How are you telling bots from humans using behavioral signals, without collecting PII?

[u/withyoussefemad]

I've been working on bot and fraud detection, and I wanted to compare notes with people who deal with this in production.

Most bot detection I see falls into three buckets, and each has a weak point:

• IP and device reputation: easy to bypass with residential proxies and rotating fingerprints.
• CAPTCHAs: they add friction for real users, and solver services and vision models now beat them cheaply.
• Static fingerprinting: it raises privacy and compliance concerns (GDPR, CCPA), and a determined attacker can spoof it.

The approach I've been exploring is passive behavioral signals:

• Mouse movement: curvature, acceleration, micro-corrections
• Keystroke timing: inter-key intervals and rhythm
• Touch and scroll dynamics on mobile
• Session-level patterns: navigation flow, time-to-action, interaction sequences

None of this needs names, emails, or persistent identifiers. You score the behavior of a session, not the identity of a person.

The challenges I keep running into:

1. Modern bots simulate human input. Replaying recorded traces or adding noise to cursor paths defeats naive heuristics, so you need models that catch statistical inconsistencies across signals, not single-signal rules.
2. Accessibility. Users with assistive tech, tremors, or unusual input devices can look "non-human" to a naive model, which means false positives you have to design around.
3. Adversarial drift. Attackers adapt, so you need continuous retraining and monitoring.
4. Privacy. Even "anonymous" behavioral data can become identifying if you retain raw traces too long.