Click Fraud: What It Is and How to Protect Your Google Ads

Click fraud is when someone, or something, clicks your pay-per-click ads with no interest in what you sell, so you pay for traffic that will never become a customer. The good news is that Google filters most invalid clicks automatically and doesn't charge you for them. The rest you can manage with a few settings, a monthly check and, for some businesses, a third-party tool.

This guide covers what click fraud is, real click fraud examples, what Google already does for you, and the practical steps a small advertiser can take this week.

What is click fraud?

Google calls it invalid traffic and defines invalid clicks as "clicks on ads that aren't the result of genuine user interest". That includes clicks made on purpose to drive up an advertiser's costs or a website owner's ad earnings, clicks from bots and other automated software, and accidental clicks such as the second click of a double-click.

Not all of it is fraud in the criminal sense. Some is accidental. Some is a competitor clicking out of curiosity. Some is organised and automated. For you as an advertiser the effect is the same: wasted spend and messier data, because fake clicks make your click-through rate, conversion rate and cost per lead look different from reality.

How big is the problem?

Across the whole digital ad industry, it is large. Juniper Research estimated the global cost of digital ad fraud at US$84 billion in 2023, and projected it to more than double over five years. That figure covers all digital advertising, not just search ads, but it is a good reason to know where your ads show and what you are paying for.

Click fraud examples: who is behind it?

Competitors

Competitor click fraud is the one small businesses worry about most. The idea is simple: a rival clicks your ads to burn through your daily budget so your ads stop showing. Google lists manual clicks meant to increase an advertiser's costs as invalid, and its systems try to filter them out of your reports and your bill automatically.

Bots and botnets

Automated clicks are the most serious kind. The best-known case is the Methbot and 3ve schemes, where US prosecutors charged eight men in 2018. According to the US Department of Justice, they "faked both the users and the webpages", using rented data centre servers and malware-infected home computers to load ads that no real person ever saw. Google was one of the companies that helped investigate.

Dodgy publishers

When your ads show on other websites and apps through the Display Network or Performance Max, the site owner earns money from clicks. A small number of publishers inflate their earnings with fake or forced clicks. This is why placement reports matter, which I cover below.

Click injection on mobile

Click injection is a mobile app version of click fraud. A malicious app already on someone's Android phone notices when a new app is being installed, then reports a fake click as the download happens, so it looks like the last ad touched before the install. The fraudster then gets paid for an install they didn't drive. If you don't run app install campaigns, this one won't affect you.

Accidental clicks

Fat-finger taps on mobile and double-clicks aren't malicious, but they are still invalid. Google treats them the same way as other invalid clicks.

What Google does automatically

Many business owners don't realise how much Google already handles. According to Google's guide to managing invalid traffic:

• You aren't charged for invalid clicks. Most are detected and filtered in real time, before they reach your bill.
• Later detections become credits. Google keeps reviewing traffic from the last 60 days. If it finds invalid clicks after you've been invoiced, you get a credit on a later invoice. Google doesn't issue refunds as such; it adjusts what you owe.
• You can see it. Credits show as "Invalid activity" under Adjustments in Billing, then Summary. You can also add the "Invalid clicks" column to your campaign table to see how many clicks were filtered.
• There is a credit report. The Invalid Activity Credit Report in Report Editor shows credited clicks and costs, plus adjusted metrics like adjusted cost per conversion, for Search and Performance Max campaigns.

One quirk: Google notes that a click can occasionally be removed as invalid while the conversion from it stays, so you may now and then see more conversions than clicks.

How to tell if click fraud is hurting your account

Not every traffic spike is fraud. Google itself suggests checking for normal causes first: a budget or bid change, new keywords, a broader match type or seasonal demand. Signs worth investigating are:

• A sudden jump in clicks with no rise in enquiries, calls or sales.
• Lots of clicks from a location you don't serve.
• Form submissions with junk names, fake emails or gibberish messages.
• A high "Invalid clicks" count on one campaign compared with the rest.
• Display or Performance Max placements on sites or apps that have nothing to do with your business.

If you think something is wrong, you can ask Google to investigate using its click quality form, but only for traffic in the last 60 days. Gather your 10-digit customer ID, exact dates, the campaigns and keywords affected, and server logs with IP addresses and click IDs (GCLIDs) if you have them. Google says investigations take several working days.

How to avoid click fraud: what a small advertiser can actually do

1. Tighten location targeting

Google's default location setting is "Presence or interest", which can show ads to people who have only shown interest in your area. Switching to "Presence" limits ads to people who are, or regularly are, in your target locations. For a local business this alone cuts a lot of irrelevant clicks.

2. Exclude suspicious IP addresses

If your server logs or form data point to the same IP addresses again and again, exclude them. You can exclude up to 500 IP addresses per campaign, and account-level IP exclusions now cover Performance Max as well as Search, Shopping, Display and YouTube. Keep in mind that most bots rotate addresses, so this is a tidy-up tool, not a wall.

3. Decide whether search partners earn their place

Search campaigns include Google search partner sites by default. You can untick "Include Google search partners" in campaign settings. Check how partner traffic performs on its own, and switch it off if it brings clicks without leads.

4. Watch your placements

If you run Display or Performance Max campaigns, check the placement report each month and exclude sites and apps that send junk. Google has been rolling out network segmentation in Performance Max placement reports, which makes this easier.

5. Use negative keywords and sensible match types

Google recommends adding negative keywords and using more restrictive match types where you are getting poor-quality clicks. A weekly search terms review catches most of it. My guide to Google Ads strategies for 2026 walks through that routine.

6. Protect your lead quality

Bots that click ads often fill in forms too. Google suggests server-side form validation, double opt-in for sign-ups and enhanced conversions for leads, so Smart Bidding learns from real customers instead of spam. Adding a simple spam filter (such as a hidden honeypot field) to your forms helps as well.

7. Consider a click fraud tool if you spend heavily

Third-party tools such as ClickCease (now part of CHEQ) and ClickGUARD monitor clicks on Google Ads, Microsoft Ads and Meta Ads and can block suspicious sources automatically. Both offer a free trial. They suit businesses in high-cost, competitive niches more than an account spending a few hundred dollars a month. Google points out that these tools may flag duplicate IPs or bots that Google has already filtered and not charged you for, so compare their reports with your own invalid click data before you decide.

A monthly click fraud check

1. Open Billing, then Summary, and note any "Invalid activity" adjustments.
2. Add the Invalid clicks column to your campaigns and compare it with last month.
3. Check clicks, leads and cost per lead by location.
4. Review placements and search partner performance.
5. Scan recent form submissions for junk.

It takes about 20 minutes and tells you whether you have a real problem or just normal noise. If you want a wider view of what to measure, read how to know if your marketing is actually working.

Frequently asked questions

Does Google refund click fraud?

Google doesn't charge for clicks it identifies as invalid. If it detects them after you've been billed, it applies a credit to a later invoice, shown as "Invalid activity" in your billing summary.

Can a competitor click my Google Ads?

They can, but Google treats deliberate clicks meant to raise your costs as invalid and tries to filter them automatically. If you suspect a competitor, check your invalid clicks column, exclude any repeat IP addresses, and request an investigation within 60 days.

What is a click fraud example?

A well-known example is the 3ve scheme, which used malware-infected computers to load ads on fake websites. A simpler example is a bot repeatedly clicking a search ad, or an app faking a click just before someone installs another app.

If you'd like someone to keep an eye on this for you, my Google Ads management service covers setup, tracking and ongoing optimisation. Book a free call and we'll look at whether your budget is going where it should.