Digital marketing has a grey area many business owners never see: artificial traffic, click fraud, forms filled in by bots and fake leads created to look like real results. At first glance the numbers go up. In reality the account gets dirty, budget is burned and decisions are taken on distorted data.
We have analysed promotional material offering traffic services from residential IPs, simulated browsing, automatic form filling, captcha bypassing and clicks on competitors' ads. We won't name the service: what matters here is explaining the method, the risk and how to protect yourself.
We'll say this for the sake of transparency too: some time ago I had to study and build a system of this kind, in a technical context where the goal was to understand how easy it is to simulate seemingly credible traffic and interactions. That is exactly why today, to balance the picture, I would rather explain the other side of the story to business owners: how to recognise these signals, how not to be fooled by reports, and how to defend campaigns, forms and budget.
The point is simple: if somebody promises traffic that is "indistinguishable from the real thing", forms filled in automatically or clicks on competitors' ads, they are not selling marketing. They are selling manipulation.
What fake traffic from residential IPs actually is
Fake traffic is not always the crude bot that arrives from a data centre and bounces in half a second. The more aggressive services promise visits from residential IPs, different browsers, different resolutions, different operating systems, mouse movements, scrolling, variable time on page and browsing paths built to look human.
The problem is that a visit can look plausible inside Analytics and still be useless or harmful. If it doesn't come from a real user intention, it generates no demand, does nothing for the brand and brings no revenue. It only produces noise.
When these services go as far as filling in forms, subscribing email addresses, pressing buttons or simulating calls to action, the damage grows: the CRM fills up with fake leads, the sales team wastes time, and campaigns start learning from the wrong signals.
Click fraud: when traffic is used to hit competitors
Some services don't stop at inflating a site's numbers. They promise to click competitors' Google Ads ads to consume their budget, push down their performance and make their campaigns more expensive.
That is not competition. It is advertising sabotage.
Google defines invalid traffic as interactions on ads that do not come from genuine user interest. The official documentation also covers manual clicks intended to increase someone else's advertising costs, automated clicks, bots, irregular patterns and impressions created to artificially alter CTR. You can read the official page here: Google Ads - invalid traffic.
Google has automated systems and dedicated teams that intercept a lot of invalid activity, but that doesn't mean a company can ignore the problem. If your sector is competitive and CPCs are high, you need to be able to read the signals.
Why fake traffic can look like a win
Artificial traffic is dangerous because it often shows the client exactly what they want to see:
- more visits in Analytics;
- more sessions on landing pages;
- more form submissions;
- more conversion events;
- rising charts in the reports;
- apparently improved authority or interest in the site.
But if those visits are not interested people, the numbers are worth nothing. Worse, they can degrade the quality of the work: automated campaigns learn from fake conversions, remarketing lists get contaminated, reports become harder to read, and the owner thinks they have a sales problem when in fact they have a traffic quality problem.
Fake leads: the hidden damage in your forms
Fake leads are even more insidious than clicks. A wasted click burns budget; a fake lead can burn time, trust and data.
When a form is filled in by artificial traffic, four things happen:
- the CRM records a contact that looks real;
- the sales team tries to call back or qualify a person who doesn't exist or isn't interested;
- Google Ads and GA4 may receive a low-quality conversion;
- campaigns start optimising towards other users similar to the ones that generated the false signal.
The result is a spiral: you pay for poor traffic, you get poor conversions, you optimise on poor conversions, and then you wonder why revenue doesn't follow the reports.
Signals that traffic isn't clean
There is no need to cry "bot" every time a campaign fails to convert. Google itself points out that click spikes or a low conversion rate can come from budget, keywords that are too generic, targeting, seasonality or weak landing pages. But some patterns deserve an audit.
The signals to check are:
- sudden traffic spikes with no proportional increase in sales or qualified leads;
- many form conversions with disposable email addresses, non-existent phone numbers or incoherent requests;
- sessions whose behaviour is too similar to one another;
- lots of clicks from geographic areas that don't match your targeting;
- repeated user agents or suspicious browser/device combinations;
- a high form conversion rate but a very low rate at sales qualification;
- Performance Max campaigns that increase leads but not orders or real customers;
- traffic growth visible in Analytics with no impact on revenue, phone calls or valid quotes.
How to protect Google Ads from click fraud and invalid traffic
The defence is not one magic setting. You need to bring together ad data, site logs, lead quality and technical checks.
A serious baseline includes:
- the "invalid clicks" columns in Google Ads, to monitor what Google has already filtered out;
- clean GCLID and conversion tracking, so every lead can be tied to the right click;
- server-side validation on forms, to reduce automated submissions and incoherent data;
- double opt-in or contact verification where the business model allows it;
- lead scoring in the CRM, separating submitted lead, valid lead, opportunity and sale;
- offline conversion imports, so Google learns from real customers rather than from mere form submissions;
- web log analysis on IPs, user agents, referrers, paths and browsing times;
- IP exclusions when the evidence is solid, bearing in mind that residential and shared IPs need to be handled with care;
- an investigation request to Google when you have concrete data on suspicious traffic.
Google also sets out which data to prepare for an investigation: customer ID, exact dates, campaigns involved, suspicious keywords, web logs, IPs, user agents, GCLIDs and an explanation of the anomalous trend. The documentation is on the same official page about invalid traffic in Google Ads.
How to defend forms against fake leads
A captcha on its own is not enough, especially when somebody is promising to get around it. The best protection comes from several layers:
- server-side field validation;
- checks on email domains and phone numbers;
- honeypot fields invisible to real users;
- reasonable limits on submission frequency;
- lightweight, privacy-compliant fingerprinting;
- anti-spam scores integrated into the CRM;
- a distinction between primary conversion and micro-conversion;
- sending only qualified leads to Google Ads, not every raw form.
That last point is crucial: if you send Google every single submission as a primary conversion, you are telling the algorithm that a false positive is a result worth chasing. And the algorithm, obediently, will go and find more of them.
Why buying fake traffic damages the buyer too
Some companies buy artificial traffic thinking it will improve authority, engagement or SEO signals. It is a dangerous shortcut.
Artificial traffic does not create customers, does not create trust and does not create demand. It can pollute Analytics, compromise A/B tests, distort UX metrics, corrupt remarketing and push budget into content or campaigns that only look like they work because they have been inflated.
In the worst case, an agency uses fake traffic to show the client that the work is going well: more visits, more events, more forms. But when you look at the final number, meaning sales, valid quotes and revenue, the growth simply isn't there.
What a serious web agency should do
A serious web agency does not sell artificial clicks on competitors and does not inflate reports with fake visits. A serious web agency works on:
- reliable tracking;
- Google Ads campaigns measured on real conversions;
- fast, coherent landing pages;
- a CRM connected to the campaigns;
- importing sales or qualified leads;
- anti-spam controls on forms;
- log analysis when the numbers don't add up;
- reports that distinguish traffic, leads, qualified leads and customers.
Marketing is not about making false things look true. It is about measuring true things properly.
To move from suspicion to data, our guide on logs, GCLID, IPs and user agents shows what to collect. It works well alongside the Google Ads eCommerce audit and, for B2B or service companies, the process for importing offline conversions and qualified leads.
Frequently asked questions
Is traffic from residential IPs always fraudulent?
No. Real users browse from residential IPs every day. The problem starts when a network of IPs is used to simulate visits, clicks, form fills or interactions with no genuine human interest behind them.
Does Google Ads refund fraudulent clicks?
Google filters many invalid clicks automatically and can apply adjustments or credits when it detects invalid activity. If you suspect traffic that hasn't been caught, you can request an investigation by providing concrete data.
How do I see invalid clicks in Google Ads?
You can add the "Invalid clicks" column to your campaign reports. That figure needs to be read alongside logs, GCLIDs, lead quality and the trend in real conversions.
If I get lots of leads but nobody answers, is it click fraud?
Not necessarily. It can come from the offer, the landing page, the targeting or your response times. But if the leads show repeated patterns, incoherent data, suspicious email addresses or come from anomalous sessions, an audit is needed.
Does a captcha block fake leads?
It helps, but it isn't enough. Better to use several layers: server-side validation, honeypots, rate limits, data checks, CRM scoring and sending only qualified conversions to Google Ads.
Can Performance Max campaigns get worse with fake leads?
Yes. If PMax receives low-quality forms as primary conversions, it can optimise towards users and placements that generate more forms of the same kind, not real customers.
Does it make sense to block suspicious IPs?
Yes, when you have solid evidence, but it should be done carefully. Many IPs are shared or dynamic, and the more sophisticated services use rotating residential IPs. IP exclusion is only one part of the defence.
What should an anti click fraud audit contain?
It should include Google Ads data, GA4, server logs, GCLIDs, user agents, geographic areas, CRM quality, offline conversions, session patterns and a comparison between leads generated and real customers.
Not sure about the quality of the traffic or the leads coming from your campaigns? We can analyse Google Ads, GA4, site logs, forms and CRM to work out whether you are paying for real traffic or artificial noise.