What Is Ad Fraud? Types, Detection, and How to Prevent It (2026)

Ad fraud is any scheme that makes advertisers pay for activity that isn't real: impressions nobody saw, clicks with no interest behind them, installs that never happened, and leads that were never going to buy. Most guides are written for brands buying programmatic media at scale. If you run Google and Meta ads for a small or mid-size business, the fraud that costs you most is closer to home: junk clicks on your campaigns, and fake form fills that get counted as conversions and teach your bidding to buy more of the same.

GoodInbound Lead Screen catches the ad fraud that shows up after the click. It records the visits your ads send and screens every form fill before it reaches your CRM or your ad platforms:

• Ad visits recorded from Google, Meta, Microsoft, LinkedIn, and TikTok click IDs or paid UTMs, with repeat visits from one IP and reused click IDs flagged.
• Every submission labeled lead, review, spam, junk, or bot, with a one-line reason drawn from how the form was filled in, the network it came from, and the email and phone.
• Only accepted leads sent back as conversions to Meta, TikTok, and Google Ads, so bots and fake leads don't train your bidding.
• Works on the form you already have with one script tag, or through a hosted form, REST API, or MCP server.

The free plan screens 500 submissions a month with behavior, network, and identity checks; ad visit tracking and the message check are part of Pro at $29 a month. Start free, or read on.

This guide covers how ad fraud works, the main types and what each one costs you, what Google and Meta filter and credit on their own, how to audit your own campaigns, and how to prevent the rest.

What is ad fraud?

Ad fraud is faking ad activity on purpose to take money from advertisers. Somebody gets paid when the fake activity is counted: a publisher or ad network paid per impression or click, an affiliate paid per sale, a lead seller paid per lead. Sometimes nobody is paid and the point is to hurt you, like a competitor clicking your search ads until your daily budget runs out.

The industry's wider term is invalid traffic (IVT): any impression, click, or visit that doesn't come from a real person with real interest. Not all of it is fraud. Search engine crawlers, link previews, and accidental double taps are invalid but innocent. Google's definition of invalid clicks covers both kinds: accidental clicks, clicks from bots and deceptive software, and manual clicks meant to raise your costs or inflate a site owner's earnings.

The Media Rating Council, which sets measurement standards for the ad industry, splits invalid traffic into two groups:

• General invalid traffic (GIVT): known crawlers, data center traffic, and other activity that routine list checks catch. Ad platforms filter most of it before you're billed.
• Sophisticated invalid traffic (SIVT): bots built to look like people, hijacked devices, hidden ads, and fake or misrepresented sites. It takes deeper analysis to catch, and it's where most of the money is.

For an advertiser, a more useful line is this one: what the platforms catch and credit on their own, and what stays in your account and your data.

How ad fraud works

Every scheme attacks the way you pay:

• Paying per impression (CPM)? Fraud fakes views. Bots load pages, ads are hidden or stacked, and junk sites pose as premium ones.
• Paying per click (CPC)? Fraud fakes clicks, from bots, paid clickers, or competitors.
• Paying per conversion or per lead? Fraud fakes the outcome, or steals the credit for a real one.

The best-documented case shows how far this goes. Between 2014 and 2016, an operation known as Methbot rented more than 2,000 servers in commercial data centers and programmed them to act like people watching video ads. The bots faked mouse movement and scrolling, accepted cookies, and got past CAPTCHAs. They loaded real ads on blank pages while claiming to be on the sites of more than 6,000 publishers, The New York Times among them. The operator leased more than 765,000 IP addresses and falsely registered them to major US internet providers, so the traffic looked like it came from homes. Advertisers paid more than $7 million for ads no person saw, and the ringleader was sentenced to 10 years in prison in 2021, according to the US Department of Justice.

A related scheme, 3ve, ran through a botnet of more than 1.7 million malware-infected computers, loading ads in hidden browsers their owners never saw. It caused businesses to pay more than $29 million for ad views no human made (DOJ).

Two lessons carry over to a much smaller account. Fraudulent traffic is built to pass simple checks: it has a browser, moves a mouse, comes from a home-looking IP, and clears CAPTCHAs. And the people who pay are the advertisers at the end of the chain.

The main types of ad fraud

Bot traffic and botnets

Scripts and automated browsers that load pages and click ads. Cheap bots run from data centers and hosting providers. Better ones run through residential proxies or infected home computers, so the IP address looks like an ordinary household.

• Budget: you pay for the clicks and impressions they generate on Search, Display, and social.
• Data: sessions with no engagement, a falling conversion rate, and traffic from places you don't sell to. If the bots also fill in forms, your conversion count goes up instead.

Our bot traffic guide covers how to spot bots in your analytics.

Click farms and paid clickers

People paid small amounts to click ads, watch videos, install apps, or fill in forms. They pass every bot check because they are people.

• Budget: clicks, installs, and per-lead fees.
• Data: they scroll and engage, so in analytics they look better than bots. They show up as leads with real-looking details that go nowhere, often from cheap placements and countries outside your market.

Competitor and manual click fraud

Someone clicks your search ads to burn through your daily budget so your ads stop showing, or to raise your costs. Google counts these manual clicks as invalid. It matters most where clicks are expensive and budgets are small, because a few dozen clicks can be a whole day's spend. Lead Screen's click fraud protection flags the repeat visits this leaves behind.

Domain spoofing

Junk sites pass themselves off as premium publishers in programmatic auctions, so you pay premium prices for placements on sites you'd never choose. Methbot spoofed thousands of real publishers this way. The industry's main defense is ads.txt from the IAB Tech Lab: publishers post a public list of the companies authorized to sell their ad space, so buyers can check they're buying the real thing.

If you don't buy programmatic directly, spoofing reaches you through Display, Performance Max, Demand Gen, and Meta's Audience Network, wherever ads run on sites and apps outside the platform's own properties.

Ad stacking and pixel stuffing

Several ads layered in one slot with only the top one visible, or a full-size ad squeezed into a 1x1 pixel frame. Every hidden ad logs an impression.

• Budget: impressions on CPM campaigns.
• Data: reach and frequency nobody actually saw, and view-through conversions credited to ads that were never visible.

Attribution fraud

Stealing the credit for conversions that would have happened anyway. Cookie stuffing drops an affiliate cookie on visitors who never clicked anything. In mobile apps, click spamming and click injection fire fake clicks just before an install, so the fraudster's network collects the payout.

• Budget: commissions and per-install fees for customers you'd have gotten for free.
• Data: your attribution says a channel works when it doesn't, so you move budget toward it.

Fake leads and conversion fraud

The type most definition pages leave out, and the one that hits lead generation hardest. Our guide to fake leads covers it in full. Bots, form-filling scripts, lead farms, and AI agents complete your forms with disposable emails, someone else's real address, made-up phone numbers, and pasted text. Some come from bots that clicked your ad. Others are real clicks from people with no intention of buying: paid form fillers, freebie hunters, and sales reps pitching you through your own contact form.

• Budget: the click, your sales team's time, and the lead itself if you pay per lead.
• Data: this is the expensive part. Every fake fill your tag records is a conversion, and conversions are what automated bidding learns from.

Google's Smart Bidding uses the conversion data from your campaigns to predict which clicks will convert. Meta's lead and conversion campaigns work the same way, optimizing toward the event you report, such as Lead. Fake conversions tell both systems that the traffic which produced them is your best traffic. Bidding shifts budget toward the placements, audiences, and hours that send junk. Cost per lead drops on the dashboard, and pipeline drops with it.

AI agents and automated browsers

AI browsing agents and automation tools now operate a real browser: they scroll, click, and type. Some uses are legitimate, like a person asking an assistant to fill in a quote form for them. But the same tools can be pointed at your ads and forms at scale, and they pass any check that only looks at the browser's user agent. What gives them away is behavior: forms filled in seconds, pasted text with no typing, and visits from data center networks.

Ad fraud types at a glance

How ad fraud hits your budget and your data

Ad fraud costs you three times.

1. The fake click or impression. If the platform catches it, you aren't charged, or you get a credit later. If it doesn't, the money is gone.
2. The time spent on junk. Sales calls numbers that don't connect and emails addresses that bounce. Follow-up sequences go to disposable inboxes. Your CRM fills with records that skew every report built on it.
3. What your campaigns learn. Automated bidding optimizes toward whatever you report as a conversion. Report fake leads, and you've asked Google and Meta to find you more of them. This cost compounds, because it changes who sees your ads next month.

No refund covers the third one. A platform can credit you for an invalid click. It can't undo weeks of a campaign learning from fake conversions, and it can't know a lead was fake unless you tell it.

What Google and Meta do about ad fraud, and what they don't

Google Ads

Google has a dedicated Ad Traffic Quality team that uses automatic filters, machine learning, and human review to catch invalid activity. For advertisers, that works out as follows, per Google's help on managing invalid traffic:

• Invalid clicks are filtered automatically, and you aren't charged for them. To see how many, open Campaigns, click the Columns icon above the table, search for Invalid clicks, and apply it. These clicks were already removed from your bill.
• Invalid activity found after billing is credited "when appropriate and possible." Credits appear under Billing → Summary, in the Adjustments dropdown of the month card, labeled "Invalid activity." The Invalid Activity Credit Report in Report Editor shows credited clicks. Credits don't retroactively change your campaign data.
• You can ask for an investigation of activity from the last 60 days with Google's Click Quality Form. Investigations typically take several business days, and Google won't confirm whether specific clicks were judged valid or invalid.
• Conversions can stay after the click is removed. Google notes that a click can be marked invalid and removed while the conversion it led to stays in your reports, which is how an account can show more conversions than clicks. The credit fixes your bill, not your conversion data.
• Lead quality is left to you. On the same invalid traffic page, Google's advice includes protecting your forms with reCAPTCHA and server-side validation, considering double opt-in, setting up enhanced conversions, and targeting people located in your area rather than people interested in it.

Meta

• Most Meta ads are billed per impression. Meta's help on how it charges for ads says you're usually charged for impressions unless you chose otherwise when you created the ad. A junk click on an impression-billed ad isn't a separate charge you can get credited.
• Billed numbers can differ from Ads Manager. Meta notes that the clicks or impressions you see in Ads Manager may differ from the number you're charged for on your receipt. Receipts for any date range are under Billing & payments → Payment activity.
• There's no invalid clicks column and no IP exclusion list in Ads Manager like the ones Google offers. What you report back through the pixel and the Conversions API is your main lever on Meta. Our Facebook ad fraud guide covers Meta in detail.
• Instant Form leads stay inside Meta. Lead ads that use Meta's Instant Forms collect details without a visit to your website, so checks that run on your site never see them.

What neither platform covers

The platforms deal with the click. What the click produced is up to you.

Signs your campaigns are being hit by ad fraud

None of these proves fraud on its own. Two or three together are worth an afternoon of digging.

• Click-through rate jumps while conversions, or qualified leads, stay flat.
• Sessions from ads with almost no engagement: no scrolling, a few seconds on the page.
• Clicks or leads from countries and regions you don't target or sell to.
• One IP address arriving from your ads again and again, or the same click ID landing several times.
• Form fills seconds after landing, in bursts, or overnight in your time zone.
• Leads with disposable or gibberish email addresses, fake-looking phone numbers like 555 numbers, or a phone country that doesn't match where the visitor was.
• Search partners, Display, or Audience Network converting far better than your core campaigns while producing no sales.
• Cost per lead falling while your sales team says leads got worse. That's the signature of bidding learning from fake conversions.

How to audit your campaigns for ad fraud

This takes about half an hour and is worth repeating every month.

1. Line up four numbers per campaign for the last 30 days: ad clicks from the platform, landing page sessions from analytics, form submissions, and leads your sales team accepted. Some drop-off between each is normal. Look for campaigns where one step drops far more than it does elsewhere.
2. Expect clicks and sessions to differ. Google Analytics automatically excludes known bots, and you can't see how much it removed. Consent banners and ad blockers also hide sessions. So compare campaigns with each other: one whose sessions are a small fraction of its clicks, when the rest aren't, is the one to look at.
3. Split by network and placement. In Google Ads, use the Network (with search partners) segment to compare Google Search, search partners, and Display. Check placement reports for Display and Performance Max. In Meta Ads Manager, break results down by placement.
4. Read the leads themselves. Export your last 50 form fills from paid traffic. Count disposable, role, and gibberish email addresses, invalid or VoIP phone numbers, and duplicated messages. The free form spam checker, fake email checker, and phone number validator speed this up.
5. Look for repeats. In your server logs or ad visit data, find IPs with many ad visits in a short window and click IDs that land more than once. A Google click ID (gclid) arriving several times is a sign of a replayed or automated click.
6. Compare cost per lead with pipeline. If cost per lead improved over the same period that accepted leads fell, assume bidding is learning from junk and go to step 5 of the prevention list below.

How to prevent ad fraud

1. Tighten where your ads run

• Location: in Google Ads location options, target people in or regularly in your locations, rather than people searching for or interested in them. Google suggests this change on its invalid traffic page.
• Search partners: check the network segment first. If partners send clicks without leads, open the campaign's settings, expand Networks, and clear Include Google search partners (Google's steps).
• Display, Performance Max, and Demand Gen: review placement reports, exclude sites and apps that send clicks but no accepted leads, and tighten content suitability settings.
• Meta: compare results by placement, and cut placements whose leads never turn into sales.

2. Exclude repeat offenders by IP in Google Ads

Google Ads lets you exclude IP addresses:

• Per campaign: in the campaign's Settings, open Additional settings → IP exclusions. You can exclude up to 500 addresses per campaign, and use an asterisk in place of the last 3 digits to cover a block. Campaign-level exclusions aren't available for Performance Max, Smart Display, video, App, or hotel campaigns.
• Across the account: under Admin → Account settings → IP exclusions. Account-level exclusions apply to every campaign, Performance Max included, and merge with campaign-level lists.

Exclude carefully. Google points out that many devices can share one IP address through network address translation, as happens in an office or on a mobile network, so only exclude addresses with repeated ad visits and no real engagement. Lead Screen flags IPs with five or more ad visits within two hours and click IDs that land three or more times in a day. Its Exclude button copies the IP with the steps to add it in Google Ads. Nothing is excluded automatically, so a real customer never gets blocked behind your back.

3. Screen every form fill before it counts

Click filters judge the click. A form needs its own checks, because the fill is where fake leads become conversions:

• Behavior: how long the form took, whether anyone typed, signs of automation, and pasted text.
• Network: data center and hosting networks, VPNs, repeat submissions from one IP, and countries you've blocked.
• Identity: invalid, disposable, role, and gibberish emails, domains with no mail server, invalid and fake-pattern phone numbers, VoIP and premium-rate numbers, and a phone country that doesn't match the visitor. Both checks are also available on their own as an email validation API and a phone validation API.
• The message: what the person actually wrote, which is the only way to catch sales pitches and junk written by real people or AI.

A CAPTCHA helps against simple bots, but it does nothing about paid form fillers or sales reps, and it adds friction for real leads. Our guides to contact form spam and stopping sales pitches go through each method and what it misses.

Label suspicious submissions instead of deleting them. A real lead caught by mistake should be one click away, not gone.

4. Send only real leads back as conversions

This is the step that stops fraud from compounding. If your conversion fires on "form submitted" or a thank-you page view, every bot and fake lead counts as a success. Move the conversion to the point where a lead has been screened and accepted.

Lead Screen sends only accepted leads back:

• Meta: through the Conversions API as a Lead event with hashed email and phone and the fbc and fbp values, deduplicated with your pixel by event ID.
• TikTok: through the Events API.
• Google Ads: through a goodinbound_lead event in Google Tag Manager that fires your conversion tag, or a webhook.

Behavior, network, and identity checks answer in under 500 ms, so screening doesn't hold up your form.

5. Repair your bidding after a burst of fake conversions

If junk was already counted, two Google Ads tools limit the damage:

• Data exclusions tell Smart Bidding to ignore a date range. Google built them for conversion tracking issues, meaning anything that makes reported conversions incorrect. Go to Tools → Adjustments, open the Exclusions tab, and add one. They work with conversion-based Smart Bidding on Search, Display, Shopping, and Performance Max, and Google says they aren't meant to be used often or for long periods.
• Conversion adjustments let you retract specific conversions by uploading them with a RETRACT adjustment. You need the order ID recorded with the conversion, or the gclid and conversion time. Adjustments can be made within 54 days, and within 7 days of the original conversion if you want automated bidding to pick them up.

6. If you buy programmatic or run affiliates

• Buy from sellers listed in each publisher's ads.txt file, and ask your agency or platform whether they enforce it.
• In affiliate programs, watch for conversions with no recorded visit, implausibly short or long times from click to sale, and partners whose customers would have found you anyway.

How to ask Google and Meta for credits

Credits cover invalid clicks, not sales time or bidding damage, but they're worth claiming when the evidence is clear.

Google Ads:

1. Check the Invalid clicks column and Billing → Summary → Adjustments first. The activity may already be filtered or credited.
2. Gather what Google's form asks for: your 10-digit customer ID, the exact date range, the campaign and ad group names, the suspicious keywords, and web server logs showing IP addresses, devices, and gclids.
3. Submit the Click Quality Form within 60 days of the activity.
4. Expect an email with the findings after several business days. Google won't say which individual clicks it judged invalid.

Meta:

1. Download receipts for the affected dates from Billing & payments → Payment activity.
2. Compare what you were charged with what Ads Manager shows for the same campaigns.
3. Contact Meta Business Support with the dates, campaigns, and evidence.

Lead Screen doesn't file claims for you. But the ad visits it records, with the IP address, click ID, and campaign for each one, are the kind of evidence these reviews ask for.

Ad fraud detection tools: which kind you need

Ad fraud tools fall into three groups, and each one judges a different moment.

• Click fraud tools watch the clicks on your search and display ads and manage IP exclusion lists for you. They suit high-cost search campaigns where competitor and bot clicks are the main leak. See how GoodInbound compares with ClickCease, CHEQ, and Anura.
• Ad verification vendors measure impression-level invalid traffic, viewability, and brand safety across programmatic buys. They're built for brands and agencies buying display and video at scale.
• Lead screening judges what the click produced: the form fill. It decides what reaches your CRM and what gets reported back to your ad platforms as a conversion.

For most small and mid-size advertisers running lead-generation campaigns on Google and Meta, the biggest leak is the third one, because it's the one that trains bidding. GoodInbound Lead Screen covers it, and also records ad visits and flags repeat clicks. Pro is $29 a month with 1,000 analyzed ad visits and 2,500 screened submissions included, and more ad visits start at $120 a month for 10,000. See pricing, or read how click fraud protection works.

FAQ

What does ad fraud mean?

Ad fraud means deliberately faking ad activity, such as impressions, clicks, installs, conversions, or leads, so that advertisers pay for something that isn't real. It's part of a wider category called invalid traffic, which also includes innocent activity like search engine crawlers and accidental clicks.

Is ad fraud illegal?

Large schemes have been prosecuted as crimes. The operator of Methbot was convicted of wire fraud and money laundering and sentenced to 10 years in prison in 2021. For smaller cases, such as a competitor clicking your ads, the practical route is the ad platform's invalid click process: Google filters and credits invalid clicks and lets you request an investigation within 60 days.

What is an example of advertising fraud?

Methbot is the best-known example: data center servers posing as people, watching video ads on spoofed copies of more than 6,000 publishers' sites, which cost advertisers more than $7 million. A smaller everyday example is a lead form that fills up with disposable emails and fake phone numbers from one ad campaign, each one counted as a conversion that steers the campaign toward more of the same traffic.

What's the difference between ad fraud and click fraud?

Click fraud is one type of ad fraud: fake or bad-faith clicks on pay-per-click ads. Ad fraud also covers fake impressions, spoofed sites, hidden ads, stolen attribution, and fake leads. See click fraud protection for the click side.

Does Google refund ad fraud?

Google doesn't charge for the invalid clicks it filters, and it credits invalid activity it finds after you were billed. Those credits appear as "Invalid activity" adjustments in your billing summary. It doesn't refund clicks it considers valid, sales time spent on fake leads, or the effect of fake conversions on your bidding.

What if I accidentally clicked on a suspicious ad?

An accidental click isn't fraud, and Google counts accidental clicks as invalid, so the advertiser usually isn't charged. If the ad itself looked like a scam, close the page without entering any details, don't download anything it offers, and report the ad to the platform that showed it.

How do I stop ad fraud on my lead forms?

Screen every submission for behavior, network, and identity signals before it reaches your CRM, label instead of deleting, and only send accepted leads back to your ad platforms as conversions. That way, fake leads don't cost you sales time or train your bidding.