Fake Leads, Bots, and Click Fraud: The Advertiser's Defence Guide

Every pound you spend on paid search, social, display, or affiliate marketing is a bet that a real, interested human will see your ad and engage. That bet is under sustained attack from a shadow economy built to intercept marketing budgets before they ever reach a genuine prospect.

The numbers are not marginal. Juniper Research projects global advertising spend lost to fraud will rise from around $84 billion in 2023 to $172 billion by 2028. In 2024, automated traffic surpassed human traffic on the web for the first time, reaching 51% of all traffic, with bad bots accounting for 37% (Imperva 2025 Bad Bot Report). Closer to home, a 2025 PPC Shield study of 15,000 UK ad accounts estimated UK businesses lost around £186 million to PPC click fraud in a single year, with small businesses spending under £5,000 a month losing roughly 27% of their budget.

The damage goes well beyond wasted spend. Fake conversions corrupt the data your Smart Bidding relies on, so your algorithms optimise toward the very traffic that is robbing you. Remarketing lists fill with bots. And your sales team burns out chasing people who never asked to be contacted.

Lead fraud is not random vandalism. It is a rational, profit-driven enterprise that exploits the same pay-per-click and pay-per-lead models that make digital advertising powerful. The main attack vectors:

• Bot-driven click fraud. Automated scripts, increasingly routed through residential proxy networks, click your ads to drain budget or inflate a publisher's revenue. Modern bots mimic human behaviour well enough to slip past basic filters.
• Fake form fills. Form-filling bots use real consumer data from breaches to pass validation, submit during business hours, and even simulate interest, dropping toxic leads straight into your CRM.
• Human fraud farms. Low-paid workers click ads and fill forms by hand, defeating behavioural bot detection because the behaviour is genuinely human.
• Consent farms and affiliate fraud. Deceptive sites harvest data under false pretences and sell it as "real-time" leads, while the pay-per-lead model rewards volume over quality.

For a deeper look at the placement and network side of this, see our definitive GDN exclusion list and the data in our click fraud statistics report.

Methbot. Russian national Aleksandr Zhukov, who called himself the "King of Fraud," ran a purpose-built ad fraud operation that at its 2016 peak generated an estimated $3 to $5 million per day. The US Department of Justice said the scheme stole more than $7 million; Zhukov was sentenced to 10 years in prison in 2021.

Vastflux. Uncovered by HUMAN Security in 2022, this mobile ad fraud operation stacked hidden video ads in real apps and at its peak generated more than 12 billion fake ad requests per day before being shut down.

Response Tree LLC. In January 2024 the US Federal Trade Commission acted against a lead generator that ran more than 50 deceptive websites posing as quote services. The operators were banned from telemarketing for life under a $7 million suspended judgment. The leads they sold fuelled illegal robocalls for products consumers never asked about.

Audit your account against these signals:

• High clicks with zero conversions for three or more days running.
• Very high CTR paired with sub-five-second session durations.
• Form fills with gibberish names, disposable emails, or identical phone patterns.
• Sales reporting that contacts "never enquired" or cannot be reached.
• Traffic spikes between midnight and 6am, or from regions you do not serve.
• Lead volume jumping with no change in budget, especially from Performance Max or Search Partners.

If several of these ring true, the single most useful next step is to quantify the problem before you change anything. Our free wasted spend analysis does exactly that.

1. Clean your traffic sources

Turn off Search Partners and Display Expansion for lead-gen campaigns, where fraud rates run highest. Audit Performance Max and re-scope it rather than letting it roam cheap inventory. Tighten match types, add negatives, and exclude geographies and off-hours that drive clicks but no genuine leads.

2. Harden your forms

Add a honeypot field (hidden from humans, filled by bots), record submission timing and reject implausibly fast fills, and use an invisible challenge such as reCAPTCHA v3 or Cloudflare Turnstile. Validate email and phone in real time so fabricated contact details never reach your CRM. Ask one context question a genuine prospect can answer but a bot cannot.

3. Optimise on validated conversions only

This is the step most advertisers miss. Tag every lead in your CRM as valid or spam, then feed only validated conversions back to Google via enhanced conversions for leads or offline conversion import. Optimising on fake conversions is worse than no optimisation at all, because it actively trains the algorithm to find more junk.

4. Hold vendors accountable

If you buy leads, shift from flat per-lead pricing to quality-adjusted contracts with clawbacks for disconnected numbers and denied enquiries. Demand traffic-source transparency and a return window. Any vendor who will not say where their traffic comes from is a fraud risk.

This is not theory for us. On our own lead forms we deployed Cloudflare Turnstile alongside gibberish-name detection, and in the process identified and cleaned 62 bot and spam submissions that would otherwise have entered our pipeline as "conversions." Across the accounts we manage, the pattern is consistent: the budget recovered from cutting invalid traffic is almost always larger than clients expect, and the conversion data gets dramatically more trustworthy once the junk is gone.

Fake leads are not only a budget problem. Under the US Telephone Consumer Protection Act (TCPA), the liability for calling a consumer who never genuinely consented sits with the business making the call, not the lead seller. Penalties run from $500 per violation up to $1,500 for willful violations, and class settlements regularly reach the millions.

One important clarification, because a lot of 2025 content gets this wrong: the FCC's "one-to-one consent" rule was vacated by the Eleventh Circuit in January 2025 and subsequently repealed, so it is not in force. The underlying consent obligations under the TCPA remain very much alive, which is exactly why documenting genuine consent and scrubbing fake leads matters.

• How to stop spam and fake leads from Google Ads the practical, step-by-step fixes.
• Performance Max fake leads why PMax is the most exposed channel, and how to audit it.
• Is a competitor click-bombing you? detect and stop targeted click attacks.
• The hidden legal risk of fake leads TCPA compliance for advertisers.