REDCap: Preventing Bots and Fraud in REDCap Survey Studies

Tags RDMC redcap

This article outlines the steps and methods users can take to help prevent and detect fraudulent/bot responses in their REDCap projects. These methods are merely recommendations and not a required aspect of a project. 

 

In This Article:

 

Understanding fraud and bot activity

Type 

What it looks like 

Strongest defenses 

 Simple bots 

 Scripts that auto-fill forms; very fast, identical or random answers, hidden fields filled 

 CAPTCHA, honeypot fields, timing checks 

 AI-assisted bots and agents 

 LLM-written open-ended answers that sound fluent but generic; can pass basic attention checks 

 Contextual open-ended questions, live verification, consistency checks 

 Professional or repeat responders 

 Real people submitting many times with varied names and emails to collect multiple payments 

 Duplicate detection, identity verification, payment controls 

 Ineligible people misrepresenting themselves 

 Real people who answer the screener the way they think you want, to qualify 

 Hidden eligibility criteria, cross-checks, verification calls 

 Coordinated fraud rings and click farms 

 Bursts of submissions shared through forums or group chats, often from similar locations or overnight hours 

 Private links, timing and burst monitoring, staged recruitment 

 

Common Red Flags

  • A sudden spike in submissions, especially overnight in your time zone or right after posting a link publicly. 

  • Completion times far below a realistic minimum for reading the questions. 

  • Email addresses that follow patterns (name plus random digits, the same unusual domain, sequential addresses). 

  • Identical or near-identical open-ended answers across records, or answers that do not address the question asked. 

  • Straight-lining (the same answer to every item in a grid) and contradictory answers. 

  • Locations, time zones, or phone area codes that do not match the stated residence or recruitment area. 

  • Participants who cannot answer basic questions about the study or themselves during a verification call. 

  • Multiple requests to be paid in a specific way or pushing to be paid quickly. 

 

Built-in REDCap survey settings

Setting 

Where to find it 

What it does 

Limits 

Google reCAPTCHA 

Survey Distribution Tools > Public Survey Link > "Protect the public survey using the Google reCAPTCHA feature" 

Shows an "I'm not a robot" check before the public survey opens 

Public links only, not participant-specific links; a device passes at most once per day; sophisticated bots and human fraudsters get through 

Response limit 

Online Designer > Survey Settings 

Closes the survey after a set number of responses 

Raise it in small increments after reviewing each batch; protects the incentive budget from a flood  

Time limit for survey completion 

Online Designer > Survey Settings 

Expires the survey link a set number of days, hours, or minutes after invitation 

Applies to invited links; limits time to research or game answers 

Survey expiration date 

Online Designer > Survey Settings 

Closes the survey at a fixed date and time 

Useful for short recruitment windows and pausing a compromised link 

Participant List and Automated Survey Invitations 

Survey Distribution Tools > Participant List; Online Designer > Automated Survey Invitations 

Sends a unique, single-use link to each known person 

Requires a contact list or a screening step first; the strongest protection against link sharing and repeat submissions 

Survey Login 

Online Designer > Survey Settings (Survey Login) 

Requires participants to enter values already stored on their record, such as date of birth or a study code, before the survey opens 

Works only when you hold that information in advance 

Survey access codes 

Survey Distribution Tools > Participant List 

Lets participants enter a code instead of clicking a link 

Codes can be shared; treat like a private link 

Conditional Auto-Continue 

Survey Settings of the first survey (or survey queue) 

Moves people to the next survey only when logic is met, such as passing screening or challenge questions 

Keeps the main survey and the incentive off the public front door 

 

Survey design techniques

  • Use the public link as a study landing page 
    • REDCap only allows the first instrument to be a public survey, so make that instrument a short screener or interest form rather than the paid survey itself.
    • Eligible, verified people then receive a participant-specific link to the real survey through an Automated Survey Invitation (ASI) or sent manually.
  • Honeypot fields
    • Add one or two plausible-looking fields with the @HIDDEN-SURVEY action tag. Humans never see them, but many bots fill every field on the page. Any record with a value in a honeypot could be suspected bots.
    • Use realistic variable names and labels, not "honeypot" or "bot_trap".
    • Set up an Alert & Notification that emails the team when a honeypot field is filled.
    • Optionally use branching logic to end the survey quietly when a honeypot has a value. 
  • Timing fields
    • Add a text field with @NOW (or @NOW-SERVER) and @HIDDEN-SURVEY at the start of each page or section to timestamp progress. 
    • Use the smart variables [survey-time-started:instrument] and [survey-time-completed:instrument], or a datediff() calculated field, to compute duration.
    • Pilot the survey with your team and set a minimum plausible completion time, such as one-third of the median pilot time. Flag anything faster. 

 

Identity and eligibility verification

Method 

How to run it in REDCap 

Notes 

Phone or video call 

Store call outcomes in a staff-only instrument; send the main survey link only after a "verified" field is set 

Ask participants to confirm screener answers in their own words; mismatches and refusals are strong signals 

Email confirmation 

Send the next survey via Participant List or an Alert to the email given, so the participant must access that inbox 

Also catches typos; does not stop people with many email accounts 

Mailing address check 

Compare the address with the stated ZIP code and county; consider mailing a physical incentive 

Mailed incentives deter fraud because addresses are harder to multiply 

Duplicate detection 

Make name, email, and phone required fields; review a report sorted by these fields.

Check for near-duplicates too: same phone with different emails, swapped name order, plus-addressing (name+1@gmail.com) 

Records or registry match 

Confirm eligibility against clinic records or a registry under an approved protocol 

Strongest for clinical populations 

Tips for verification calls

  • Use a short script with open questions ("Tell me a little about how you heard about the study") rather than yes/no prompts that echo the screener. 

  • Note the time zone and background noise only as context, never as a sole reason to exclude. 

  • Be respectful; many flagged people are real, and a courteous process protects your study's reputation. 

 

Data monitoring and review 

REDCap tools for monitoring 

  • Custom reports sorted by start time, email, phone, and duration, with the flag fields as columns. 

  • Project Dashboards and Alerts & Notifications to email the team when a honeypot is filled, a record is flagged, or daily submissions exceed a threshold. 

  • Data Quality rules for impossible or contradictory combinations. 

  • Logging to see when records were created; bursts of records created seconds apart are a warning sign. 

  • Survey metadata in exports: start and completion timestamps for each survey. 

  • Disabling surveys: If bots have become an issue in a project, the surveys can be disabled temporarily in the survey settings. 

 

 

Print Article