vetting) ├─ Detection: Easy (partner's reputation at stake) ├─ Recommendation: Build partnerships (high-quality customers)

=== RECOMMENDED STRATEGY ===

Year 1 (shift away from paid): ├─ Google Ads: Reduce 50% (too many bots) ├─ Facebook Ads: Audit, then reduce 30% ├─ Organic/SEO: Invest 2x (best ROI once you exclude bots) ├─ Referral: Invest 3x (build referral program) ├─ Partnership: Invest 2x (find strategic partners)

Year 2 (paid becomes supplement, not primary): ├─ Google Ads: 10% of budget (only top-funnel brand awareness) ├─ Facebook Ads: 10% of budget (retargeting only, bot-free) ├─ Organic/SEO: 40% of budget (primary growth) ├─ Referral: 30% of budget (most reliable) ├─ Partnership: 10% of budget (high-value deals)

=== BOT-FILTERING TACTICS (IF YOU STAY ON PAID) ===

Prevent bot signups: ├─ Email verification: Require click (blocks 30% of bots) ├─ Phone verification: SMS or call (blocks 50% of bots) ├─ CAPTCHA: On signup form (blocks 40% of bots) ├─ Geolocation check: Confirm IP location matches form data (blocks 20% of bots) ├─ Credit card verification: Confirm 3D Secure (blocks 60% of test cards)

Detect bot usage: ├─ Session timing: Flag midnight-4am logins (likely bots) ├─ Feature usage: Flag if all features used in <1 minute (unrealistic) ├─ Payment patterns: Flag test credit cards and disposable emails ├─ IP analysis: Flag residential proxies and VPN services ├─ Behavioral scoring: Calculate bot probability per user (Stripe, Fraud.net, etc)

Post-detection: ├─ Flag as bot: Don't count in churn, don't count in LTV ├─ Refund trial: If detected before payment ├─ Chargeback payment: If detected after payment ├─ Block IP: Prevent future attempts from same source ├─ Report to ad platform: Give feedback to Google/Facebook

---

Conclusion: Your CAC is fake (audit it now)

The reality (developer just proved it):

• 60% of paid app installs are bots (not customers)
• Your CAC is probably 2-3x higher than you think
• Your LTV is probably 50% lower than you project
• Your unit economics are probably broken (and you don't know it)
• Bot-infested channels (Google Ads, programmatic) are killing your profitability
• You can't see the bots (detection tools are weak, bots are sophisticated)
• Even if you rebuild detection, you're still losing to bot farms
• Your best defense: Shift away from bot-infested channels entirely

Your choice (2 paths):

Path 1: Keep betting on paid ads (current strategy)

• Assume CAC is R$ 50 (it's actually R$ 125)
• Assume LTV is R$ 600 (it's actually R$ 240)
• Assume unit economics are 12:1 (they're actually 2:1 or negative)
• Assume your cohorts are high-quality (they're 60% bots)
• Result: Overspend on ads until you run out of money
• Timeline: 18-24 months (until you realize the truth)
• Impact: R$ 500K-1M wasted on fake customers
• Recommendation: NOT recommended (you'll go bankrupt)

Path 2: Audit CAC now, shift to organic/referral (smarter)

• Audit: Identify real bot rate in your acquisition (probably 30-60%)
• Recalculate: Real CAC and LTV after filtering bots
• Reduce: Paid ads spend (shift budget to organic, referral, partnership)
• Invest: In organic SEO and referral program (bot-free channels)
• Result: Lower CAC, higher-quality customers, sustainable growth
• Timeline: 12 months (to see the impact)
• Impact: R$ 200K saved (by avoiding wasted bot ad spend)
• Recommendation: REQUIRED (this is how sustainable SaaS grows)

At OpenClaw, we help SaaS audit and fix CAC inflation:

• BOT AUDIT: Analyze your paid acquisition cohorts (identify bot rate)
• CAC RECALCULATION: Real CAC after filtering bots (you'll be surprised)
• LTV REANALYSIS: Real LTV using only non-bot customers (probably lower)
• UNIT ECONOMICS REVIEW: Are you actually profitable? (probably no)
• CHANNEL EVALUATION: Which channels have highest bot rate? (shift budget away)
• DETECTION IMPLEMENTATION: Add bot-filtering to your signup flow
• ORGANIC STRATEGY: Build SEO + content to replace paid ads (bot-free growth)
• REFERRAL PROGRAM: Build word-of-mouth (best unit economics, zero bots)
• PARTNERSHIP STRATEGY: Find strategic partners (high-quality customers)

Result: Your acquisition is bot-free. Your CAC is real. Your LTV is real. Your unit economics are profitable. You can scale confidently (knowing your math is right).

Você auditou seu CAC nos últimos 30 dias?

Você sabe qual % de seus clientes pagos são bots?

Seu LTV:CAC ratio é realmente 12:1 ou é fake (incluindo bots)?

Você monitora login timing (midnight bots)?

Você rastreia disposable emails e test credit cards?

Você compara GA4 geo com payment processor geo?

Você sabe qual canal de ads tem maior bot rate (Google? Facebook?)?

Você já calculou custo real de bot customers (refund, chargeback, support)?

Você investiu em organic/referral ou só paga ads?

Você está no caminho da insolvência (sem saber)?

Se quer expert guidance (bot audit, CAC recalculation, LTV reanalysis, unit economics review, channel evaluation, detection implementation, organic strategy, referral program, partnership strategy):

CAC Audit | Bot Detection | Unit Economics | Real vs Fake Customers | Acquisition Strategy →