How to Identify Fake Leads: 10 Signs and How to Filter Them (2026)
How to identify fake leads: the red flags in the form data, submission behavior, IP, and patterns across leads, and how to filter fakes before sales calls them.
To identify fake leads, check four things for each submission: the data (disposable emails, invalid or VoIP phone numbers, gibberish), how it was submitted (seconds after the page loaded, no scrolling or typing), where it came from (a data center IP, a location that doesn't match), and how it compares with your other leads (the same IP behind different names, bursts of near-identical submissions). One red flag is a reason to look closer; several together almost always mean a fake.
If you're checking leads by hand at volume, GoodInbound Lead Screen is a drop-in fix that does the checking for you. It screens how every visitor fills in your form and stops automated list bombing, spam, and non-buyers sending unsolicited pitches from cluttering your pipeline, with five layers of protection:
- Rules: domains you always accept or always block.
- Behavior: how the form was filled in: typing, pasting, fill time, automation tells, and a built-in honeypot.
- Network: data centers, VPNs, proxies, Tor, and bursts from one IP or device.
- Identity: whether the email has a working inbox and isn't disposable or gibberish, and whether the phone number is real.
- Message: the whole submission read for intent, so sales pitches, recruiters, and link offers are caught.
Every submission is classified into five types (lead, review, spam, junk, and bot), and only the real leads, based on your filters, are reported to your sales team and CRM. GoodInbound takes care of the entire flow end to end for you.
Use GoodInbound for free for up to 500 screened submissions a month.
What are fake leads and lead generation fraud?
A fake lead is a form submission with no real prospect behind it. Most come from bots that fill in forms automatically, often with names, emails, and phone numbers stolen from real people, which is why some fake leads look convincing. Others come from real people entering made-up details to get a download, from click farm workers paid per form, or from competitors wasting your time.
Lead generation fraud is producing fake leads for profit: affiliates and lead sellers inflating the leads they're paid for, bot operators making ad clicks look real, or someone claiming a promotion again and again. It concentrates where someone gets paid per click or per lead, especially paid search, paid social, and the Google Display Network.
Fake leads aren't the same as low-quality leads. A low-intent or unqualified lead is a real person who isn't ready or isn't a fit; they need qualifying, not filtering. A fake lead should never reach sales at all. Spam, like a sales pitch sent through your contact form, is a third kind: a real person, but not a lead. Our guide to spam leads covers how the three differ.
10 signs of a fake lead
1. It was submitted seconds after the page loaded
No one reads a form and types real details in two or three seconds. A submission that arrives almost instantly after the page loads, with no scrolling, pointer movement, or typing, is almost always automated. Pasting every field at once is another tell.
2. The email is disposable or undeliverable
Look for temporary inbox domains, addresses whose domain has no mail server (no MX record), random strings, and role addresses like info@ on a B2B demo form. A correctly formatted email isn't the same as a real inbox. Check one with our free fake email checker or disposable email checker.
3. The phone number is invalid, VoIP, or in the wrong country
Numbers with impossible area codes, repeated or sequential digits, prefixes used by temporary number services, and VoIP lines are common in fake leads. So is a phone number from a different country than the rest of the lead. Our phone number validator checks one number at a time.
4. The IP location doesn't match the lead
A lead claiming to be in Chicago, submitted from an IP in another country, deserves a second look, especially when you only target the US. People travel and use VPNs, so combine this with other signs before deciding.
5. It came from a data center, VPN, or proxy
Real buyers browse from home, office, and mobile networks. Submissions from hosting providers and cloud data centers are a strong bot signal. VPNs and proxies are weaker on their own but common in fraud.
6. Different names share one IP address or device
People don't fill in the same form over and over. Several leads with different names but the same IP address, subnet, or device are usually one source. Sophisticated bots rotate IPs, so also look for the same email or phone reused under new names.
7. The details are gibberish, sequential, or copied
Watch for keyboard mashes (asdf), the same character repeated, names like john.smith1, john.smith2, john.smith3, company names that don't exist, and the same message word for word from different senders ("I'm interested, please send more info").
8. Leads arrive at odd hours or in bursts
If your leads normally come in during business hours, dozens arriving overnight or within a few minutes, from scattered locations, point to automation. Time zones explain some of it, so pair timing with other signs.
9. There's no history behind the lead
A real prospect has usually visited a few pages, read pricing, or come back more than once before asking for a demo. A lead that appears from an unfamiliar referral site, with no prior visits, and fills in your highest-intent form straight away is more likely fake.
10. The person on the phone has never heard of you
When sales reaches someone who is confused or annoyed that you have their details, their identity was probably used by a bot or a fraudster. Besides wasting time, contacting people who never gave consent creates privacy and compliance risk.
Two campaign-level signs point to fake leads in bulk: lead volume rising without more sales, and ad spend rising without more qualified leads.
How to identify fake leads: check four layers
Checking only the form fields catches the crudest fakes. Checking four layers catches the rest:
| Layer | What to check | Red flags |
|---|---|---|
| Form data | Email domain has a mail server, phone prefix and line type, name and company make sense | Disposable domains, VoIP or invalid numbers, gibberish |
| Behavior | Time from page load to submit, scrolling, pointer movement, typing vs. pasting | Submitted in seconds, no interaction |
| Network | IP type (residential or data center), IP location vs. stated location | Data center or proxy IP, location mismatch |
| Patterns across leads | Shared IPs or devices, naming patterns, timing clusters | Many names from one IP, sequential names, bursts |
The first layer you can check from the CRM. The second and third need data collected on your landing page when the form is filled in, which is why checking after the fact is hard and checking at submit time works.
A honeypot and a timer you can add today
For a free first layer, add a hidden field that only bots fill in, and record how long the form took:
Treat any submission with website_url filled in, or a fill_ms under about 3,000, as a likely bot. Bots that run a real browser leave the honeypot empty and wait, so this only catches the simple ones.
Can CAPTCHA still catch modern bots?
Partly. reCAPTCHA and similar tools stop basic scripts, but AI-driven bots and CAPTCHA-solving services get past them, and people filling in fake details pass by definition. CAPTCHA also adds friction for the real leads you paid for. Use it as one layer if you need it, not as your only check. See why reCAPTCHA isn't stopping spam.
How to filter fake leads before they reach sales and your CRM
Spotting fake leads by hand doesn't scale past a few a day, and by the time sales has looked, the lead is already in the CRM and counted as a conversion. Filter at submit time instead.
With GoodInbound Lead Screen:
-
Add the script to every page with a form:
HTML1<script src="https://cdn.goodinbound.com/leadscreen.js" data-key="pk_live_your_key" async></script> -
Every submission gets a label with a reason, in under a second:
lead,review,spam,junk, orbot. -
Route by label. Leads go to sales, Slack, or your CRM. Bots can be blocked at the form. Spam and junk are kept out of the CRM but stay recoverable.
reviewwaits for a person. -
Store the label in your CRM. The script writes it into hidden fields (
gi_label,gi_reason) that HubSpot and other form tools can save on the contact. For Salesforce, real leads go on through Zapier, Make, or a webhook.
See the step-by-step setup for HubSpot spam form submissions and Salesforce Web-to-Lead spam, and how the main tools compare in fake lead detection software.
A triage routine for borderline leads
Some leads land in between: one red flag, everything else fine. Give sales a short routine instead of a guess:
- Business email, VoIP phone, normal behavior: contact by email first; many small businesses use VoIP.
- Disposable email, everything else normal: ask for a work email in a short reply before booking a call.
- Location mismatch only: check for a VPN or travel; don't discard on location alone.
- Two or more red flags: don't call. Mark it fake so it's excluded from your conversion data.
In Lead Screen, these are the submissions labeled review, each with the reason it was held.
Keep fake leads out of your ad platforms' data
Identifying a fake lead after it was reported to Google Ads or Meta is only half the fix. The conversion already taught their bidding to find more like it.
- Report only screened leads. Lead Screen sends accepted leads to the Meta Conversions API and TikTok Events API, and pushes a
goodinbound_leadevent to Google Tag Manager for your Google Ads tag. Fakes never become conversions. - Don't send fakes in Enhanced Conversions or offline imports. Filter your upload to leads your team accepted.
- Correct what's already been sent. Google Ads lets you retract or restate offline conversions you uploaded. Meta doesn't let you take back an event, so stopping fakes before they're sent matters more there.
Our guide to stopping fake leads from Facebook and Google ads covers the campaign side.
FAQ
What are fake leads?
Fake leads are form submissions with no real prospect behind them: bots filling in forms, often with stolen details, click farm workers paid per form, and people entering made-up information. They look like leads in your CRM but never turn into customers.
What are the top warning signs that a bot submitted a form?
A submission seconds after the page loaded with no scrolling or typing, a data center or proxy IP, a disposable or undeliverable email, an invalid or VoIP phone number, and the same IP or device behind several different names. GoodInbound Lead Screen checks all of these at submit time and labels bot submissions bot with the reason.
How do fake leads affect Google Ads and Meta?
When a fake lead fires your conversion pixel, Google Ads and Meta count it as a success and optimize toward more people like it, which buys more bot traffic. Report only screened leads as conversions, and keep fakes out of offline imports.
How can I stop fake leads from entering HubSpot or Salesforce?
Screen each submission before it creates a record. GoodInbound Lead Screen labels every form fill with one script tag, writes the label into a hidden HubSpot property your workflows can route on, and sends only real leads on to Salesforce through Zapier, Make, or a webhook.
Can CAPTCHA still catch modern form-filling bots?
Only the simpler ones. AI-driven bots and CAPTCHA-solving services get past it, and people entering fake details pass it. Checks on behavior, network, email, and phone catch what CAPTCHA misses, without adding friction for real leads.
Is there a free tool to check whether a lead is fake?
Yes. GoodInbound's free fake email checker and phone number validator check single leads. To check every lead automatically, GoodInbound Lead Screen is free for 500 screened submissions a month.
