Flight log / Transmission 058

Click fraud and invalid clicks: what Google catches and what you should check

Every paid search account has a ghost story about a competitor clicking their ads all night. Google's own help page says there is no industry standard invalid traffic rate, and it lets you block just 500 IP addresses per campaign, so the real defense is knowing where to look.

Click fraud is the term advertisers search for. Invalid clicks is the term Google uses, and the difference matters. "Fraud" implies someone meant to cost you money. "Invalid" covers that plus bots that never meant anything, accidental taps on badly placed ads, and anything else that doesn't represent genuine interest. Google filters most of it before you're billed. The part worth your time is the slice that gets through, and the slice that's technically valid but still useless.

This guide covers what Google counts as invalid, how it detects and credits it, where to see it in your account, the checks worth running yourself, what IP exclusions can and can't do, and how to file a click quality request that gets taken seriously.

What is click fraud, and what does Google count as an invalid click?

Google Ads Help defines invalid clicks as clicks on your ads that don't represent a genuine interest in your business, and groups them into three kinds: accidental clicks caused by poor ad placement, automated traffic from tools, bots or other deceptive software, and manual clicks meant to increase your costs or inflate publisher profits.

Google's Managing invalid traffic page adds detail, and says its list isn't exhaustive:

• Non-human traffic: bots and automated software that mimic browsing.
• Accidental clicks: for example, ads placed too close to navigation buttons.
• Fraudulent placements: clickjacking (tricking users into clicking an ad they can't see) and ad stacking (layering ads so only the top one is visible).
• Other invalid activity: competitors clicking your ads to raise your spend, publishers paying people to click, or invalid impressions meant to lower your CTR.

Notice where most of those happen. Placements, publishers and stacked ads are network problems, not problems on a Google results page. That's a clue about where to look first.

How does Google detect invalid clicks?

Per Google, its ad traffic quality team uses automated filters, machine learning and manual reviews. Much invalid traffic is caught as it happens or shortly after, and Google also analyzes traffic over longer periods to find more complex patterns. The Media Rating Council accredits Google's invalid traffic defenses for specific services and metrics, and an independent third party audits the processes annually.

Google also says something vendors in this space rarely repeat: there is no industry standard invalid traffic rate. Any headline number you've seen for "the" click fraud rate is someone's sample, not a law of nature.

To see what Google filtered in your account, add the Invalid clicks column: Campaigns, the Columns icon, search for "Invalid clicks," then Apply. Google frames a rising count as its defenses catching more invalid clicks before you're billed. Those clicks are filtered out of your campaign metrics and removed from billing, so your Clicks column already excludes them.

Here's what a suspicious stretch looks like in a hypothetical account, with filtered invalid clicks next to billed clicks.

In this illustrative example, Google filters dozens of extra clicks a day during the spike, which is the system working. But billed clicks still more than double, from about 44 a day to 96 to 118, while leads stay at 1 to 3. On a budget-limited campaign that means the spike eats the day's budget before real buyers search. That pattern, a big rise in clicks without more conversions, is exactly the evidence Google asks for when you request an investigation.

Does Google refund invalid clicks?

Yes, as a credit, when it finds them after billing. Google Ads Help lays it out in two paths:

• Caught before the billing cycle closes: removed from billing and campaign metrics. No refund needed because you were never charged.
• Found after billing: credited as an "Invalid activity" adjustment where appropriate and possible, typically in the next billing cycle. You'll find it under Billing, Summary, in the Adjustments dropdown on the month card, and on the month-end invoice.

Credits don't retroactively change campaign metrics. So a campaign can show a CPA in its report that's higher than what you actually paid. For corrected numbers, Google offers the Invalid Activity Credit Report in Report Editor (template "Invalid Activity Credit Report: Search & PMax"), which shows credited clicks and amounts plus adjusted cost, clicks, CTR, average CPC, conversion rate and cost per conversion, by campaign and network. It covers Search and Performance Max only. Search Engine Land covered the help documentation for that report when Google published it.

Two side effects worth knowing. Google removes conversions from invalid traffic. And when a click that led to a valid conversion is later marked invalid, the click is removed but the conversion stays, so Google warns your reports might show more conversions than clicks.

What should you check yourself?

Google's filters look for invalid traffic. They don't look for traffic that's valid but worthless to you: real people from the wrong country, real visitors on placements your buyers never see, real competitors researching your pricing. Those are targeting problems, and they're yours to catch. Start with network, because that's where the gap usually lives. Here's an illustrative comparison in a hypothetical account.

In this hypothetical account, search partners convert clicks to leads at about a third of Google Search's rate, and almost none of those leads qualify. That's not proof of fraud. It's a reason to segment by network every month and decide whether the cheaper clicks are worth it. If a recommendation offers to expand you into search partners or Display, our optimization score guide covers when to say no.

The rest of the checklist:

The search term line deserves its own habit; our guide to the search term report covers it. And if you're adding up what all of this costs, wasted ad spend is the wider audit.

Do IP exclusions stop click fraud?

A little. Google lets you exclude up to 500 IP addresses per campaign. You can enter specific addresses or use an asterisk in place of the last part of an address to cover a block. Campaign-level IP exclusions aren't supported for Video, Hotel, App, Performance Max or Smart Display campaigns, but account-level exclusions, set under Admin, Account settings, IP exclusions, apply across all campaigns in the account, including Performance Max, Demand Gen, Search, Shopping, Display and YouTube. If both levels exist, Google merges them. Google's page doesn't state a separate limit for the account-level list.

Where IP exclusions work: a known office, a known competitor's office, a known agency, your own team. Where they don't: most bots and many people browse from mobile networks and shared or changing addresses, so a list of IPs from last week can describe nobody this week. In most B2B accounts, IP exclusions are a scalpel for a few known sources, not a wall.

The stronger controls are the boring ones: the location option set to "Presence," network settings chosen on purpose, tight negatives, and bidding on conversions that reflect real pipeline so automated bidding learns to avoid the junk.

How do you report invalid clicks to Google?

Use Google's Click Quality Form. You can request an investigation of activity from the last 60 days. Google asks for:

1. Your 10-digit Customer ID.
2. The exact date range, plus campaign and ad group names.
3. The keywords that look suspicious.
4. Web server logs: IP addresses, platforms and devices, and GCLIDs.
5. For invalid leads, a spreadsheet of GCLIDs with your assessment of each lead.
6. A plain description of the trend, in Google's own example "a 300% spike in clicks without more conversions."

Google says reviews typically take several business days and you'll get an email with findings. It also says investigations won't confirm whether specific clicks were valid or invalid. Expect a verdict on the pattern and possibly a credit, not a click-by-click audit.

The GCLID detail is the practical one. If your forms capture the GCLID into your CRM, you can hand Google a clean list of junk leads tied to specific clicks. If they don't, start capturing it; it pays off in form and attribution work too.

What we don't know

• The real rate in your account. Google says there's no industry standard, and you only see what Google filtered, not what it missed.
• Exactly how credits are decided. Google credits "where appropriate and possible" and doesn't publish the rules.
• Competitor clicks at low volume. A competitor clicking 3 times a week looks like any other visitor. It's annoying and usually smaller than the money lost to broad queries and wrong networks.
• Lead spam vs. click fraud. A bot that fills your form is a landing page problem. Validation and hidden honeypot fields on the form handle much of it; Google's filters may not.

FAQ