Click Fraud Detection: How to Recognize and Evidence Suspicious Clicks

Click fraud detection is the work of spotting paid clicks that were not made by people with a genuine interest in your business, and then gathering enough evidence to tell deliberate abuse apart from ordinary noise. In practice it means comparing current traffic with a reliable baseline, ruling out innocent explanations first, and documenting whatever remains so that Google can review it.

That order matters. Most sudden changes in clicks have mundane causes, such as a settings change, a competitor pausing its ads or a broken tracking tag. This guide covers how click fraud differs from invalid clicks, which suspicious click indicators are worth checking, how to build baselines, where analysis runs out of road, and how to turn a suspicion into a documented case, ending with an illustrative worked example.

Click fraud and invalid clicks are not the same thing

Google uses the broader term. Its help center defines invalid clicks as clicks on your ads that don’t represent a genuine interest in your business, and gives three kinds of examples: accidental clicks caused by poor ad placement; clicks from automated tools, bots or other deceptive software; and manual clicks that increase your ad costs or inflate publisher profits.

Click fraud is the deliberate part of that set: someone clicks, or makes software click, with the intent of costing you money or earning money for themselves. An accidental tap on a phone screen is invalid but not fraudulent. The distinction matters for detection because intent is invisible in data. What you can observe is a pattern, and any pattern can have several causes. For a closer look at who commits deliberate abuse on Google’s network and why, see our guide to click fraud on Google Ads.

The measurement industry draws a related line. When the Media Rating Council (MRC) finalized its invalid traffic guidelines in 2015, it separated two categories:

• General invalid traffic, identified through routine and list-based filtration, such as bots, spiders and other crawlers, non-browser user agents, and prefetched or pre-rendered pages.
• Sophisticated invalid traffic, identified through advanced analytics, multipoint corroboration or human intervention, such as hijacked devices, adware and malware.

The practical lesson is that routine filtering is built to catch the easy cases. Whatever survives into your reports tends to be either harmless or genuinely hard to prove, so method matters more than instinct.

What Google filters before you start looking

Before treating any click as suspect, remember that the numbers in your account have already passed through Google’s systems. Google says its ad traffic quality team uses automated filters, machine learning and manual reviews to detect and filter invalid traffic. Activity identified before the billing cycle closes is removed from your billing and campaign metrics. Activity found later is credited where appropriate and possible, and those credits appear as “Invalid activity” adjustments under Billing > Summary.

Three consequences follow:

• Your Clicks column is already filtered. Adding the Invalid clicks column to the campaigns table shows how many clicks Google removed. The Invalid traffic card on the Overview page, which Google says is rolling out gradually, summarizes estimated savings and credited cost.
• Outside tools may count traffic you never paid for. Google notes that third-party tools might flag traffic as invalid, such as duplicate IP addresses or bot activity, that Google has already filtered and excluded from your bill.
• Credits do not rewrite history. Credits for activity detected after billing do not change past campaign data, so reports and invoices will not always line up neatly.

For background, see how Google Ads counts and bills clicks and our explainer on how Google filters and credits invalid clicks. For detection, the point is simple: examine what remains after Google’s filtering, not what it already removed.

Suspicious click indicators worth checking

No single indicator proves fraud. Each pattern below has ordinary explanations, and the useful signal is usually a cluster of indicators that point the same way and cannot be explained by anything you or the market changed.

Clicks rising faster than impressions

A jump in click-through rate with flat impressions means a larger share of the people who saw the ad clicked it. That can be good news: a sharper headline, a promotion, or a rival that stopped bidding. It becomes interesting when nothing in your change history or the market explains it and the extra clicks show none of the behavior your real visitors show.

Clicks from outside your target area

Out-of-area clicks are among the most common reasons advertisers suspect fraud, and among the most often misread. Google explains that with the default location option, ads can reach people who have shown interest in your targeted locations, not only people physically there, and that with country-level targeting, ads may show to people searching on that country’s Google domain even if their IP addresses are outside the selected area. Check the location option before reading anything into a map. Our guide to segment-level ad traffic analysis shows how to fold location into a routine quality review.

Engagement and lead quality

Engagement is where invalid traffic often gives itself away, because automated or indifferent clicks rarely behave like prospects once they land. Google Analytics 4 counts a session as engaged when it lasts longer than 10 seconds, has a key event, or has two or more page or screen views. A paid segment whose share of engaged sessions collapses while organic traffic holds steady deserves attention.

For leads, check whether contact details are real and whether any become customers. If you store the click identifier with each lead, junk leads that trace back to ad clicks point toward the ads, while junk leads without one suggest the form itself is being targeted.

Building baselines before you judge anything

A spike only means something relative to normal, and normal differs across campaigns, devices, hours and places. Build baselines before you need them.

Google Ads lets you segment table data by time, including hour of day and day of the week; by device, covering computers, mobile phones, tablets and TV screens; and by network, which separates Google Search, search partners and the Display Network. Those segments are the backbone of a useful baseline:

• Per campaign. Brand, generic and remarketing campaigns behave differently and should never share a benchmark.
• Per device. Compare mobile, desktop and tablet traffic each with its own history.
• Per hour and weekday. A business-to-business campaign may be quiet overnight; a consumer campaign may peak in the evening.
• Per location. Note which regions normally produce clicks and how much traffic usually sits outside your core area.
• Per network. Search partners and Display placements often behave unlike Google Search.

Record the typical daily or hourly range for each segment over several comparable weeks, rather than a single average, and flag values well outside it. Allow for seasonality by comparing with the same period in earlier years, and mark promotions, launches and holidays on your timeline.

Then reconcile every anomaly with what changed. Google Ads change history lists changes made to your account, campaigns and ad groups during the past two years and can be filtered by date range, type of change, campaign or ad group. A bid strategy switch, a new broad-match keyword or a widened location target explains far more “suspicious” spikes than fraud does. If the change is sudden and affects the whole account, a structured Google Ads performance investigation is a better starting point than a fraud hunt.

The limits of click fraud detection

Good click fraud detection is honest about its blind spots. Several limits apply to every advertiser.

Google Ads reports are aggregated. They show clicks by campaign, keyword, device, location and time, but not the IP address or identity behind each click. Visitor-level details come only from your own website and server records, which is why Google asks for server logs when you request an investigation.

IP addresses are not people. Google points out that an IP address isn’t always unique to one device: universities, offices, coffee shops and mobile carriers commonly use network address translation, which allows hundreds or thousands of devices to share one public IP address. Repeated clicks from one address can be one person or an entire building. VPNs and privacy relays add another layer, because the address you see belongs to the exit point rather than the person.

Clicks and sessions measure different things. Google lists many reasons the two diverge: two clicks within 30 minutes can count as one session, redirects can strip the click identifier, visitors may leave before the tracking code runs, and some browser settings prevent measurement. Analytics also reports visits from clicks that Google Ads filtered as invalid. A gap between clicks and sessions is normal; a sudden change in that gap is what deserves attention.

Consent and blocking create holes. Visitors who decline analytics or block scripts may be partly or wholly invisible in analytics, so “no engagement” can sometimes mean “not measured”.

Correlation is not causation. Clicks rising the week after a dispute with a competitor may be coincidence. Treat such links as hypotheses to test, never as conclusions.

How to detect click fraud responsibly: a step-by-step method

When an anomaly survives the baseline check, work through it in order. Skipping steps is how false accusations and wasted effort happen.

1. Define the anomaly precisely. Write down the metric, the campaigns and segments affected, the date and hour range, and the account time zone. “Clicks on the generic campaign tripled between 01:00 and 04:00 on two consecutive nights” is testable; “we’re getting fake clicks” is not.
2. Rule out changes and market effects. Check change history, budgets, bid strategies, keywords, location options, network settings and recent ad or landing-page edits, then consider seasonality, news and competitors.
3. Check Google’s own invalid-click data. Compare the Invalid clicks column for the same period, look at the Invalid traffic card if your account has it, and watch billing adjustments in the following months.
4. Examine individual sessions and logs. Look at what the suspect visits actually did. Our guide to reading suspicious ad sessions one at a time explains what to look for and which harmless quirks to set aside, and our article on identifying non-human visits in analytics and server logs covers bot-specific signals.
5. Preserve evidence. Export the relevant reports, keep the raw server logs for the period, and if you capture click identifiers with leads, keep a list of the affected leads with your assessment of each.
6. Document without accusing. Record facts, not theories about who is responsible. Unless you hold evidence that would stand up to scrutiny, do not name or confront a suspected competitor or publisher.
7. Submit an investigation request. Google accepts invalid traffic investigation requests through its Click Quality Form for activity within the last 60 days. It asks for your 10-digit customer ID, the exact dates, the campaigns and ad groups involved, suspicious keywords, web server logs with IP addresses, platform and device details and GCLIDs, a spreadsheet of affected leads where relevant, and a brief explanation of why the traffic looks suspicious.
8. Adjust protections proportionately. While the review runs, apply the safeguards an advertiser controls directly, such as tighter location options or network settings, without cutting off traffic that is performing well.

Evaluating third-party detection tools critically

Most outside monitoring services work in similar ways: a script on your website records each visit that arrives from an ad, a scoring model flags visits that look automated or repetitive, and some services then add exclusions to your campaigns. They can add useful visit-level detail, but they share structural limits.

• They see your website, not Google’s click logs. A tool cannot see which clicks Google has already filtered or credited, so its “blocked” or “fraudulent” counts may overlap with traffic you were never charged for.
• They inherit the shared-IP problem. Scoring that leans heavily on repeated IP addresses will misjudge offices, campuses and mobile networks.
• Their thresholds are judgments. Every tool decides how much repetition or how little engagement counts as invalid, and different tools can disagree about the same visit.
• Exclusions have side effects. An IP exclusion added because of one flagged visit can also hide your ads from every genuine customer who shares that address.

Questions worth asking any vendor:

• How do you define an invalid visit, and can I see the signals behind each flag?
• How do you treat shared IP addresses and mobile carrier networks?
• Do your savings figures account for clicks Google already filtered or credited?
• Can I export raw, visit-level evidence suitable for a Google investigation request?
• What visitor data do you collect, and how long do you keep it?

A service that cannot answer these clearly is offering reassurance rather than evidence.

An illustrative worked example

The following scenario is hypothetical and uses round numbers to show the method, not to describe a real account.

Imagine a home-services company whose Search campaign, over the previous eight comparable weeks, received between 80 and 120 clicks a day at a fairly steady click-through rate. One Tuesday the campaign records 300 clicks while impressions stay within their usual range.

• Define it. Segmenting by hour of day shows that roughly 200 of those clicks arrived between 01:00 and 03:00 in the account time zone, a window that normally produces a handful.
• Rule out changes. Change history shows no edits for ten days. The clicks came from Google Search rather than search partners, from inside the target area, and nothing in the market explains a burst at that hour.
• Check Google’s data. A day later, the Invalid clicks column shows a substantial number of clicks filtered for that Tuesday, so part of the burst was never billed.
• Look at sessions. Sessions from that window are almost all unengaged. Server logs show many requests carrying click identifiers seconds apart, from a few network ranges, with identical browser details.
• Preserve and document. The advertiser exports the hourly report, saves the log lines and writes a factual timeline without speculating about who was responsible.
• Request a review. Because billed clicks in that window still exceed the normal range, the advertiser files an investigation request within 60 days, attaching the logs.

Now change one detail. Suppose the same burst had arrived at 19:00, on the evening a local television segment mentioned the company, with normal engagement and several phone calls. The method would stop at the second step, with no case to make. A disciplined process protects you both from ignoring real abuse and from chasing ordinary demand.

Key takeaways

• Click fraud is the deliberate subset of invalid clicks. Data shows patterns, not intent, so detection is about building evidence, not reaching certainty.
• Your reports already exclude the invalid clicks Google filtered; check the Invalid clicks column and billing adjustments before assuming you paid for a spike.
• Build baselines per campaign, device, hour, location and network, and reconcile every anomaly with change history and market events before suspecting fraud.
• Shared IP addresses, VPNs, consent gaps and normal click-to-session differences limit what any analysis, including third-party tools, can prove.
• Document facts, avoid accusations, and submit an investigation request with logs and click identifiers within Google’s 60-day window.