Bots are detected using a number of different methods, probably last of which is how they actually play their cards. Bots have consistent timing tells on actions, they always click the mouse button on the exact same pixel, they fail captcha's etc.

Bots are not really an issue, the bigger issue is assisted play for a human. So a programme tells the player the optimal move and the player executes it. That's much harder to catch.