Few things make advertisers angrier than the thought of paying for clicks that were never real. A competitor tapping your ad every morning, a bot farm hammering your display placements, a sudden spike of clicks from a country you do not even serve — the suspicion that part of your budget is being stolen is common, and sometimes justified.
The reality is more nuanced. Ad platforms filter a lot of invalid traffic automatically and do not charge for it. Some of what looks like fraud is actually poor targeting, accidental mobile taps or tracking errors. And some genuinely is fraud, which you can reduce with the right settings and monitoring.
This guide explains what click fraud and invalid traffic are, how Google handles them, the warning signs to look for, a step-by-step investigation process and the practical defences that actually work.
Key Takeaways
- Click fraud is a type of invalid traffic: clicks with no genuine interest, from bots, scripts, click farms, competitors or publishers.
- Google filters invalid traffic automatically and says you are not charged for invalid traffic detected before billing; later detections are credited.
- Suspicious patterns — sudden click spikes with no conversions, odd locations, junk form fills — are the first clues, but rule out targeting problems first.
- Your strongest defences are tight targeting, placement and IP exclusions, conversion-based bidding and clean conversion data.
- If you have evidence of invalid clicks that were charged, gather it and submit an investigation request to Google.
What Is Click Fraud?
Click fraud is the deliberate generation of ad clicks with no genuine interest in the ad, usually to drain an advertiser's budget or to earn publisher revenue. Google uses the wider term invalid traffic, which covers both deliberate fraud and accidental activity such as repeated clicks.
Wikipedia's summary of click fraud describes the main sources:
- Publisher fraud: website owners clicking ads on their own sites (or paying others to) to earn ad revenue.
- Competitor clicks: rivals clicking your ads to burn your budget.
- Bots and botnets: scripts or infected computers simulating human clicks at scale.
- Paid click workers: people paid small sums to click ads.
Click fraud has been a known industry problem for decades. In 2006, Google agreed to a $90 million settlement fund in the Lane's Gifts class action over click fraud, one of the early cases that pushed ad platforms to invest heavily in detection.
How Google Handles Invalid Traffic
Google describes a layered approach: automated filters, machine learning and manual reviews. Automated filters continuously scan traffic for interactions that do not match normal human behaviour patterns.
“You aren’t charged for invalid traffic detected before billing.”
— Google Ads Help, About invalid traffic
If invalid traffic is identified after you have been billed, Google says it automatically issues an invalid activity credit in the next billing cycle, as a billing adjustment. You can see how much traffic was filtered by adding the Invalid clicks and Invalid click rate columns to your campaign reports.
Warning Signs: Fraud or Something Else?
Many “fraud” complaints turn out to be targeting or tracking problems. Use this table to separate them:
| Symptom | Possible fraud explanation | Common non-fraud explanation |
|---|---|---|
| Sudden spike in clicks, no conversions | Bot or click-farm activity | Broad match expansion, new placement, tracking broken |
| Clicks from countries you do not serve | Botnets or click farms abroad | Location setting includes “interest in” your target area |
| Very high CTR on Display/partner sites | Fraudulent publisher placements | Accidental taps in mobile apps |
| Junk or fake form submissions | Bots filling forms | No spam protection on forms, misleading ad copy |
| Repeated clicks at the same time daily | Competitor or script | A genuine customer reordering or comparing |
| Near-zero time on site from paid clicks | Non-human visits | Slow page, wrong landing page, mismatched intent |
Check settings first. In particular, review your location targeting options, your network settings (Search partners and Display expansion) and recent changes to keywords or match types. Our list of Google Ads mistakes that waste money covers many of these.
How to Investigate Suspicious Clicks: Step by Step
- Define the window. Note when the suspicious activity started and which campaigns, ad groups and networks it affects.
- Check the Invalid clicks columns. See whether Google already filtered part of the traffic.
- Segment the data. Break performance down by network, device, location, hour and — for Display or Performance Max — placement.
- Review the search terms. The search terms report may show irrelevant queries that explain poor-quality clicks without any fraud.
- Cross-check site analytics. Compare paid sessions with engagement, bounce behaviour and conversions in GA4 or your server logs. Look for clusters of identical behaviour.
- Inspect form submissions. Look for repeated email patterns, nonsense names or submissions seconds apart. Make sure form tracking counts only genuine submissions.
- Collect evidence. Record dates, times, IP addresses (from server logs), placements and click IDs where possible.
- Apply exclusions (see below) and monitor whether the pattern stops.
- Request an investigation. If you believe you were charged for invalid clicks, use Google Ads Help's invalid click investigation request and submit your evidence.
Practical Defences That Work
| Defence | What it does | Notes |
|---|---|---|
| IP exclusions | Blocks ads from showing to specific IP addresses | Up to 500 per campaign; account-level exclusions also available |
| Placement exclusions | Stops ads appearing on specific sites, apps or channels | Most useful for Display, Video and Performance Max |
| Location “presence” targeting | Shows ads only to people in your target area | Reduces clicks from distant regions |
| Ad scheduling | Limits ads to hours when real customers act | See ad scheduling |
| Conversion-based bidding | Bids less on traffic that does not convert | Needs clean conversion data |
| Form spam protection | Stops bots polluting conversion data | CAPTCHA, honeypots, verification |
| Third-party monitoring tools | Flags suspicious IPs and devices | Useful for high-CPC niches; check claims critically |
On IP exclusions, Google's help centre is precise about limits:
“You can exclude up to 500 IP addresses per campaign.”
— Google Ads Help, Exclude IP addresses
Google notes that campaign-level IP exclusions are not available for some campaign types, including video, hotel and App campaigns, while account-level exclusions apply across campaign types including Performance Max, Demand Gen, Search, Shopping, Display and YouTube. Keep in mind that sophisticated bots rotate IPs, so IP blocking is a supporting measure, not a cure.
Protect your conversion data
Fake conversions are often more damaging than fake clicks, because smart bidding learns from them and starts buying more of the same traffic. Validate leads before counting them as primary conversions, and where possible import only qualified outcomes. If you use Google Ads lead form assets, Google highlights features such as OTP verification to help confirm contact details.
You can also automate monitoring: Google Ads scripts and automated rules can alert you to sudden spikes in clicks or cost without matching conversions.
Common Mistakes
- Assuming every bad click is fraud. Loose match types and broad location settings cause far more waste than fraud for most advertisers.
- Blocking huge IP ranges. You may exclude real customers, including people on shared mobile or office networks.
- Ignoring Search partners and Display expansion. Review these networks separately rather than letting them blend into Search results.
- Letting spam leads train bidding. Unfiltered form fills teach the algorithm to find more spam.
- Never auditing. A regular PPC audit catches suspicious patterns early.
- Buying tools on fear alone. Third-party protection can help, but judge it on measured results.
Related Guides
- Ads in AI Overviews and AI Mode: What Advertisers Need to Know
- Lookalike Audiences: How to Build Ones That Convert
- Video Ads: How to Plan, Make and Run Them Profitably
Frequently Asked Questions
Does Google refund click fraud?
Google says you are not charged for invalid traffic detected before billing, and if invalid traffic is found later it automatically issues an invalid activity credit in the next billing cycle.
Can a competitor click my ads to waste my budget?
It can happen, but Google filters repeated and suspicious clicks automatically. Check the Invalid clicks column and use IP exclusions if you identify specific sources.
How many IP addresses can I exclude in Google Ads?
Google allows up to 500 IP address exclusions per campaign, and also offers account-level IP exclusions.
How do I know if I have click fraud?
Look for clicks without engagement or conversions, unusual locations, odd timing patterns and junk form fills — after ruling out targeting and tracking issues.
Do I need a click fraud protection tool?
Not always. Many advertisers solve most problems with tighter targeting, exclusions and clean conversion data. Tools can help in high-CPC, high-risk niches.
Conclusion: Separate Real Fraud From Real Waste
Click fraud is real, but it is only one source of wasted spend. Start by checking targeting and tracking, monitor Google's invalid click data, apply exclusions to genuine problem sources, protect your conversion data and request an investigation when you have evidence.
If you suspect your budget is leaking, our PPC management team can audit your traffic quality and set up the right defences — get a free quote.
