What is click fraud? How to spot it and stop it on Google Ads

Every time someone clicks your ad, you pay. Google charges for the click, not for who made it or why. That is where click fraud comes in: clicks made by people or programs that were never going to become customers. For businesses in competitive local markets such as legal services, trades and home services, where a single click can cost several pounds, it adds up quickly.

What counts as click fraud?

Click fraud, also called invalid traffic, is any click on a paid ad that has no genuine interest behind it. It usually comes from one of four sources:

• Competitors who click your ads to use up your daily budget, so your ads stop showing and theirs get the customers.
• Bots and scripts running from data centres or headless browsers, clicking ads at scale.
• Repeat clickers: the same person clicking again and again, often switching networks or using a VPN so each click looks new.
• Click farms and incentivised traffic, especially on display and partner networks, where low-quality placements generate clicks for payment.

Not all of it is malicious. Accidental double-clicks and curious visitors with no budget are frustrating too, but deliberate, repeated activity is what does the real damage.

Doesn't Google already stop it?

Google does run automatic filters for invalid clicks, and it credits some of them back to your account. You can see these under the invalid clicks columns in Google Ads. The problem is that the filters are tuned to catch the obvious cases. A competitor clicking a few times a week from different networks, or a bot that behaves enough like a person, can still slip through and be billed as a normal click.

Google also only sees what happens on its side. It does not see what visitors do on your website, which is where many of the clearest signals of fake traffic show up.

Warning signs to look for in your account

You do not need specialist tools to start spotting problems. Look for these patterns in Google Ads and Google Analytics:

1. Costs rising while conversions stay flat. If spend and clicks go up but enquiries do not, some of those clicks may not be real.
2. Unusual click-through rates on particular keywords or times of day, especially overnight.
3. Very short sessions: paid visitors who land and leave within a second or two, or never scroll.
4. Clicks from places you don't serve, or from data-centre locations, despite location targeting.
5. Budget running out early in the day, particularly at the same time each day.
6. Junk form submissions with fake names, nonsense messages or disposable email addresses.

One of these on its own is not proof. Several together, repeated over weeks, is a strong sign you are paying for invalid clicks.

How to reduce click fraud manually

There are several things you can do inside Google Ads today:

• Tighten location targeting. Use "Presence: people in or regularly in your targeted locations" rather than people who have shown interest in them.
• Review placements and partners. On display and Performance Max, check where your ads appear and exclude low-quality sites and apps. Consider switching off search partners if their traffic doesn't convert.
• Use ad scheduling. If you never get real enquiries at 3am, stop paying for clicks at 3am.
• Exclude suspicious IP addresses. Google Ads lets you exclude IP addresses at campaign level, but the list is limited in size and you have to find the addresses yourself from server logs.
• Protect your forms with spam filtering so fake leads don't pollute your conversion data.

These steps help, but they are reactive and time-consuming. By the time you have spotted a pattern and added an exclusion, the money is already spent, and fraudsters who change IP address simply come back.

Automating protection with ClickTrap

This is the problem we built ClickTrap to solve. It is our own in-house click fraud protection tool, built from years of running PPC campaigns for UK businesses.

ClickTrap checks every paid visit to your website as it arrives. It looks at signals such as data-centre IP addresses, headless browsers, VPNs and devices clicking repeatedly, then automatically excludes bad sources from your campaigns. It works with Google Ads, Microsoft Advertising, Meta and LinkedIn, and visitors who reach your thank-you page are treated as customers and never blocked.

You also get a dashboard that sorts paid clicks into valid, suspicious and invalid, so you can see how much the blocked clicks were costing you by campaign, day and country. That means cleaner data for every optimisation decision you make afterwards.

What to do next

Start by checking your own account against the warning signs above. If several apply, it is worth measuring the problem properly. ClickTrap has a free 30-day trial and takes about 10 minutes to set up, so you can see real figures for your own campaigns before spending anything. If you would rather we manage your campaigns and protection for you, our PPC team can help.

Frequently asked questions