Facebook Ad Fraud: How to Spot and Stop Bot Clicks on Meta Ads (2026)

For an advertiser, Facebook ad fraud means paying for clicks that no real person meant to make: bots, click farms, repeat clickers, and accidental taps inside third-party apps. Meta filters some of it and doesn't charge for clicks it judges invalid. It doesn't refund poor results, though, and unlike Google Ads it gives you no way to exclude an IP address. You control three things: where your ads run, what Meta optimizes for, and which conversions you report back.

GoodInbound Lead Screen shows which Meta ad clicks become real people, and reports only those back to Meta. It runs on your landing page and the forms on it:

• Every ad visit recorded: visits that land with Meta's fbclid or paid UTMs, by campaign, with the share that engaged, leads, and accepted leads.
• Repeat clicks flagged: IPs with 5 or more ad visits in 2 hours, and click IDs that land 3 or more times in a day.
• Every form fill labeled lead, review, spam, junk, or bot, with a one-line reason, from how the form was filled in, the network it came from, and the email and phone.
• Only accepted leads sent to Meta as Lead events through the Conversions API, so your campaigns learn from real people.

The free plan screens 500 submissions a month; ad visit tracking and the message check are part of Pro, at $29 a month. Start free, or read on for the checks you can run today.

This guide is about bot clicks and invalid traffic on Facebook and Instagram ads. If a fake ad scammed you as a shopper, there's a short section for you near the end.

What Facebook ad fraud looks like

Most invalid traffic on Meta ads falls into four groups:

1. Bots. Scripts and headless browsers that click ads, load your page, and sometimes fill in your form. They come from data centers, proxies, and VPNs, and they tend to arrive in bursts.
2. Click farms. People paid to click, scroll, and fill in forms, often on real phones. Their behavior looks human, but their networks and the details they type often don't.
3. Accidental taps. A tap on an ad squeezed next to the close button in a mobile game is still a click. Accidental taps are why Facebook added click filtering to Audience Network, the placement that shows your ads inside other companies' apps. Our guide to Meta Audience Network covers it in depth.
4. Repeat clicks. The same person or device clicking again and again: a curious visitor, a competitor, or a script replaying one click.

Meta's own definition of an invalid click covers most of this list. It includes repetitive or accidental clicks, and clicks made with fake accounts, bots, scrapers, or browser add-ons. The catch is that Meta can only skip charging for the clicks its systems catch, and a paid person on a real phone is hard for anyone to catch from the click alone.

For ad fraud beyond Meta, see our guide to ad fraud.

Not every bot is fraud

Some automated visits are harmless. Meta's own crawlers fetch pages: FacebookExternalHit builds link previews for pages shared on Meta's apps, and Meta-ExternalAds crawls for Meta's advertising products. Uptime monitors, SEO tools, and your own testing hit your landing page too. None of these are ad clicks you pay for, so filter them out of your analytics and focus on visits that arrive with an ad click ID.

Why bot clicks cost you twice

The first cost is obvious: you pay for the click, or for the impressions that led to it.

The second cost is bigger. Meta's delivery system bids for whatever result you choose. Pick Maximize number of link clicks, and Meta says it will show your ads to the people in your audience who are most likely to click. If bots and accidental tappers click more readily than buyers, that's who you get.

It gets worse when bots also fill in your form. If your pixel fires a Lead event on every thank-you page, Meta learns that those visitors convert and goes looking for more of them. A campaign can look healthy in Ads Manager, with cheap clicks and a steady cost per lead, while your sales team finds nobody worth calling.

So the goal isn't to catch every bad click. It's to make sure Meta never mistakes one for success.

How to tell bot clicks from real visitors

Ads Manager doesn't show you who clicked. To find bot traffic, compare what Meta reports with what happened on your site. These signals are listed roughly in order of effort.

Compare link clicks with landing page views

A link click counts when someone taps a link in your ad. A landing page view counts only when the destination then loads. Meta gives two reasons the numbers differ: the page didn't fully load, or the ad has other link destinations.

Add Link clicks, Landing page views, and Cost per landing page view to your columns, then use the Breakdown menu (between Columns and Reports) to split results by placement. A slow page hurts every placement about equally. A gap that's far wider in one placement than the rest points to accidental or automated clicks there. Our guide to landing page views vs. link clicks covers how to read the gap.

Look for visits that never engage

In Google Analytics 4, an engaged session is one that lasts more than 10 seconds, has a key event, or includes two or more page views. Bots and accidental tappers rarely manage any of the three.

Filter your reports to Meta traffic and compare engagement rate by campaign. Meta may add a campaign source of Facebook or Instagram and a medium of paid to ad links automatically. A campaign whose sessions are almost all unengaged, with average engagement time near zero, is buying taps that never became visits.

To see the placement behind each visit, add Meta's dynamic URL parameters in the ad's Tracking section, under URL parameters:

Meta fills in the placement with values like facebook_feed, instagram_stories, or audience_network_classic. There's also {{site_source_name}}, which returns fb, ig, an, msg, or th. Changing URL parameters on a live ad can send the ad set back into the learning phase, so add them when you next build or duplicate one.

Check where the clicks come from

Break your results down by country and compare with your targeting. Then look at your own analytics or server logs, which see the visitor's IP address and Meta doesn't share. Visits from countries you don't target, or from data center and hosting networks where no real customer browses, are a common sign of bots or proxies.

Look for repeat clicks

Ads Manager won't show you that one IP address arrived from your ads a dozen times this morning. Your server can. Two patterns matter:

• One IP, many ad visits in a short window, with no engagement.
• One click ID, many landings. Meta usually adds an fbclid to the URL when someone clicks an ad. A person might reload the page, but the same fbclid landing again and again points to a replayed or automated click.

Lead Screen's Paid traffic view flags both automatically: IPs with 5 or more ad visits in 2 hours, and click IDs that land 3 or more times in a day.

Read the form fills

Bots that get past the click often give themselves away on the form. Watch for forms filled in a couple of seconds, pasted text in every field, disposable or gibberish email addresses, fake phone patterns like 555 numbers, VoIP numbers, and a phone country that doesn't match the visitor's country. Run a suspicious address through the fake email checker or a number through the phone number validator to see what a check finds.

What Meta filters, and what it refunds

Meta's help center describes the two kinds of invalid clicks above, and says Meta caps how often one person sees an ad to reduce abuse. When it detects or is alerted to suspicious click activity, it runs a manual review. In Meta's words: "You will not be charged for clicks that are determined to be invalid." (source)

That is a non-charge, not a refund. Filtered clicks are left off your bill, which is why Meta notes that the clicks and impressions on a receipt may differ from what Ads Manager shows.

Audience Network got extra filtering in 2017, when Facebook said it would stop charging for clicks where the visitor left the landing page within two seconds, because those are almost always accidental. It called two seconds a starting point. (TechCrunch)

Refunds are a separate matter. Meta's refund policy says decisions are made case by case, at Meta's sole discretion, and that it doesn't give refunds for poor ad performance or return on investment. The examples it lists are mostly system bugs, such as overspend from a wrong bid or an exceeded budget.

In practice:

• Clicks Meta catches cost you nothing, and you won't see them listed anywhere.
• Clicks Meta misses are billed. You can report them through Meta Business Support, or request a refund from the Get help link at the bottom of your Payment settings page. There's no promise of a credit, so bring evidence: dates, campaigns, placements, the gap between link clicks and landing page views, and what your own logs show.
• Junk traffic delivered exactly as you asked, such as cheap link clicks from a placement you left on, counts as performance. That's yours to fix in your settings.

Meta has no IP exclusions

Google Ads lets you exclude up to 500 IP addresses per campaign. Meta has no equivalent. Its exclusions work on people and places:

• Custom audiences, including an exclusion-only customer list matched on email addresses and phone numbers.
• Locations in each ad set's targeting.
• Account controls in Advertising settings, which can limit every campaign to certain countries, a minimum age, and certain placements.

So even when you've found an IP that clicked your ads dozens of times, there's nowhere in Ads Manager to put it.

Some click-fraud tools work around this by attaching an "invalid traffic" custom audience to your ad sets as an exclusion. That only covers visitors Meta can match to an account, and it doesn't recover what you've already spent. The levers that work at scale are the three below.

Fix 1: Decide where your ads run

Meta recommends Advantage+ placements, since more placements give the system more room to find your result. But if your result is a click, cheap accidental clicks count as success. If Audience Network shows the pattern above, a wide click-to-view gap and visitors who don't engage, turn it off.

For the Awareness, Traffic, or Engagement objectives (Meta's steps):

1. In the ad set's Placements section, hover over Advantage+ placements, click Edit, and select Manual placements.
2. Under Placements, uncheck Audience Network native, banner and interstitial and Audience Network rewarded videos.
3. Untick Allow limited spend to excluded placements. Left on, it lets Meta spend up to 5% of your budget on each excluded placement when it expects better performance.

For the Leads or Sales objectives, click Show more settings in the Placements section, edit Placement controls, uncheck the same placements, and untick the same limited-spend option. Excluding any placement turns Advantage+ placements off for that ad set.

To exclude a placement from every campaign at once, use account controls. Go to Advertising settings → Placement controls, turn on My business can only advertise on specific placements, and uncheck Audience Network. This applies even when a campaign uses Advantage+ placements. Changes to existing campaigns can take up to 48 hours, and Meta is still rolling the feature out, so you may not have it yet.

If you'd rather keep Audience Network, use delivery reports to see which apps your ads appeared in, and add the bad ones to a publisher block list in the Brand Safety and Suitability Center.

Fix 2: Optimize for something bots can't fake cheaply

Your performance goal tells Meta who to find. From weakest to strongest:

1. Maximize number of link clicks: people most likely to tap. Easy for bots and accidental tappers to satisfy.
2. Maximize number of landing page views: people most likely to view the website. The page has to load, which filters out the taps that bounce before it does.
3. Maximize number of conversions: people most likely to take an action on your website, such as submitting your form.

Each step up costs more per result. Meta suggests a daily budget of at least 10 times the average cost of your chosen goal, so a conversion goal needs a bigger budget than a click goal.

A conversion goal is only as good as the event behind it. If your Lead event fires on every form submission, a bot that fills in your form is a conversion, and Meta will optimize toward more bots. That leads to the most important fix.

Fix 3: Send Meta only the leads that are real

Most setups fire a Lead event from the pixel the moment a thank-you page loads, for every submission, real or not. To stop that from training your campaigns:

1. Screen each submission first. Decide whether it's a real lead before anything is reported.
2. Send the Lead event from your server through the Conversions API, only for submissions you accept. Include the fbc value, built from the visit's fbclid in the form fb.1.<timestamp>.<fbclid>, and the fbp cookie, so Meta can tie the lead to the right ad click (Meta's spec).
3. Don't let another tag count everything. If the pixel also sends Lead, it should fire only for the same accepted leads, with the same event name and event ID. Meta deduplicates pixel and server events with a matching ID received within 48 hours.

Lead Screen does all three without custom code. It labels every submission from behavior (fill time, typing, automation, pasted text), network (data center networks, VPNs, repeat submissions from one IP, blocked countries), and identity (the email and the phone, including VoIP numbers and a phone country that doesn't match the visitor), in under 500 ms. On Pro, it also reads the message for sales pitches and junk. Only accepted leads go to Meta as Lead events with hashed email and phone, fbc and fbp, deduplicated with your pixel by event ID. The same leads can go to TikTok, and to Google Ads through a goodinbound_lead event in Google Tag Manager.

Fake leads submitted through Meta's own Instant Forms never touch your website, so they're a separate problem with their own fixes, covered in our guide to fake leads from Facebook ads.

Meta's controls, click-fraud tools, and lead screening compared

Each layer covers a different part of the problem.

The first two are free and worth doing first. If you're weighing tools for the rest, see how Lead Screen's click fraud protection compares with ClickCease, CHEQ, and Anura.

A weekly Meta ad fraud check

Fifteen minutes a week catches most problems early:

1. In Ads Manager, compare link clicks with landing page views by placement and by country.
2. In your analytics, compare the engagement rate of Meta traffic by campaign and placement.
3. On your server or in Lead Screen, look for IPs and click IDs that land again and again.
4. In your leads, count how many of last week's Meta leads were real, and compare with the conversions Meta reported. Then cut the placement, raise the goal, or fix what you report back.

If a Facebook ad scammed you

This guide is for advertisers. If you bought something from a fake ad, or entered card details on a page an ad led you to, report the ad from its own menu. Facebook's help center says the Report link next to the content is the best way to flag it. Then call your bank or card issuer about the charge.

FAQ

Does Meta refund bot clicks on Facebook ads?

Meta doesn't charge for clicks it determines are invalid, so those never reach your bill. Clicks it missed are billed, and refunds are case by case, with poor ad performance excluded. You can request one from the Get help link in Payment settings, with evidence from your own logs.

Can you block IP addresses from Facebook ads?

No. Meta Ads Manager has no IP exclusion setting. You can exclude custom audiences, locations, and placements, but not IP addresses.

Is Meta Audience Network mostly bots?

Not necessarily, but it's the placement to check first. Your ads run inside other companies' apps, where taps are easy to make by accident. Compare its link clicks, landing page views, and engagement with your other placements before deciding. Our Meta Audience Network guide goes further.

Do Instagram ads get bot traffic too?

Yes. Instagram placements run on the same ad system as Facebook, and bots can click any link. Add {{site_source_name}} or {{placement}} to your URL parameters to compare Instagram and Facebook visits on your own site.

How much of web traffic is bots?

Imperva's 2025 Bad Bot Report found that automated traffic made up 51% of all web traffic in 2024, and that malicious bots accounted for 37% of all internet traffic. (Imperva) Your own share depends on your site and how your ads are set up.

Why is there a FACEBK* charge on my bank statement?

Meta ad charges appear as "FACEBK*" or "FACEBOOK INC." followed by a 10-character reference number. If you run ads, search for that number under Billing & payments → Payment activity in Ads Manager to find the receipt (Meta's steps). If you don't run ads, contact your bank.

How do I dispute a Facebook ad charge?

Meta's guide to unrecognized activity suggests checking the receipt and billing reason under Payment activity, your budgets, and who else has access to the ad account. If you still don't recognize the charge, or think the account was hacked, contact Meta Business Support. For refunds, use the Get help link in Payment settings.