Define minimum reasonable completion times for multi-step business flows based on human interaction patterns. Reject or flag completions that fall outside the human range:

• Account registration: A real user fills a form in 30–300 seconds. Registration completed in under 5 seconds: bot.

• Checkout flow (browse → cart → payment → confirm): Real users take 2–10 minutes. Completed in under 10 seconds: bot.

• Referral code entry: A user reads and types a code in 5–30 seconds. Pasted and submitted in under 500ms: bot.

• Survey or review submission: A real user takes 60–600 seconds to write a review. Submitted in 3 seconds: bot.

Track session timestamps server-side: when did the user reach step 1, step 2, and the final step? Compute the elapsed time. If below the minimum human threshold, return a challenge (CAPTCHA) rather than processing the transaction. Log the anomalous timing for review.

Sophisticated bots add artificial delays to mimic human timing. Combine this detection with behavioral fingerprinting (MIT 03) — a session that takes the right amount of time but has no real mouse movement is still a bot. Multiple signals together are more robust than any single signal alone.