Google Ads Click Fraud: How to Spot It, Report It and Stop It

Google Ads click fraud is paid clicks on your ads with no real interest behind them, from bots, click farms or competitors. Google removes the invalid clicks it catches from your bill, and the ones it misses are charged like any other click.

A bot that clicks your ad and runs your tags arrives with the ad's click ID, so GA4 files it under your paid traffic. It never buys. Every one Google misses costs you the click, pulls your conversion rate down and pushes your cost per acquisition up. If a campaign optimizes for an early step such as a page view or a form fill, bots can also fire that goal, and Smart Bidding counts them as results.

This guide covers what Google counts as an invalid click, what click fraud costs at real US prices, how to check your account, how to claim a credit inside Google's 60-day window, and which settings cut it at the source. For the wider picture, see what click fraud is and what ad fraud is.

What Is Click Fraud in Google Ads?

Click fraud in Google Ads is clicks made on purpose without genuine interest, by bots, click farms, competitors or publishers chasing earnings.

Google's own term is invalid clicks: "clicks on your ads that don't represent a genuine interest in your business" (Google Ads Help). Google sorts them into three kinds: accidental clicks caused by poor ad placement, automated traffic from bots and other software, and manual clicks that "increase your ad costs or inflate publisher profits".

Click fraud is the deliberate part of that list. An accidental click is invalid, but nobody planned it. Everything else is someone clicking on purpose, or running software that does.

Who does it depends on where your ads run.

On Google Search, the usual suspect is a competitor. Google lists "competitors who manually click to increase your spend" as invalid activity (Google Ads Help). Every click spends part of your daily budget, and once the budget is gone your ads stop showing for the day.

On the Display Network and search partner sites, the motive is money for the site. A site that shows Google ads earns when people click them, so a dishonest owner can send click bots or a click farm to click the ads on its own pages. That's what Google means by clicks that inflate publisher profits.

Invalid Clicks, Click Fraud and Invalid Traffic

These terms overlap, and the difference decides what you can claim.

Google's Invalid clicks column counts only what Google caught. Click fraud that gets past Google never appears there, which is why the checks later in this guide look at your own data too. Our guide to invalid traffic covers the industry definitions in depth.

Is Click Fraud Illegal?

It can be. US prosecutors have charged click fraud schemes as wire fraud, and Google treats deliberate clicking as invalid activity either way.

In the best-known US case, a group of defendants infected more than four million computers in over 100 countries with malware that hijacked clicks on search results and ads, sending people to sites that paid the group per click. The Justice Department called it click fraud. Vladimir Tsastsin and his co-conspirators collected over $14 million in advertising fees, and in 2016 he was sentenced to 87 months in prison after pleading guilty to conspiracy to commit wire fraud and computer intrusion (US Department of Justice).

A competitor clicking your ads by hand is a smaller and murkier matter. Whether it's a crime depends on the facts and where you are, so treat it as a question for a lawyer. For your ad account it makes no difference: Google counts those clicks as invalid activity and doesn't charge you for the ones it catches.

How Much Does Click Fraud Cost on Google Ads?

Each bot click Google misses is billed at your full cost per click, so the damage grows with your keywords. Bots also skew conversion rate and CPA.

No independent source publishes the share of Google Ads clicks that are fraudulent. Every widely quoted rate comes from a company selling click fraud protection, so treat those figures as marketing. What can be measured is the price of each click, and in some US categories it's high.

Cost per click is Google Ads keyword data for the US, via DataForSEO, September and October 2026. The 10 clicks a day is an assumption for the arithmetic, not a measured rate.

The pattern matters more than the totals. A running shoe store can absorb a few stray bot clicks. A law firm or an insurer pays more than $150 for each one, and a handful of uncaught clicks a day can empty a small daily budget.

The Costs That Don't Show on the Invoice

Bots also distort the numbers you make budget decisions with. What they can and can't do depends on your conversion goal.

• They lower your conversion rate and raise your CPA. Every bot session is a visit with no sale, so the campaign looks worse than it is, and you may cut one that works for real customers.
• They never buy. A bot can't complete a purchase, so it never appears in your purchase count and never takes credit for a sale.
• They can feed early-step goals. If a campaign optimizes for a page view, an add to cart or a form fill, a bot that runs your tags can fire that goal. Smart Bidding counts it as a result and bids toward more traffic like it. Lead generation teams see this as form spam.
• They can join remarketing lists. Bots that load your pages fire the tags that build those lists. Google says Smart Bidding can adjust bids "based on which remarketing list someone belongs to" (Google Ads Help), so a listed bot that comes back through an ad can get the bid set for that list. How often that happens isn't published.

How Does Google Handle Click Fraud?

Google filters invalid clicks automatically and with a manual review team. You don't pay for those it catches, and later finds come back as credits.

Google runs automated filters on its ad traffic, and an Ad Traffic Quality team investigates by hand (Google Ads Help). Google says it "catches most invalid traffic shortly after the ad interaction".

What happens next depends on timing:

• Caught before your billing cycle ends. The click is removed from your metrics and your bill. You never pay for it.
• Caught later. Google issues an invalid activity credit in a following billing cycle, "when appropriate and possible". It shows in your billing summary under Adjustments, labelled "Invalid activity".

Google also offers an Invalid Activity Credit Report that breaks credits down by campaign and network, with cost, clicks and cost per conversion recalculated after credits (Google Ads Help). It covers Search and Performance Max campaigns, and you'll find it in the template gallery of Report Editor.

What Google Doesn't Tell You

Three limits are worth knowing before you go looking:

• Google doesn't publish how much invalid traffic its filters miss.
• Google won't confirm whether specific clicks were judged valid or invalid.
• Google says it "cannot evaluate third-party reports", because it doesn't know their detection criteria, and that such tools might flag clicks it had already filtered and left off your bill.

That last point shapes how you build a claim, covered below.

How Do You Check for Click Fraud in Your Google Ads Account?

Add Google's invalid clicks columns, compare paid clicks with GA4 sessions, then check search terms, locations, placements and hours.

Start With What Google Already Caught

On the Campaigns page, open the columns menu and add Invalid clicks and Invalid click rate. They show the clicks Google classified as invalid and filtered out of your account (Google Ads Help). Search and Display campaigns can also show General invalid clicks, the part caught by routine filtering.

Read these columns the right way round. They count what Google removed, which you didn't pay for. A high rate tells you a campaign attracts invalid traffic, so it deserves a closer look. It doesn't tell you how much got through.

Compare Paid Clicks With GA4 Sessions

Take one campaign and one date range, and compare its clicks in Google Ads with its sessions in GA4.

Some gap is normal. People leave before the page loads, and visitors who decline analytics cookies may not appear in GA4 at all. A gap that suddenly widens on one campaign, with no change to your site or your consent banner, suggests some clicks never ran your tags. Simple bots that don't run scripts are one cause.

Build a GA4 Exploration for Paid Traffic

Bots that do run your tags show up in GA4 as paid sessions, because they carry the ad's click ID. Build a free form exploration filtered to the session source / medium "google / cpc". Put Country, then Device category, then Operating system in the rows, and add Sessions, Engagement rate and Key events.

You're looking for groups no customer makes: hundreds of sessions from one city, all on one device setup, with near-zero engagement and no key events. Then compare paid engagement with organic search on the same landing pages. Our guide to detecting bot traffic walks through this exploration step by step.

Check Search Terms, Locations, Placements and Hours

• Search terms. Review the queries that triggered your ads, and add the irrelevant ones as negative keywords, one of the protections Google itself lists.
• Locations. Go to Campaigns, Insights and reports, When and where your ads showed, then Matched locations (Google Ads Help). Look for clicks from places you don't serve. A cluster in Ashburn, Virginia, home to one of the largest concentrations of cloud servers in the US, may be servers rather than people. Paid clicks from China or Singapore in a campaign that doesn't target them deserve the same look, covered in our guide to bot traffic from China and Singapore.
• Placements. For Display and video campaigns, the "Where ads showed" tab in the same report lists the sites, apps and channels that carried your ads. Google notes that invalid traffic may not be removed from this report (Google Ads Help), so use it to find placements, not to count what you paid. Performance Max has its own placement report in Report Editor, and search partner sites appear in the Content suitability report for Search, Shopping and App campaigns.
• Hours. Look at clicks and conversions by hour of day. Clicks that keep arriving at hours when your customers never buy are worth a schedule change.

Want a directional read on how much of your paid traffic is real? Run the free GA4 check. Read-only, no signup required.

How Do You Report Click Fraud to Google and Claim a Credit?

Request an investigation through Google's Click Quality Form within 60 days, with dates, campaigns and server logs. Google decides any credit.

This is also how you file a complaint with Google Ads about fake clicks. Google accepts investigation requests for activity in the last 60 days, through the Click Quality Form (Google Ads Help).

What Google Asks For

Gather this before you open the form:

1. Your 10-digit Google Ads customer ID.
2. The exact date range of the suspicious activity.
3. The campaign and ad group names affected.
4. The keywords that drew the suspicious clicks.
5. Your web server logs for those clicks, with IP addresses, devices and platforms, and the GCLID of each click.
6. For fake leads, a list of the GCLIDs behind them.

The GCLID is the click ID Google adds to your landing page URL. It's what lets Google match a line in your logs to a click it billed.

How to Make the Claim Count

• Take out what Google already caught. Check the Invalid clicks column and your credits first. Google warns that outside tools might flag clicks it already filtered and left off your bill, and claiming those again adds nothing.
• Point to a pattern. A date range, a campaign, a location or a keyword where clicks rose and sales didn't.
• Use identifiers Google can check. Click IDs and log lines Google can match to its own records carry more weight than a verdict it can't evaluate.
• Stay inside the window. Google only investigates the last 60 days, so check every month rather than every quarter.

What Happens Next

Google says the review typically takes several business days, because specialists check the data by hand. You get an email with the findings, and if Google finds invalid traffic its filters missed, it tells you about any credit. The decision is Google's, and it won't confirm which individual clicks it judged invalid.

How Do You Protect Your Google Ads From Click Fraud?

Stack Google's own settings: IP and placement exclusions, the Presence option, a search partner opt-out, negative keywords and goals bots can't fake.

No single setting stops every bad click, and bots are built to get past any one rule. Layer these.

Exclude IP Addresses That Keep Coming Back

You can exclude up to 500 IP addresses per campaign, in the campaign's settings under Additional settings (Google Ads Help). Account-level IP exclusions, under Admin and Account settings, also reach Performance Max, Demand Gen, Search, Shopping, Display, Discover and YouTube campaigns. That matters for Performance Max, which doesn't take campaign-level IP exclusions.

Treat it as a patch. Bots rotate addresses, and Google notes that one IP address isn't always one device, so an office or a mobile network can share an address with real customers.

Use the Presence Location Option

Google offers two location options. "Presence or Interest", which Google recommends on Search, also reaches people elsewhere who've shown interest in your locations. "Presence" reaches only "People in or regularly in your targeted locations". When clicks come from outside your area, Google's own advice is to switch to Presence (Google Ads Help).

The trade-off is reach. A hotel or a moving company may want people searching from elsewhere. A local plumber usually doesn't.

Turn Off Search Partners Where They Don't Sell

Search campaigns can opt out of Google's search partner sites: in the campaign's Networks setting, uncheck "Include Google search partners" (Google Ads Help). Check partner performance first. If partner clicks convert, keep them.

Exclude Placements That Never Sell

Account-level placement exclusions apply to every campaign in the account, including Performance Max, and since March 2024 to the search partner network too (Google Ads Help). They live under Tools, Content suitability, Advanced settings. Add the sites and apps from your placement reports that send clicks and never sales. Our guide to brand safety covers the rest of the content suitability settings.

Add Negative Keywords and Schedule From Your Own Data

Add irrelevant search terms as negative keywords. If your hour-of-day report shows clicks at hours when you never sell, use an ad schedule to stop showing ads then. Base both on your own reports, not on general rules about when fraud happens.

Optimize for Goals Bots Can't Fake

Bots can fire a page view or a form fill. They can't complete a purchase. Bidding on purchases, or on qualified leads your sales team confirms, keeps bots from counting as results. For lead generation, Google's own advice includes reCAPTCHA on forms, double opt-in, server-side checks of submissions, and goals such as Qualified lead or Converted lead (Google Ads Help). Our CAPTCHA vs bot detection guide compares the form defenses.

This doesn't make bot clicks free. Target CPA and Target ROAS campaigns still pay for each click unless a campaign is set to pay for conversions, an option Google offers in Display campaigns (Google Ads Help). What changes is that bots stop steering the bidding.

Score Every Visit and Let Your Tags Act on It

A detection tool that runs on your landing pages can score each visit while it happens and pass the verdict to your tag manager. The click is already billed by then. What your own setup can do with the verdict is keep flagged visits out of page-view, add-to-cart and form-fill goals, and show which campaigns and placements send bots, so you can cut them. A record of which paid clicks were bots also supports a claim. For a comparison of tools built for paid media, see our roundup of click fraud software.

Cut the sources that send bot clicks and put that budget into campaigns that really sell. Hyperguard scores every visit while it happens, shows bot share by source and campaign, and keeps per-click evidence for a Google claim (Google decides any credit). Run the free GA4 check first, then see how Hyperguard works.

Can Bots Steer Smart Bidding and Performance Max?

Only through early-step goals. Smart Bidding learns from conversions and bots never buy, but they can fire page views, add to carts and form fills.

Smart Bidding uses Google AI "to optimize for conversions or conversion value in every auction" (Google Ads Help). So what bots can do to it depends on what you count as a conversion.

• Purchase goals. Bots send no purchases, so they give Smart Bidding nothing to learn from. You still pay for their clicks, and your CPA looks higher than it is.
• Early-step goals. A page view, a product view, an add to cart or a form fill can be fired by any bot that runs your tags. Smart Bidding counts each one as a result and bids for more traffic like it.
• Remarketing lists. Bots can join lists built from page views. Smart Bidding adjusts bids by list, so a listed bot that clicks again can get the bid set for that list.

Performance Max

Performance Max can show your ads across YouTube, Display, Search, Discover, Gmail and Maps, with search partners and the Display Network handled as separate tiers (Google Ads Help). It "may show ads to relevant audiences outside of your signals" (Google Ads Help). That reach is the point of the campaign type, and it also means more of your clicks come from places you didn't pick.

The same rule applies: a Performance Max campaign bidding on purchases gets no conversions from bots. To keep it that way:

• Optimize for purchases or qualified leads, not page views or form fills.
• Add account-level placement and IP exclusions, which Performance Max respects.
• Check the Performance Max placement report and the Invalid Activity Credit Report, which both cover it.
• Compare asset groups. One that draws far more clicks than sales deserves a look at where its traffic comes from.

Is It Click Fraud, or Clicks That Just Don't Convert?

It may be neither fraud nor bots. Broken tracking, broad targeting, consent choices and weak landing pages also produce paid clicks with no sales.

Before you file a claim or cut a campaign, rule out the ordinary causes. Each one looks like fraud in a report.

• Broken conversion tracking. A tag that stopped firing makes real sales vanish from Google Ads. Place a test order or submit a test lead yourself.
• Consent. Visitors who decline analytics cookies may not appear in GA4 at all, so clicks and sessions drift apart without any bots involved.
• Broad match and broad locations. Loose keywords and the Presence or Interest option bring in people who were never likely to buy.
• The landing page. A slow page, or one that doesn't match the ad, loses real people in the first seconds.
• Accidental clicks. Ads placed too close to buttons or content draw clicks nobody meant. Google counts them as invalid and filters the ones it catches.

If none of these explains it, and the clicks with no sales cluster in one campaign, location, placement or hour, treat it as invalid traffic and go back to the checks above.

What Should You Do First?

Add the invalid click columns, compare paid clicks with GA4, check locations and placements, file a claim within 60 days, then tighten your settings.

1. Add Invalid clicks and Invalid click rate to your Campaigns view, and open the Invalid Activity Credit Report.
2. Compare clicks with GA4 paid sessions for your three most expensive campaigns over the last 30 days.
3. Build the GA4 exploration on google / cpc, and note every group with near-zero engagement and no key events.
4. Check matched locations, "Where ads showed" and the hour-of-day report for clicks that never sell.
5. If you find a pattern, gather your server logs with GCLIDs and file through the Click Quality Form while the clicks are inside 60 days.
6. Add IP and placement exclusions, switch local campaigns to Presence, and review search partners.
7. Move bidding to purchases or qualified leads wherever bots are firing your goals.

Step 7 protects your bidding even when step 5 brings no credit. For the same checks on other platforms, see our guide to Facebook and Meta ad fraud, and for the wider set of defenses, ad fraud prevention.