Bots give themselves away at signup through behavior: the speed of the form fill, the order of the fields, the IP and device history, and whether the session ever behaved like a person browsing. Bots were 53 percent of web traffic in 2025, and 40 percent of it was bad bots. The signup form is the cheapest place to stop them.
The numbers that set the stakes
Thales counted bots at 53 percent of all web traffic in 2025, up from 51 percent the year before, with bad bots alone at 40 percent. AI-driven bot attacks rose 12.5 times in a single year. The numbers are not abstract. They are the traffic hitting the signup form, the login form, and the checkout, and they are the reason the signup form is the cheapest place to stop a fake account. A fake account stopped at signup costs nothing. A fake account stopped after its first purchase costs a refund, a chargeback, and a review.
The signup form is also where the fraud starts. A fake account that gets through signup can be used for credential stuffing, for bonus abuse, for review fraud, and for return fraud. Akamai counted 26 billion credential stuffing attempts per month in 2024, and Verizon found stolen credentials were the initial access in 22 percent of confirmed breaches in 2025. The account that is created by a bot is an account that will be used by a bot, and the signup form is the last cheap place to catch it.
Related reading on this site: Home and Fake Signups: The Velocity Signals That Give Bots Away cover the neighbouring problems in more depth.
What behavior looks like at signup
Bots give themselves away through behavior, and the signup form is where the behavior shows. A form fill that completes in two seconds is not a person. A session that fills the fields in order, top to bottom, without ever moving the mouse, is not a person. A session that loads no images, runs no JavaScript, and comes from a datacenter IP with no prior browsing history is not a person. Each signal is weak alone. Together they are a picture, and the picture is a bot.
The signals that matter are the ones a bot cannot fake cheaply. Mouse movement, typing cadence, and the order in which fields are filled are hard to fake at scale. IP and device history are harder still: a device that has already created five accounts is a device worth challenging, and an IP that has already been flagged is an IP worth blocking. The behavior is the signal, and the signal is available before the account is created.
The layered check that works
The check that works is layered, not single. A CAPTCHA is one layer, and it is the weakest one, because modern bots solve or bypass CAPTCHAs and because CAPTCHAs mostly annoy humans. Behavior scoring, velocity checks, and device reputation do more work with less friction, because they run in the background and only challenge the sessions that look wrong. The shopper who behaves like a person never sees the check. The bot that behaves like a bot gets challenged, and the challenge is the point.
The velocity check is the simplest layer and the most effective. A signup form that receives ten accounts from one IP in an hour is a form under attack, and the response is to slow the form down, challenge the sessions, or block the IP. The device reputation check is the second layer: a device that has already been linked to fraud is a device that gets a harder challenge. The behavior score is the third layer, and it ties the two together. No single layer catches every bot. The three together catch most of them, and the ones they miss are the ones the review queue is for.
Frequently asked questions
How much web traffic is bots?
Thales counted bots at 53 percent of all web traffic in 2025, up from 51 percent the year before, with bad bots alone at 40 percent. AI-driven bot attacks rose 12.5 times in a single year.
What behavior signals catch bots at signup?
Form fill speed, field order, mouse movement, whether the session loaded images or ran JavaScript, and the IP and device history. A signup that completes in two seconds from a datacenter IP with no prior browsing is not a person.
Why not just use a CAPTCHA at signup?
Because CAPTCHAs mostly annoy humans and modern bots solve or bypass them. A CAPTCHA is one layer, not the defense. Behavior scoring, velocity checks, and device reputation do more work with less friction.
What is credential stuffing at signup?
It is the reverse: bots testing stolen username and password pairs against login forms. Akamai counted 26 billion credential stuffing attempts per month in 2024, and Verizon found stolen credentials were the initial access in 22 percent of confirmed breaches in 2025.