How to Spot Fake SaaS Revenue: 4 Forensic Signatures
Fabricated revenue is easy to display and hard to sustain. Each shortcut leaves a trace. Here are the four that show up again and again.
Imagine walking 10 meters on the beach but leaving only 3 steps bootprint? impossible, right?.
Fake revenue isn't hard to show. A number is a number — anyone can put one on a slide. What's hard is making it consistent. Real revenue is tied to a hundred other things: sessions, signups, activations, engagement, referral sources, the timing of churn. A fabricated number has to keep all of them in agreement to survive scrutiny, and it almost never does.
So you don't catch fake revenue by staring at the revenue. You catch it where the revenue fails to line up with everything that should surround it. Four signatures recur.
Signature one: revenue without an audience
A given MRR implies a population. If you're doing real recurring revenue at a given ARPU (Average Revenue Per User), some number of paying accounts exist — and if those accounts are real, they generated a behavioral footprint of a predictable size: sessions, signups, activations, logins, support touches. People leave exhaust.
The first signature is money that implies thousands of users sitting on top of traffic that can only account for hundreds. That gap is the fingerprint of self-funded MRR — looped cards, fabricated subscriptions, a small set of controlled accounts cycled to inflate the count. The charges are easy to manufacture. The matching human behavior is not, because real behavior is expensive, messy, and timestamped. A seller can fake the revenue or fake the audience; faking both, in sync, at scale, is where it falls apart.
A founder claims $80,000 MRR at an $80 ARPU. That requires ~1,000 active paying accounts (80,000 ÷ 80 = 1,000).
GA4 shows ~700 visits/month producing ~60 signups, with a claimed 0% churn. Two things break immediately:
-The funnel can't build the base. A site turning ~700 visits into ~60 users a month cannot have produced or sustained 1,000 paying customers. The audience the revenue requires is more than ten times the audience the traffic can account for.
The revenue-per-visitor is impossible. $80,000 ÷ 700 = $114 per visitor. But ARPU is $80 — that's what each paying customer pays. You cannot earn more per visitor ($114) than per paying customer ($80), because not every visitor pays. Revenue per visitor must sit below ARPU, usually far below. $114 isn't just high; it's a contradiction.
The money describes a thousand-customer company. The traffic describes a sixty-signups-a-month business. Both can't be true.
How it surfaces: the revenue-to-traffic ratio sits outside any plausible range for the business model and ARPU.
Signature two: growth that only exists in the diligence window
Real growth has a past. Fabricated growth has a date.
The second signature is a sharp inflection in revenue and traffic concentrated in the final 30–60 days before a raise or a sale — with nothing in the prior eighteen months that rhymes with it. The timing itself is the tell. Growth that materializes precisely when someone starts looking, and never appeared before, is a curve shaped by the deal calendar rather than the market.
The methods that produce it vary — a timed push, annual prepays pulled forward, a padded final billing cycle — but the trace is the same: a terminal spike with no history behind it.
How it surfaces: revenue and traffic concentration in the terminal window, and the shape of the growth curve measured against its own past.
Signature three: sessions that don't behave like people
Sometimes the traffic count is fine — and the traffic still isn't real.
Purchased and bot traffic gets poured into the top of the funnel to make the conversion math look plausible. But it doesn't act human. Engagement rate, session duration, bounce, and the conversion-to-session ratio drift outside the ranges real cohorts produce. The sessions either never convert — pure decoration — or they convert at rates no genuine audience hits, because the "users" aren't actually choosing anything.
This is the third signature: a real-looking volume of sessions that behaves nothing like a real audience.
To explain this more, A founder shows 60,000 sessions/month — plenty of volume. Then GA4 shows the average session lasts 3 seconds. Do the math:
60,000 × 3 sec = 180,000 sec = 50 hours.
That's the total human attention the product got all month — 50 hours, across 60,000 visits. For a business claiming thousands of paying users, that's almost nothing.
It gets worse. GA4 only counts a session as engaged once it passes 10 seconds. At a 3-second average, almost no session clears the bar:
Engaged sessions ≈ 4% — against the ~50% a real audience produces.
The volume is real. The behaviour isn't. Real users pause, click a second page, and come back. Bots arrive, blink, and leave — 60,000 times.
Then we start asking, Was traffic purchased? Was there a one-time viral post? Were bots involved? Were ad campaigns heavily subsidized? Is the spike repeatable?
How it surfaces: engagement-rate anomalies and behavioral distributions that don't match human benchmarks.
Signature four: traffic with no believable origin
Every real audience has a provenance. The users came from somewhere — search, a referral, a community, an ad spend with a paid footprint to match. There's an origin story, and it's coherent.
Manufactured traffic struggles to invent one. The backlink profile skews toward low-quality or nofollow links. Referral spikes appear with no corresponding brand activity to explain them. The acquisition mix simply can't account for the volume claimed. The fourth signature is traffic that exists in the analytics but has no credible way of having arrived.
To explain this more, A founder claims:
80,000 monthly visitors 15,000 registered users
But when a buyer looks deeper:
| Source | Visitors |
|---|---|
| Google Search | 1,200 |
| Direct | 73,000 |
| Referrals | 800 |
| Social | 300 |
| 200 |
Here's the only question that matters: is it plausible that 73,000 people typed the URL straight into their browser and hit enter?
That's 91% of all traffic arriving as "direct" — no search, no referral, no link. Direct traffic at that scale takes a household-name brand.
It's also exactly how bots show up: they arrive with no referrer, so analytics files them under "direct."
The real signature is disagreement
None of these convicts on its own. A low revenue-to-traffic ratio might be a genuinely viral product with light analytics. A terminal spike might be a real, well-run launch. An odd engagement number might be one bad tracking setup.
The forensic signal isn't any single anomaly. It's that revenue, behavior, and provenance stop telling the same story. Honest growth corroborates itself from three directions at once — the money, the behavior, and the origin all agree without anyone forcing them to. Fabricated growth has to keep three independent systems manually in sync, and the seams show under cross-examination.
That's the whole idea behind what we built. ProofCap cross-references live revenue against behavioral and traffic signals and surfaces exactly where they diverge — delivered as a timestamped, reconstructable record of whether the signals agree. Not a verdict on a number. A map of whether the numbers that should move together actually do.
If you're heading toward a raise or an exit, the useful exercise isn't polishing the revenue figure. It's checking whether your own signals corroborate each other before a buyer checks for you.