Click fraud on Google Ads: what is real and what to do.

What to check first

Before you pay for anything or accuse anyone, check your own account:

• Add the Invalid clicks column: go to Campaigns, click the Columns icon, search for Invalid clicks and apply it. It shows the clicks Google filtered, which you were not charged for.
• Open Billing, then Summary, and look under Adjustments in each month for credits labelled Invalid activity.
• Open the Locations report and look at matched locations, which shows where your ads appeared. Clicks from places you do not serve point at the location setting before they point at fraud.
• Open the campaign settings and check the location option and the Networks setting.
• Read the search terms report for the searches that brought the clicks.
• Compare clicks with real enquiries and calls for the same days, from your own records.

If the clicks still look wrong after all six, gather the evidence below and ask Google to investigate. You can do that for traffic in the past 60 days.

What Google counts as an invalid click

Google defines invalid traffic as clicks and interactions that do not represent genuine interest in your business. Its examples:

• Automated clicks from bots and other software.
• Accidental clicks, such as those caused by an ad placed where people tap it by mistake.
• Fraudulent placements, such as clickjacking, where a site tricks people into clicking.
• Intentional clicks from people with no real interest, including competitors trying to run up your costs, and clicks meant to inflate a website owner's earnings from ads.

So the competitor who clicks your ads is on Google's own list. Google's ad traffic quality team uses automated filters that scan traffic continuously, plus manual reviews and investigations, to catch it.

What happens to the clicks Google catches

Invalid clicks found before your billing cycle ends are removed from your costs, so you are never charged for them and there is nothing to refund. They still show in the Invalid clicks column, which is why that column exists. Google's own reading is that a rise in invalid clicks shows its filters protecting your budget.

Invalid clicks found after you were billed come back as a credit, as a billing adjustment for their value. You find these in Billing, under Summary, in the Adjustments of each month, labelled Invalid activity, and they appear on your invoices. The Invalid Activity Credit Report in Report Editor shows the adjusted clicks, cost and conversion rate.

One quirk: credits for past invalid activity appear on the invoice but do not change the old campaign data in your account. If a report from last month looks worse than the bill, that can be why.

Clicks that look like fraud and are not

Many patterns that look like fraud have a simpler cause. Check these before anything else:

• Clicks from far away. Google's default location option reaches people in, regularly in or who have shown interest in your target area. Someone in another city who searches for a plumber in your town counts. Switch to the option called Presence if you only want people who are in or regularly in the area.
• Clicks from search partners. Search campaigns include Google's search partner sites by default. You can untick Include Google search partners in the campaign's Networks setting.
• Clicks on loosely related searches. The search terms report may show searches such as jobs, courses or how to do it yourself. Add them as negative keywords.
• People comparing quotes. Someone who clicks three ads, reads each page and rings one business clicked your ad for real. Your page decides whether they ring you.
• Your own team. Staff, family and the person who built the website clicking the ads to check they are running. Search without clicking.
• A slow or broken page. Real people leave a page that will not load, and it looks like empty clicks in the report.

Each of these costs money and none of them is fraud. All of them are fixed in your own settings, for free.

Signs worth acting on

After the settings are right, these patterns deserve a closer look:

• Clicks jump suddenly while impressions and the number of searches stay the same.
• Many clicks from one small area, or at the same odd hour, with visits that end in seconds.
• The same handful of keywords taking most of the clicks, with no calls or enquiries from them.
• Clicks that rise each time your ads appear above one particular competitor, at hours when real customers are not searching.

Your website's server logs or analytics can show more than Google Ads does: the IP addresses, the devices and the Google click ID on each visit, which Google adds to every ad click when auto-tagging is on. Save them for the dates in question. They are what Google asks for if you request an investigation.

How to ask Google to investigate

Google takes investigation requests through its Click Quality Form, for traffic from the past 60 days. Its specialists review the traffic and email you the findings. Before you send it, collect:

• Your 10-digit Google Ads customer ID.
• The exact dates of the clicks you think were invalid.
• The campaign and ad group names, and the keywords that look wrong.
• Your server logs for those dates, with IP addresses, device details and click IDs.

Check the Invalid clicks column for the same dates first. Google points out that third-party tools may flag traffic it has already filtered, and you were not charged for that. A request about clicks Google already removed will find nothing to credit.

Write the request plainly: what you saw, when, and why it does not look like real customers. Do not name or accuse a competitor in public while you wait. If you are right, the evidence is what counts. If you are wrong, you have made an enemy for nothing.

Blocking IP addresses, and its limits

If you know the address a stream of bad clicks comes from, such as an office network, you can block it. Go to Campaigns, then Settings, select the campaign, open Additional settings and expand IP exclusions. Google allows up to 500 IP addresses per campaign, plus an account-level list that it merges with the campaign one. You can block a range by replacing the last part of the address with an asterisk.

IP exclusions are not available for every campaign type. Google says they are not available for video, hotel, App, Performance Max and Smart Display campaigns.

Know the limit before you rely on it. A phone on mobile data changes address easily, and many people can share one address, such as everyone in an office or on a cafe's Wi-Fi. Blocking addresses works against a fixed office. It does little against someone on a phone, and a wide block can shut out real customers.

When a click-fraud tool earns its fee

Click-fraud tools watch the visits from your ads, flag suspicious patterns and add IP exclusions to your campaigns for you. They charge a monthly fee, and what decides whether it pays is simple: the value of the invalid clicks it stops that Google would not have filtered or credited anyway.

That is the catch. The tool cannot see Google's own filtering, so part of what it reports as fraud may be clicks you were never charged for. Its main weapon, the IP exclusion, is capped at 500 addresses per campaign and weak against phones.

A tool can make sense for a large account in a fiercely contested local trade, such as emergency locksmiths or personal injury law firms, where you have evidence of repeated invalid clicks that Google did not credit. For a small business spending a modest amount on search ads, the settings in this guide, a weekly look at the search terms report and an investigation request when the evidence is clear will usually do more for less.

A weekly check that catches waste early

Fraud worries grow when nobody looks at the account for a month and then the bill arrives. A short check every week, on the same day, catches problems while they are small:

• Clicks, cost and invalid clicks for the week, next to last week's. A jump in one without the others is the thing to explain.
• The search terms report, sorted by cost. Add negative keywords for every search you would never want to pay for.
• Matched locations in the Locations report, for clicks from places you do not serve.
• Calls and enquiries from the ads in your own records, per campaign, so you judge clicks by what they brought.
• Any new credits under Adjustments in Billing.

Write the numbers in a sheet, one row per week. After a couple of months you will know what a normal week looks like for your account, and a strange one will stand out on its own. If nobody in the business has time for this, it is a sign the account needs a person to own it, whether that is you, a colleague or a paid manager. The weekly figures are also easy to send to one inbox automatically, as part of a weekly summary from your own automation.

A locksmith's suspicious week

A locksmith covering one city sees clicks double in a week with no extra calls, and suspects a rival. He works through the checks:

• The Invalid clicks column shows Google filtered a share of that week's clicks. He was not charged for them.
• Matched locations show clicks from cities hundreds of miles away. The location option was set to the default, so people searching about his city from elsewhere counted. He switches to Presence.
• The search terms report shows searches for locksmith training and lock-picking kits. He adds them as negative keywords.
• Search partners were on. He switches them off and watches the next two weeks.
• What is left is a burst of clicks between 2am and 3am from one part of the city, on days his ads appeared above one competitor. He saves his server logs for those nights and sends the Click Quality Form.

He did not buy a tool, did not ring the competitor and did not pause his ads. Most of the waste was in his settings, and the rest is now with Google. A trade business depends on its phone, so he also counts calls from the ads: see call tracking for a small business.

Mistakes when you suspect click fraud

• Paying for a tool before checking the location option, search partners and search terms.
• Blocking IP ranges so wide that real customers stop seeing the ads.
• Clicking a competitor's ads in revenge. It is invalid traffic too, and Google filters it.
• Judging the campaign on clicks instead of calls and enquiries.
• Pausing everything in a panic, then restarting with the same settings.
• Ignoring the credits on your invoices and counting those clicks as lost.
• Accusing a competitor publicly without evidence.

The best defence is knowing which clicks became customers. Save the click ID and the campaign with every enquiry, as how to track leads from Google Ads explains, and the fake clicks stop mattering as much because you can see the real ones. GGSites builds landing pages for ads that keep the click ID with each enquiry, and we do not run ad accounts, so we sell nothing that depends on your fear of fraud. If you are weighing Google's pay-per-lead option instead, see Local Services Ads or Google Ads, and for the cost of a page, our prices page.