Most fake leads and foreign clicks in Google Ads come from three settings, not a hacker targeting you. The campaign shows ads to people "interested" in your area instead of people in it. It runs on partner sites and the Display Network as well as Google Search. And it bids toward any form submission, so every bot that fills your form teaches Google to find more bots. Fix those three and most of the junk goes. Then claim credit for what gets through.
The case that surfaced this topic is typical. An owner on r/PPC posted "$4,500 down the drain!": $300 a day for 30 days, a targeted CPA, 18 leads, "fake form submissions (people are stunned when we call them)," clicks "from places like Somalia, Ghana, Costa Rica even though I've set US as my targeted market." Sales: zero. Every top reply named the same few settings. None of them said "buy software."
This post covers the Google Ads account itself. For the form side, see stopping spam form submissions, and for sorting a real lead from a fake one before you drive out, use the 90-second fake lead test.
Five-minute triage: which problem do you have?
Open three reports before you change anything: location, network and search terms. The pattern you find tells you which fix comes first.
| What you see | Most likely cause | First fix |
|---|---|---|
| Clicks from countries you never targeted, in the location report | Location option set to Presence or interest | Switch targeted locations to Presence |
| Most junk arrives through Search partners or Display in the network segment | Partner networks switched on | Search network only |
| Form fills with fake names, gibberish, numbers that do not ring | Bots finding your form | Form filters, and stop counting raw submits as conversions |
| Real people who "never asked" or want it free | Search terms, ad copy that attracts browsers | Negatives, price anchor in the ad |
| Clicks bunched between midnight and 4 a.m. | Bots and people on the other side of the world | Ad schedule |
| Junk that survives all of the above, from "local" IPs | Proxies and geo-spoofed bots | Evidence file and a click quality investigation |
To segment by network, open the campaigns table, click Segment and choose Network. For location, Google's matched locations report shows "locations that matched your ads," which "could be users' physical locations or locations of interest." That second part is the tell: if a click matched on interest, the setting let it in.
Why fake leads and foreign clicks show up together
They come from the same weak spot: the campaign is allowed to reach people who are not your customers, and then it is rewarded when they fill in a form. Loose settings bring the traffic in, and conversion tracking tells Google to find more of it.
The location option
Every campaign has a buried "location options" setting. Google's own page on location targeting says broad geo targeting, "Presence or Interest," is "recommended as a best practice on Search." It also says "the location mentioned in the user's query is considered first," with the user's physical location used only when the search names no place.
That is exactly the $4,500 thread. As the top reply put it: "If it's set to 'Presence or Interest' in the United States that will include someone searching for 'editing services United States' in Nigeria." A local trade gets the same thing when someone abroad searches "plumber Dallas." We cover the full location picture, including Meta and Local Services Ads, in the guide to leads from outside your service area.
The networks
Google is plain about the default: "When you create a campaign for the Search Network, search partners are included by default." It also says it "doesn't provide information detailing the website where your ad was shown on the Search Network, unless you are running a Performance Max campaign." In other words, the default sends some of your budget to sites you cannot see.
Every practitioner source we checked starts here. In a video on stopping click fraud with about 13,000 views, the Grow My Ads presenter says search partners are "normally one of the first places I look," and calls the Display Network "an absolute sewer of garbage in my opinion."
The bid strategy
This is the one the top-ranking pages skip. Smart Bidding goes out and buys more of whatever you count as a conversion. If a bot's form fill counts, you are paying Google to find more bots.
A reply in the $4,500 thread made the point: "The tCPA is part of what's driving this rather than just sitting on top of it. It buys more of whatever you count as a conversion, so if the junk form fills are firing that conversion you've spent a month training it to go and find more people who fill forms and then never answer the phone." In the r/PPC thread "Am I just advertising for bots?", another commenter explained the reverse: a page view or button click is easy for a bot, "an actual phone call from the website or from the call asset on the ad itself, or an actual sale" is not.
What Google covers, and what it leaves to you
Google filters invalid clicks and credits some of them. It does nothing about what those visitors do on your site. Knowing where that line sits saves you arguing with support about the wrong thing.
Google's page about invalid traffic sets out the split:
- Before billing: invalid traffic caught before the end of the billing cycle is "automatically removed from your billing and campaign reports, so no refunds are necessary." You can see it by adding the Invalid clicks column to your campaigns table.
- After billing: traffic found later is credited "in the form of a billing adjustment," labelled "Invalid activity" on your invoice, "when appropriate and possible."
- After the click: "Google systems cannot track or control visitor actions after they click your ad. Therefore, lead quality is a shared effort." Google's filters "cannot block traffic from your site."
Two things confuse owners here. First, the Invalid clicks column and the credit on your invoice measure different things, so a big filtered number and a small credit is normal. Google says "these numbers are not directly related." Second, campaign metrics freeze at month end, so old credits never lower the cost per lead in your dashboard. To see real numbers after credits, use the Invalid Activity Credit Report in Report Editor. It covers Search and Performance Max campaigns only.
By the numbers
Google's own lead generation guidance says goals such as "qualified lead," "converted lead," "book appointment" or "request quote" "automatically trigger invalid traffic protections, built specifically for lead generation campaigns," and asks for at least 15 conversions in the last 30 days on the action you bid to. Source: Best practices for generating high-quality leads.
If your campaign counts every form fill as a win, Google is being paid to find more junk. We set up the lead capture so each enquiry is marked real or fake, and only real ones go back to Google as conversions, so bidding learns from people who pick up the phone.
The 7 fixes, in the order to do them
Work top to bottom. The first three are free, take minutes and remove most of the junk. The last four stop it coming back.
1. Switch location targeting to Presence
In each campaign go to Settings, Locations, Location options. Change targeted locations to Presence: people in or regularly in your targeted locations. Google's advanced location options page confirms the default: "location targeting includes both physical locations and locations of interest." Exclusions work the other way round: by default they block "people likely to be located in your excluded locations," so an exclusion list does not replace switching to Presence. Several replies in the $4,500 thread also suggested excluding the specific countries the clicks came from.
For a local business, target your service area, not the whole country. One reply in the thread noted that $300 a day "is not even enough to cover a city so focus local first."
2. Run on Google Search only
Under Settings, Networks, untick Include Google search partners and Include Google Display Network. Google's own help page tells you to "also check your Display Network settings if you're experiencing performance issues." If you want Display later, run it as its own campaign with its own landing page, which is what the Grow My Ads video recommends for Display and Performance Max lead gen.
3. Make a real lead the conversion you bid to
This is the fix that changes behaviour. Google says primary conversion actions are "used for bidding," while secondary actions "are for observation only." So:
- Set raw form submissions to secondary. You still see them, but bidding ignores them.
- Make the primary action something a bot cannot fake: a qualified lead you mark in your CRM, a booked appointment, or a call from the ad over a set length.
- If you use offline imports or enhanced conversions for leads, Google suggests uploading "ideally daily" and picking an action that happens "within 7 days of the ad interaction."
If you are below about 15 qualifying conversions a month, do not run Target CPA yet. "Target CPA with no real Conversion history is the death of any Campaign," as one r/PPC reply put it. That threshold is the same one that decides whether broad match is worth testing. Calls count only if you track them, and call tracking for contractors is what makes a phone lead something Google can learn from.
4. Filter bots on the form, and do not fire the conversion for them
Google recommends "reCAPTCHA and server-side validation" and a double opt-in for email. The important part is sequence: if a submission fails your checks, it should not fire the Google Ads conversion. The Grow My Ads presenter runs a honeypot so "we weed out any spam leads that come through and we don't fire it as a conversion." The full filter stack, including what Google's free reCAPTCHA tier does at its cap, is in the spam form guide linked at the top of this post.
If you use Google's own lead form assets, check the type. Google's lead form help page lists "More volume (Default)" and warns those leads "may include people who are less interested." Switch to More qualified. The same trade-off shows up on Meta, which we compare in Meta lead forms vs landing pages.
5. Put a price floor in the ad
A lot of "fake" leads are real people who were never going to pay. In the $4,500 thread, one reply suggested a headline like "Starting At Only $500"; another suggested negatives such as "Free, Discount, Cheapest, Charity, Coupon." Your search terms report shows which ones to add. A price anchor costs you some clicks, and those are clicks you did not want.
6. Schedule ads for hours someone can answer
An owner in r/PPC asked if bots were clicking after noticing most clicks came "between 12am and 4am." Replies suggested running ads from about 6 a.m. to 9 p.m. local time and removing call assets when no one can pick up. For a service business this also helps real leads: an overnight form that waits until 10 a.m. loses to whoever responds first.
7. Turn off auto-apply recommendations
Google Ads can apply its own recommendations automatically, and some of them broaden targeting or change bidding. A solo founder on r/PPC described finding 18 auto-apply toggles switched on after his campaign lost about $600 in six days. His Google Analytics showed Singapore at 130 users, 21.35% of site traffic, with 0 seconds average engagement, against real US traffic at 21 seconds. Check Recommendations, then Auto-apply, and switch off anything you did not choose. If ads fell off a cliff rather than filling with junk, the four ways Google Ads stops working is the better starting point.
Why blocking IP addresses rarely fixes it
IP exclusions are for your own office or one persistent clicker, not for bots. Google allows up to 500 IP exclusions per campaign, and Google itself explains why excluded addresses still show up: "Some Internet Service Providers continuously rotate users' IP addresses," and "some Google Network sites don't provide IP information," so "we can't guarantee there will be no clicks from a particular IP address."
An advertiser in r/googleads who had already excluded every other country put it plainly: "I tried blocking the IP addresses of the fake country click IP's but they keep coming with fresh IP's - so it didn't work." Your time is better spent on fixes 3 and 4, which make junk traffic worthless to the bidding system.
How to get credit for invalid clicks
Google gives credits, not refunds, and it will investigate the last 60 days if you bring evidence. The form is the Click Quality Form, and Google's credit report page says it covers "invalid clicks, poor quality form submissions, clicks outside of location targeting, or sudden short-term cost increases."
Google lists what to bring. For a small business, most of it comes out of your lead list:
- Customer ID and the exact date range, within the last 60 days.
- Campaign, ad group and keyword names where the spike happened.
- Web server logs: IP addresses with repeat clicks or no conversions, browser and device details.
- GCLIDs, the Google click ID on each ad visit. Capture it in a hidden form field so every lead carries one.
- A lead spreadsheet: "GCLIDs for each lead" plus "your assessment of each lead, such as outcomes from emailing or calling them."
- The pattern in one line: Google's own examples are "a 300% spike in clicks without more conversions, or clicks that originate outside your targeted locations."
Google says a review "typically takes several business days," that results arrive by email, and that it will not confirm which specific clicks it judged invalid. The auto-apply poster above filed one and later updated the thread: "Google gave me credit back." That is one account, not a promise. Credits apply only to clicks, so even a good result does not pay for the hours spent calling fake leads.
The GCLID-per-lead sheet is also how you start to track where your leads come from, so it is worth setting up even if you never file.
Do you need click fraud software?
Probably not first. Most of the pages ranking for this problem are written by companies that sell click fraud tools, which is worth knowing when you read them. Google also warns that "third-party tools might flag traffic as invalid (such as duplicate IP addresses or bot activity) that Google already filtered and excluded from your bill."
The Grow My Ads video, which is no friend of Google's defaults, lands in the same place: go through the settings first, and use a tool "as a last resort" if junk survives all of it. If you do buy one, use it to gather evidence for the Click Quality Form, not as a replacement for fixing the conversion setting.
Can you fix this yourself?
Yes, fixes 1, 2, 5, 6 and 7 are settings you can change this afternoon, and they are free. Most of the replies in the $4,500 thread were settings changes, not a sales pitch. One reply was blunt: "Google makes it look deceptively simple but in reality there are so many seemingly minor settings that have a major impact."
Fixes 3 and 4 are where owners get stuck, because they involve the website, the form, the phone system and a way to mark each enquiry as real or junk, then send that back to Google. If your leads land in an inbox, a spreadsheet and a voicemail, nobody is marking them, and bidding keeps learning from the junk. That is when it stops being a settings problem and becomes a lead system problem.
Before you decide Google Ads does not work, compare your real numbers with a sensible cost per lead for contractors. An account that looks awful with junk included can look fine once you count only qualified enquiries. The same thing happens on Facebook, where leads but no customers is usually a question of what counts as a lead.
The checklist
Run this on every campaign, once:
- Location options: targeted locations set to Presence; countries the junk came from added as exclusions.
- Networks: Search partners off, Display off.
- Auto-apply recommendations: everything off that you did not choose.
- Conversions: raw form submit is secondary; primary is a qualified lead, booking or tracked call.
- Bid strategy: no Target CPA until the primary action has about 15 conversions in 30 days.
- Form: bot filter in place, and a failed check does not fire the conversion.
- Hidden GCLID field on every form, saved with the lead.
- Negatives for free, cheap and job-seeker terms; a price anchor in one headline.
- Ad schedule matches the hours someone can answer.
- Invalid clicks column added; Invalid Activity Credit Report saved in Report Editor.
Then, once a week, mark each lead real or junk. If junk rises, you will see which campaign and which setting changed, and you will already have the spreadsheet Google asks for.
Ticked the settings but cannot tick the conversion and GCLID lines? That is the part that stops the junk coming back. We build the capture so every enquiry carries its click ID and a real or junk mark, and only real leads are sent back to Google.
