The script is almost always the same. Sales report that half of this week’s enquiries are unusable: emails that bounce, nine-digit phone numbers, names like "asdf", requests in a foreign language for a service sold only in one region. Somebody says the word "fraud", and the conversation turns to whether to buy a click-fraud tool.
Sometimes it really is automated traffic. More often it is a mix of three different things: bots filling in forms, targeting that is too loose, and real people who are simply not your customers. They need separating, because the fixes are different. And there is one point almost everyone underestimates: the cost of invalid clicks is the smaller problem. The bigger one is that, if those leads are recorded as conversions, your bid strategy learns to go and find more of them.
What Google already does, and what it credits back
Start with what happens without you lifting a finger. Google treats as invalid any clicks and interactions that do not come from genuine interest: automated traffic, repeated clicks, accidental clicks, deliberately fraudulent activity. According to Google’s ad traffic quality site, the system runs more than two hundred filters that stop most invalid traffic in real time or shortly afterwards, backed by manual review of suspicious cases.
For an advertiser, in practice, that means:
- Filtered clicks are not charged. They are not in your billed clicks, but you can see them by adding the Invalid clicks and Invalid click rate columns to the campaigns table.
- What slips past the filters is credited later. Google states that invalid interactions identified after the fact within the past two months are credited; the credits appear in billing as adjustments labelled "Invalid clicks".
- Since June 2026 there is a dedicated report. The Invalid Activity Credit Report, found in the Report Editor, breaks credits down by campaign and network, showing credited clicks and interactions and "adjusted" metrics net of credits. At the time of writing it is available for Search and Performance Max campaigns.
- You can request an investigation. If you think the filters are missing something, you can ask Google to review the past 60 days of traffic. You need concrete evidence: dates, campaigns, times, and ideally your own site logs with the GCLIDs of the suspicious clicks.
The limit that matters. All of this is about clicks. Google has no idea whether the form submitted after a valid click contains fake data: to the conversion tag, a submission is a submission. A bot sophisticated enough to pass the click filters, or a valid click followed by a form filled in with invented details, produces a perfectly ordinary conversion. That is where nearly every serious problem starts.
Fraud or bad targeting? How to tell
Before talking about fraud, rule out the mundane causes, which are by far the most common. This is the table we use for the first pass:
| What you see | Most likely cause | Where to look |
|---|---|---|
| Forms with obviously invented details, often overnight, in bursts | Bots filling in the form (with or without an ad click) | Form logs: times, completion time, IP, whether a GCLID is present |
| Real leads, wrong topic: students, job seekers, suppliers | Broad match and over-wide search terms | Search terms report |
| Enquiries from other regions or abroad | The "presence or interest" location option | Location settings and the user location report |
| High CTR, near-zero time on page, no useful conversions | Accidental clicks on Display apps and sites | "Where ads showed" report and the Performance Max channel report |
| Click spikes you cannot find in Google’s search terms | Search partner network | Segment by network |
| Repeated clicks from the same IPs, concentrated on your most expensive keywords | Possible deliberate activity (competitors, click farms) | Server logs, the "Invalid clicks" column, an investigation request |
Two causes deserve a few more words. The first is broad match: when keywords are loose, a share of searches is about something else entirely, and the people who arrive fill in the form with an unrelated question. That is not fraud; it is a search terms governance problem, which we cover in our negative keywords guide.
The second is the location option. With the default "presence or interest" setting, ads can reach people outside your chosen area who show interest in it. For a business that serves one territory, "presence" (people in, or regularly in, your targeted locations) is almost always the sensible choice. We go into detail in our article on presence and interest in location targeting.
How bots poison Smart Bidding
Contact forms get filled in automatically for all sorts of reasons: advertising spam, testing stolen email addresses, scripts that try every form they find. Some of those bots arrive from an ad, or from low-quality placements on the Display Network and in Performance Max, and therefore carry a GCLID. When the form is submitted, the conversion tag fires and Google Ads records a conversion attributed to that campaign, that keyword, that placement.
For a strategy such as Maximise conversions or target CPA, that is valuable information: "this converts, and it converts cheaply". The system shifts budget towards the sources producing that kind of conversion. The better the junk traffic converts, the more of it gets bought.
An illustrative example. A campaign generates 100 conversions a month at £30 each. Thirty come from in-app placements and are bot submissions at £10 each; the other seventy are genuine enquiries at around £38.60. Seen by the algorithm, the app placements are the most efficient source in the account. Seen by sales, they are the one source that produces nothing. As long as the primary conversion is "form submitted", the algorithm’s view wins.
That is why spam leads are not an admin nuisance for sales to tidy up. They are a wrong optimisation signal that gets worse over time, and it is the same mechanism we describe in our article on value-based bidding for lead generation: the system optimises for exactly what you tell it to count.
Layer one: the form
Site-side defences are the cheapest and the most neglected. None is perfect on its own; together they remove the large majority of less sophisticated bots.
- Honeypot field. A field hidden from users but visible to bots that read the code. If it is filled in, the submission is quietly discarded. It takes minutes and bothers nobody.
- reCAPTCHA v3 or reCAPTCHA Enterprise. No puzzles for the user: it returns a score indicating how human the interaction looks. You choose the threshold, and the score must be checked on the server, not in the browser.
- Server-side validation. JavaScript checks are bypassed by posting straight to the form endpoint. Email format, phone length, required fields and per-IP submission limits all need rechecking on the server.
- Email and phone verification. Check that the email domain can receive mail, block disposable domains, validate numbers by country code and length. For high-value leads, confirm by SMS or email before the enquiry reaches sales.
- Completion time. A six-field form completed in one second was not completed by a person.
The most important point, though, is about tracking: the conversion tag should fire only once the server has accepted the submission. If the conversion is tied to a thank-you page visit, any bot or crawler that reaches that URL creates a conversion without submitting anything. We see it often in audits: a thank-you page that is indexed, or reachable directly, quietly counting phantom conversions.
Layer two: what you count as a conversion
Form defences reduce spam but never eliminate it, and they do nothing about real people who are off-target. The structural protection is different: do not optimise on form submissions.
- The form submission becomes a secondary conversion, worth watching but excluded from optimisation.
- The primary conversion is the qualified lead: the enquiry that sales or the CRM has confirmed as real and relevant. It reaches Google Ads through enhanced conversions for leads or offline conversion import; the technical side, including the move to the Data Manager API, is in our offline conversions guide.
- The value reflects quality. A lead that becomes a customer is worth more than a qualified one, which is worth more than one just received. Spam, by construction, is worth nothing and is never uploaded.
Set up this way, a bot that fills in the form stops being a positive signal: it never becomes a qualified lead, so to the algorithm that click cost money and produced nothing. It is the only fix that corrects the direction of optimisation instead of chasing symptoms. The price is latency, because qualification takes a few days, which is why the primary conversion should be the stage that arrives within a few weeks of the click and has enough volume.
Layer three: campaign settings
This is where you cut the traffic sources that most often bring low-quality clicks and leads:
- Search partner network. In Search campaigns it can be switched off in the network settings. It does not always need to go, but it should be segmented and judged on qualified leads, not on form fills. The same applies to Display expansion on Search campaigns. In Performance Max, Google is testing an alpha "Partners" setting that lets you exclude search partners and the Display Network; at the time of writing, most accounts do not have it.
- Account-level placement exclusions. A single list of excluded sites, apps and YouTube channels applies across Display, YouTube, Demand Gen and Performance Max. It is the main lever against accidental in-app clicks.
- The "presence" location option. If you serve a specific area, it is the first setting to check.
- IP exclusions, with realistic expectations. You can exclude up to 500 IP addresses per campaign, including ranges with an asterisk replacing the last part, and there is also an account-level list that applies to every campaign, Performance Max included. They work well for internal traffic or a competitor on a fixed IP; they do little against bots that change address with every request.
- Google lead forms on "More qualified". If you use lead form assets, you can choose between "More volume", the default, and "More qualified", which may use a form with more steps and produces fewer but more interested leads. For most B2B and high-value services we start with "More qualified".
Click-fraud tools: a sober view
There are plenty of tools that promise to detect and block fraudulent clicks. They can be useful, but buy them knowing what they actually do:
- They do not stop the click before it happens. They analyse the traffic reaching your site and, when they spot a suspicious source, add it to your IP exclusions, with the 500-address-per-campaign limit and little effect against rotating IPs.
- The fraud percentages they report are their own estimates. They use their own criteria, which differ from Google’s, and whoever sells the fix has an interest in showing a big problem. "35% suspicious traffic" does not mean you are paying for 35% invalid clicks: some of those clicks Google has already filtered and not charged.
- Where they genuinely help is in gathering evidence for an investigation request and in filtering forms on your site, which is exactly the part Google does not cover.
Our test for them is simple: a trial of a few weeks measured on qualified lead rate and cost per qualified lead, not on the number of IPs blocked. If those two numbers do not move, the tool is producing reports, not results. And before evaluating one, fix the form, the conversions and the campaign settings first: by then the remaining problem is often small.
Checklist
- Add the "Invalid clicks" and "Invalid click rate" columns and check credits in billing and in the dedicated report.
- Analyse your form logs: times, completion time, IP, whether a GCLID is present.
- Honeypot, reCAPTCHA and server-side validation on the form; the conversion tag fires only once the submission is accepted.
- Form submission as a secondary conversion, CRM-qualified lead as the primary one, with a consistent value.
- Review search partners, Display expansion, placements and the location option.
- IP exclusions only where they make sense: your office network and documented fixed sources.
- Investigation request to Google if you have concrete evidence, within the 60 days.
If the leads you receive do not match what Google Ads says it generated, our free audit starts right there: we compare recorded conversions, real enquiries and traffic sources to work out how much is spam, how much is targeting and how much is measurement. You can see how we work in our process and the answers to the most common questions in the FAQ.