Google Ads Click Fraud: Who Commits It, Where It Happens and How to Report It

Google Ads click fraud is the deliberate generation of clicks on ads by people or software with no genuine interest in what is advertised, usually to drain an advertiser’s budget or to earn money from ads shown on a publisher’s site. Google treats it as one form of invalid traffic: it filters most such activity before you are billed, credits what it finds later, and lets advertisers request an investigation when they believe something was missed.

This article covers who commits click fraud and why, how exposure differs across Search, search partners, the Display Network, YouTube and Performance Max, which signs you can and cannot see, how to report a case, the myths behind common overreactions, and the policy and legal context.

What click fraud on Google Ads is, and what it is not

Google uses the broader term invalid traffic for any clicks and impressions that do not represent genuine interest in your business. Some of it is accidental, such as clicks caused by ads placed too close to navigation buttons. Some of it is deliberate: Google’s examples include bots and automated software that mimic human browsing, clickjacking and ad stacking by fraudulent publishers, competitors who manually click to increase your spend, and publishers who pay users to click ads (About invalid traffic).

Click fraud is the deliberate part of that picture. Google’s filters do not need to know anyone’s motive to discard a click, but you need evidence of a pattern before you can reasonably call something fraud. Everything Google does about invalid activity, from the reporting columns to post-billing credits, is explained in our guide to how Google filters and credits invalid clicks.

What click fraud is not: a click that did not convert, a curious prospect who clicked twice, a visitor who bounced, or a spike after you broadened your keywords. Most disappointing traffic has ordinary causes.

Who commits Google Ads click fraud and why

Competitors clicking your ads

The motive most advertisers fear is a rival trying to exhaust their budget. Google explicitly lists competitors who “manually click to increase your spend” as invalid user activity (About invalid traffic), which means a rival clicking by hand is attempting exactly what Google’s filters and reviews are meant to catch. Clicks that are identified before billing are not charged, and those found later are credited.

Dishonest publishers

Publishers who show Google ads on their own sites or apps earn money from valid ad activity, which gives a dishonest publisher a reason to inflate clicks. Google’s AdSense policies leave no room for this: “Publishers may not click their own ads or use any means to inflate impressions and/or clicks artificially, including manual methods.” The same policies prohibit automated click and impression generating tools, robots and deceptive software, asking others to click or view ads outside rewarded inventory, and using third-party services that generate clicks or impressions, such as paid-to-click, paid-to-surf, autosurf and click-exchange programs (AdSense Program policies). Publisher-side tricks such as clickjacking, ad stacking and ads hidden in ways no visitor could see are described on Google’s Ad Traffic Quality site (Invalid activity).

Botnets and malware

At the larger end of the scale, Google describes botnets as “automated software programs that run on Internet servers or hijacked computers”, and lists malware as another source of invalid traffic (Invalid activity). Infected devices let fraud appear to come from ordinary home connections. This publication covers such software only conceptually; for why click bots are prohibited and how they tend to be exposed, see our explanation of ads clicker bots.

Click farms and paid clickers

Not all deliberate invalid activity is automated. Google’s Ad Traffic Quality site describes invalid user activity as “when a real person interacts with an ad, but not out of actual interest”, and notes that some publishers ask, or even pay, users to click on ads (Invalid activity). Organized groups of paid clickers can look more human than software, which is why judging this kind of activity takes patterns across many clicks rather than any single visit.

How exposure differs by network and campaign type

Where your ads run shapes both the risk and the controls available to you.

A few details are worth knowing. Google says search partners are included by default when you create a campaign for the Search Network, that partner placements can include site directory pages, product detail pages and YouTube search results and Watch pages, and that you can opt out by unchecking “Include Google search partners” in the Networks section of the campaign settings (About the Google Search Network).

IP exclusions are capped at 500 addresses per campaign, and campaign-level exclusions are not available for video, hotel, App, Performance Max or Smart Display campaigns. Account-level IP exclusions, set in the account settings, apply across campaign types including Performance Max, Display and YouTube (Exclude IP addresses).

For Performance Max, Google states that campaigns “will respect all account-level and MCC-level placement exclusions”, covering Display, Search Partners and video inventory, but cautions that it “can’t guarantee that every related placement will be blocked”. Performance Max negative keywords apply to Search and Shopping inventory only (How to use brand suitability features in Performance Max).

For video formats, remember that Google reports invalid interactions alongside invalid clicks, since the main paid action may not be a click at all (About invalid traffic).

Signs you can see and what stays hidden

Advertisers see aggregates and their own site data; Google keeps its detection logic private.

Two Google statements anchor the right column. Google says an investigation “won’t be able to confirm if specific clicks were marked as valid or invalid” (About invalid traffic), and that Google Ads doesn’t provide details of the websites where ads were shown on the Search Network unless you are running a Performance Max campaign (About the Google Search Network).

Server logs help, within limits. Google’s advice to advertisers is that if auto-tagging is enabled and a visit lacks the GCLID parameter, “it’s safe to say that those visits didn’t come from your ad”, and that even if you find several entries with the same GCLID, “you will only be charged for at most one click.” It also warns that a unique IP address only “sometimes” indicates a unique user, because most mobile carriers and some internet providers rotate addresses among users, and a whole university can appear to share one address (Resources for Advertisers).

Out-of-area clicks deserve particular care, because location settings can legitimately put ads in front of people outside the area you had in mind; check them using our guide to location targeting options before treating those clicks as suspicious. A full method for turning signs into evidence is in our guide to click fraud detection.

How to report click fraud to Google

If you want to report click fraud on Google Ads, follow a sequence that makes the request credible and quick to assess.

1. Check Google’s numbers first. Look at the Invalid clicks column and the Invalid traffic card on the Overview page, both described in Google’s invalid traffic help page. Much suspicious activity has already been filtered and was never billed.
2. Rule out ordinary causes. Review the change history, budgets, match types, location options, seasonality and competition. Our walkthrough of diagnosing a sudden change in campaign performance gives an order of checks.
3. Gather the evidence Google asks for. Google lists your 10-digit customer ID, the exact date range, the affected campaigns, ad groups and keywords, web server logs with IP addresses, devices and GCLIDs, a spreadsheet of GCLIDs with your assessment of each lead for lead quality problems, and a brief explanation of why the traffic looks suspicious (About invalid traffic).
4. Submit within 60 days. Requests go through the Click Quality Form and are limited to activity in the last 60 days (same source). Google’s advertiser resources add that it “disclaims all liability for traffic accrued 60 days prior to the date of requesting an investigation” (Resources for Advertisers).
5. Know what to expect. Google says reviews typically take several business days and that findings arrive by email (About invalid traffic). Any credit appears in billing as an invalid activity adjustment. Charges, Google notes, “are based solely on Google’s metrics” (Resources for Advertisers).

If a third-party tool prompted your concern, include the underlying logs rather than its verdict. Google says such tools may flag traffic it has already filtered and that it cannot evaluate their reports without knowing their criteria (About invalid traffic).

Myths and counterproductive reactions

Some reactions to suspected fraud cause more harm than good.

• “Every click that doesn’t convert is fraud.” Non-converting clicks are mostly ordinary visitors who were not ready to buy, or traffic from loosely matched queries.
• “A competitor can drain my budget with a few clicks.” Google classifies competitor clicking as invalid activity, filters what it detects before billing and credits what it finds afterward. Suspected competitor clicks belong in a documented investigation request, not in a panic response.
• “Blocking IP addresses will stop it.” IP exclusions are capped per campaign, unavailable at campaign level for several campaign types, and addresses are often shared or rotated, so blocking can miss the culprit while excluding real customers.
• Clicking your own ads to check them. This adds noise to your data. Use the preview approach described in our guide to how Google Ads counts clicks instead.
• Clicking a competitor’s ads in retaliation. This is itself the kind of activity Google lists as invalid, and it gains you nothing.
• Publicly accusing a named competitor. Without evidence you could be wrong, and accusations carry their own legal risk.
• Buying protection on fear alone. Third-party tools have real limits. Our guide to realistic invalid click protection explains how to evaluate them and which safeguards you control directly.

Legal and policy context

Click fraud breaks Google’s rules on both sides of the auction. For publishers, the AdSense policies state that “clicking your own ads for any reason is prohibited” and that “any method that artificially generates clicks or impressions on your Google ads is strictly prohibited” (AdSense Program policies). For advertisers and their competitors, Google’s own definition places deliberate manual clicking to increase someone’s spend in the invalid traffic category (About invalid traffic).

Large-scale ad fraud can also lead to criminal charges. In 2018, Google described an ad fraud operation it called 3ve, which used infrastructure including residential malware infections, data centers and spoofed domains. Google said it identified the operation in 2017 while working with the cyber security firm White Ops, referred it to law enforcement, took part in a coordinated takedown and credited advertisers, and that the U.S. Attorney’s Office for the Eastern District of New York announced criminal charges related to the scheme (Industry collaboration leads to takedown of the “3ve” ad fraud operation). That case concerned fraudulent ad inventory and bid requests rather than competitors clicking Search ads, but it shows that ad fraud is treated as fraud, not as a marketing tactic.

Whether a particular act by a particular person is unlawful depends on the jurisdiction and the facts. If you believe a specific business is targeting you, document what you see, report it to Google, and take legal advice before acting against anyone.

Key takeaways

• Google Ads click fraud is the deliberate subset of invalid traffic, committed by competitors, dishonest publishers, botnet operators and paid clickers, and Google filters most of it before billing.
• Exposure differs by inventory: Google Search has no outside publisher with a stake in each click, while partner, Display and video inventory add publisher-side risks, with controls such as opting out of search partners and account-level placement and IP exclusions.
• You can see aggregates, engagement and your own logs, but not Google’s click-level decisions or criteria, and IP addresses are an unreliable way to identify people.
• To report click fraud, check Google’s invalid click data, rule out ordinary causes, gather logs with GCLIDs and submit through the Click Quality Form within 60 days.
• Avoid self-inflicted damage: do not click your own or competitors’ ads, do not accuse without evidence, and do not rely on IP blocking alone.