Can your store's velocity checks catch a bot that shops like a real human?

A new wave of AI-driven bots does not rush to checkout. Instead, these agents browse product pages, scroll through listings, and add items to carts slowly and naturally, exactly as a real shopper would. Traditional velocity checks look for speed anomalies (hundreds of requests per second), so a bot moving at human pace passes through completely undetected.

These bots are increasingly used for scalping limited-edition items, competitive price scraping, and inventory manipulation. All without triggering a single alert on a rules-based fraud system.

What to do about it?

• Analyse mouse movement patterns, scroll cadence, click timing, and keystroke dynamics. Even a well-scripted bot produces statistically different signatures from a real human.
• Move beyond per-request rate limiting. Score the entire session and observe how long it spent on a page, whether it followed a natural reading path, and whether it hovered over images.
• Look for mismatches between the declared browser environment and actual capabilities. Headless Chrome, missing fonts, or suspiciously clean browser history are common signals.
• Add hidden form fields or invisible page elements that real users will never interact with. Any session that triggers these is almost certainly automated.
• Instead of hard blocks, introduce micro-challenges (invisible CAPTCHA scoring, delayed responses) for suspicious sessions to make attacks economically costly without harming real customers.