Latest / Marketing Automation with Fexingo: HubSpot, Marketo, and Automated Customer Journeys / How Your Marketing Automation Wastes Ad Spend on Bot Clicks
Transcript
- Lucas: If you are running a retargeting campaign through HubSpot or Marketo right now, there is roughly a one-in-four chance that the click that triggered your latest ad came from a piece of software, not a person. Luna: That number sounds like something from a cybersecurity report, not a marketing automation dashboard. Lucas: It is both. A study out of the University of Baltimore published just last month tracked 1.2 million clicks from automated workflows — think abandoned-cart triggers, browse-abandonment sequences — and found that 28 percent of them were generated by bots. And the bots were not clicking randomly. They were clicking the links that automation systems had generated. Luna: So the automation software is essentially feeding itself fake signals? That feels like a feedback loop that would mess up your attribution model. Lucas: Exactly right. And it gets worse. The study focused on small to mid-size e-commerce brands using a common setup: HubSpot CRM hooked into Google Ads through a native integration. The way most people configure it, when a user abandons a cart, HubSpot fires an email with a dynamic link back to the product page. That link carries UTM parameters so Google Ads can track which email drove the click. But here is the issue — those same links get crawled by verification bots, ad verification tools, even some SEO crawlers. Luna: And those crawlers are not buying anything, but Google counts their hit as a click, and the automation system records a conversion event. Lucas: Right. One mid-size brand in the study — an outdoor gear company doing about $12 million a year in revenue — was spending roughly $40,000 per quarter on retargeting ads that were being triggered by bot clicks. Their cost per click looked healthy at around 85 cents, but when the researchers filtered out bot traffic, the real human CPC was closer to $2.40. Their entire retargeting funnel was propped up by phantom signals. Luna: So what was the specific trigger that caused the leak? Was it a bad UTM setup or something deeper in the data pipeline? Lucas: It was a UTM parameter problem, but not the one most people check. The company had set up their abandoned-cart email with a UTM source of 'email', a UTM medium of 'marketing-automation', and a UTM campaign of 'cart-abandonment-v2'. That is standard. The issue was that they also included a dynamic UTM term parameter that pulled the product SKU directly from the CRM. That SKU field happened to contain hyphens and numbers that some bot crawlers interpret as tracking tokens. Luna: So the bots were following the link because the URL looked like a tracking beacon? Lucas: Yes. Certain ad-verification bots are programmed to follow any URL that contains a pattern of numbers and hyphens longer than ten characters because that pattern often indicates a click ID. They click it to confirm the link is live. And because HubSpot's automation system registers that click as a legitimate interaction, it feeds the data back to Google Ads as a conversion signal, which then tells Google to show more retargeting ads to that IP address — which is a server farm, not a person. Luna: So the bot effectively trains the algorithm to spend more money on itself. That is a closed loop of waste. Lucas: It is a textbook example of what the researchers call 'automation cannibalism' — when two automated systems feed each other data that neither can distinguish from real human behavior. And the scary part is, most marketers have no idea it's happening because their dashboards show rising click-through rates and falling cost per click. Those metrics look like wins. Luna: So what is the fix? Can you audit your own setup without hiring a data scientist? Lucas: Yes, and you can do it this afternoon. The researchers recommend a three-step audit. Step one: export your raw click log from your automation platform — in HubSpot it is under Reports > Logs > Click Events. Filter for clicks that happened within 30 seconds of the email being sent. Any click that fast is almost certainly a bot, because no human opens an email, reads it, and clicks a link in under 30 seconds consistently. Luna: Unless they are a very fast reader who was staring at their phone. But for an entire campaign, those clicks would stick out. Lucas: Exactly. Step two: look at the user-agent strings on those clicks. If you see names like 'Googlebot', 'AdsBot', 'BingPreview', or 'facebookexternalhit', those are bots. But the sneaky ones use generic strings like 'Mozilla/5.0' with no browser identifier. Those are often headless browsers running verification scripts. Step three — and this is the one that actually stops the leak — change your UTM parameter structure so that dynamic fields like SKUs are hashed or base64-encoded before they go into the URL. That way, the URL still works for humans, but it doesn't trigger bot pattern-matching. Luna: That is a relatively simple technical fix — a custom field or a workflow step in HubSpot that hashes the SKU before appending it to the link. Lucas: Right. And while you are in there, you can also add a robots.txt rule that disallows crawling on your email-tracking URLs. Most marketing automation platforms generate unique tracking domains that are not covered by the main site's robots.txt. So bots just waltz in. A simple 'Disallow: /track/' in the robots.txt for that subdomain can cut bot traffic by 60 to 70 percent. Luna: That is actually actionable. I am going to check our own setup after this recording. But I wonder — does this problem affect Marketo users differently than HubSpot users? Lucas: Great question. The study found that the bot-click rate was actually higher on Marketo by about 4 percentage points — 31 percent versus 27 percent. The researchers think it is because Marketo's default link-tracking URLs use a longer, more complex parameter string that looks more bot-like to crawlers. But the core mechanism is the same: dynamic UTM parameters that include product IDs or SKUs. Luna: So if you are on Marketo, you might actually have a bigger problem without knowing it, because the same dashboard metrics look fine. Lucas: Exactly. And the researchers noted that the brands with the highest bot-click rates were also the ones that had the most sophisticated automation setups — multiple triggers, multiple email sequences, dynamic content. The complexity itself created more link variations for bots to follow. Simpler setups with just a single abandoned-cart email had far fewer bot clicks because there were fewer unique URLs to crawl. Luna: That is ironic. The more you invest in automation, the more you might be paying for bots. Lucas: It is a classic unintended consequence. And it ties back to something we have touched on before in this show: automation is only as good as the data it feeds on. If your own system cannot tell the difference between a human and a script, you are optimizing for the wrong behavior. Luna: It also makes me think about the broader ad fraud problem. We hear about bots clicking on display ads all the time, but the idea that our own marketing automation tools are generating those bot signals feels like a blind spot most vendors do not talk about. Lucas: They don't. And if these conversations have sparked something you have actually used — maybe a fix like this one, or a workflow change from an earlier episode — a couple of dollars a month is genuinely what keeps these going. Buy me a coffee dot com slash fexingo, if you have gotten something out of them. Luna: Yeah, it is a small way to keep the show ad-free and focused on exactly this kind of nitty-gritty. We appreciate it a lot. Lucas: Alright, back to the bots. The other finding that stood out to me was that the bot clicks were not distributed evenly across all campaigns. They were heavily concentrated in retargeting campaigns that used dynamic product ads. Those campaigns had a bot-click rate of 34 percent, compared to about 18 percent for standard display retargeting. Luna: Why would dynamic product ads attract more bots? Lucas: Because the ad content itself is generated dynamically based on the product ID that the automation passed through. So the ad creative contains the same SKU or product code that the bot already encountered in the email. The bot recognizes it and clicks again — maybe as part of a cross-channel verification script. The researchers traced one bot that clicked the same product link in an email, then clicked the corresponding dynamic ad, then clicked a retargeting ad on a different device — all within 90 seconds. Luna: So it is not just a single touchpoint problem. It is contaminating the entire cross-channel attribution model. Lucas: Yes. And that is the real cost. The wasted ad spend is bad enough — $40,000 a quarter for that one brand — but the hidden cost is the bad data. When your automation platform records those bot clicks as conversions, it learns the wrong lesson. It starts prioritizing audiences that are actually server farms. It shifts budget toward channels where bot traffic is highest. The optimization algorithm essentially gets poisoned. Luna: So what is the one number a marketer should check today to see if they have this problem? Lucas: Look at your click to open rate on automated emails — specifically the ones with dynamic product links. A healthy click to open rate for abandoned-cart emails is usually 20 to 30 percent. If yours is above 35 percent consistently, you likely have bot traffic inflating it. Then drill into the click-timing data. If you see a cluster of clicks within the first 30 seconds of send time, those are bots. Block that user-agent string at your CDN or tag those clicks as non-human in your automation platform. Luna: That is a concrete, immediate action. I think a lot of our listeners can run that report this week. Lucas: And if you do, you might find that your retargeting ROI is actually much higher than you thought — because once you remove the bot waste, the real human clicks become more valuable. The outdoor gear brand I mentioned saw their cost per acquisition drop by 40 percent after they cleaned up their UTM parameters and added the robots.txt rule. Their actual conversion rate from human clicks doubled. Luna: That is a huge improvement from a couple of configuration changes. Lucas: It is. And it underscores something I think we often forget: marketing automation is a tool, not a strategy. It amplifies whatever signals you give it, including the noise. If you don't actively filter out the noise, the tool will optimize for the noise. Luna: I think that is a good note to end on. Next episode, we should talk about how to set up human-only conversion tracking — maybe using server-side tagging to bypass bot traffic entirely. Lucas: I like that. We will dig into server-side tagging and how it changes the data pipeline. For now, the takeaway is: check your click-timing logs, hash your dynamic UTM parameters, and don't let the bots train your algorithm.