Seatext library / BotRefund evidence
How to Audit Your Google Ads Account for Fake Clicks: A Step-by-Step Guide
Start by pulling your click performance data and comparing it against Google's invalid clicks report. Look for anomalies like sudden click spikes with no conversion lift, high bounce rates from specific regions or devices,...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Fake clicks drain budgets and poison your conversion data. Google's automated filters catch less than half of invalid traffic, leaving sophisticated invalid traffic (SIVT) that requires manual evidence to dispute. A thorough audit combines platform reports, analytics cross-checks, and behavioral signals to prove which clicks aren't human.
Why auditing for fake clicks matters
Industry data shows 11% to 14% of clicks across Google Ads campaigns are invalid, and Google's own filters catch under 50% of that traffic. The rest — sophisticated invalid traffic — slips through unless you document it yourself. High-CPC verticals like legal, insurance, and B2B SaaS see even higher rates. If you spend $50,000 a month, you could be losing $5,000 to $15,000 monthly to bots. That's $60,000 to $180,000 a year. Beyond wasted spend, bot traffic corrupts your pixel data, causing Google's algorithms to optimize for more bots instead of real customers.
Prerequisites before you start
- Admin access to your Google Ads account and Google Analytics (GA4)
- At least 30 days of campaign data — 90 days is better for spotting patterns
- Conversion tracking set up with meaningful events (not just pageviews)
- Access to your CRM or lead database to match front-end clicks to back-end outcomes
- A spreadsheet or dashboard to log findings per campaign, ad group, and keyword
Step-by-step audit process
- Pull the Invalid Clicks report in Google Ads. Go to Campaigns > Columns > Modify columns > Performance > Invalid clicks and Invalid click rate. Add these columns and download 90 days of data. This shows what Google already caught.
- Cross-reference with Analytics. In GA4, compare sessions from Google Ads (source/medium = google/cpc) to your Ads click data. Look for discrepancies: high clicks but low sessions, or sessions with near-zero engagement time.
- Segment by dimension. Break down clicks by device, geography, network (Search vs. Search Partners vs. Display), hour of day, and keyword match type. Bots often cluster in specific segments — e.g., mobile Search Partners at 3 AM from a single region.
- Check engagement metrics. For each suspect segment, review bounce rate, average engagement time, pages per session, and scroll depth. Bot sessions typically show: bounce rate >90%, engagement time <10 seconds, zero scroll, one pageview.
- Match clicks to conversions. Export click IDs (GCLIDs) from Ads and match them to leads or sales in your CRM. Flag GCLIDs that generated a click but no downstream activity — no form start, no add-to-cart, no meaningful page interaction.
- Look for behavioral anomalies. If you have client-side tracking (JavaScript on your landing pages), examine mouse movement paths, click speed, and session duration distributions. Robotic linear movements, grid-aligned paths, superhuman input speeds (<1ms), and uniform session durations are bot signatures.
- Document evidence for each suspect cluster. For every campaign/ad group/keyword combo showing anomalies, compile: date range, click count, invalid click rate (Google's), engagement metrics, GCLID list, behavioral screenshots, and CRM match rate.
- Submit a refund request. Use Google's invalid clicks appeal form with your evidence package. Include behavioral logs, GCLIDs, and a clear narrative linking the anomalies to non-human patterns.
Key metrics and signals to check
| Signal | What to look for | Why it indicates bots |
|---|---|---|
| Invalid click rate (Google Ads) | >5% at campaign level; >10% at keyword level | Google's baseline catch; higher rates mean more SIVT slipping through |
| Clicks vs. Sessions gap | >20% discrepancy | Bots click but don't execute JavaScript, so Analytics misses them |
| Bounce rate from paid traffic | >90% on specific segments | Humans usually explore; bots hit and leave |
| Engagement time | <10 seconds median | Too fast to read content or fill forms |
| Scroll depth | 0% on long pages | Bots don't scroll; they load and exit |
| GCLID-to-lead match rate | <5% for a keyword that should convert | Real clicks produce some downstream activity |
| Mouse movement patterns | Linear, grid-aligned, tremor-free | Humans have micro-jitter; bots move in straight lines |
| Click speed | <1ms between interactions | Physically impossible for humans |
Using Google's built-in tools
Google Ads gives you three native tools: the Invalid Clicks report (already covered), the Click Quality dashboard (shows filtered vs. charged clicks), and the Traffic Quality report for Display/Video campaigns. These are necessary but insufficient. Google admits its automated systems catch less than 50% of invalid traffic. The rest requires advertiser-submitted evidence. Treat Google's reports as your starting baseline, not your final answer.
When to use third-party auditing tools
Manual audits work for small accounts. Once you manage multiple campaigns or spend over $10,000/month, the volume of data makes spreadsheet analysis impractical. Third-party tools automate GCLID capture, behavioral fingerprinting (mouse, scroll, speed, VPN detection), and report generation formatted for Google's dispute process. They also protect conversion pixels in real time — preventing "pixel poisoning" where bot conversions train algorithms to target more bots. Look for tools that: capture client-side behavioral evidence, generate audit-ready refund reports, support historical claims (some go back to 2017), and integrate with both Google and Meta dispute workflows.
Common mistakes to avoid
- Relying only on Google's invalid click report. It misses the majority of sophisticated fraud.
- Treating all low-engagement traffic as fraud. Some audiences (e.g., top-of-funnel display) naturally have high bounce. Compare segments against their own baselines.
- Ignoring Search Partners. This network often carries the highest invalid rates. Opt out or audit it separately.
- Submitting refund requests without behavioral evidence. Google rejects claims backed only by analytics screenshots. They want client-side proof: mouse paths, timestamps, device fingerprints.
- Auditing once and stopping. Fraud patterns shift. Schedule monthly audits for active accounts.
Key facts
| Metric | Value | Source |
|---|---|---|
| Global digital ad fraud (2026 projection) | Over $100 billion | S1 |
| Google Ads share of global digital ad revenue | Over 28% | S1 |
| Average invalid click rate across Google Ads campaigns | 11% to 14% | S1 |
| Google's automated filter catch rate | Less than 50% of invalid traffic | S1 |
| Invalid traffic share of programmatic spend (WFA) | 10% to 30% | S1 |
| Google Search invalid click rates by protection level | 4% (well-protected) to >35% (high-CPC competitive) | S5 |
| Non-human share of total internet traffic (Imperva) | 43% | S5 |
| Monthly loss example at $50K spend | $5,000 to $15,000 | S5 |
| Refund success rate for high-volume advertisers (BotRefund) | 83% | S2 |
| Historical refund reach (BotRefund) | Back to 2017 | S2 |
Limitations of manual auditing
You can't catch what you can't see. Server-side logs miss client-side behavior. IP-based filters fail against residential proxy botnets that route through real consumer devices. Click farms use actual smartphones, bypassing device fingerprinting. Without JavaScript-level tracking on your landing pages, you lack the behavioral evidence Google requires for SIVT disputes. Manual audits also don't prevent future fraud — they only document past losses. Real-time protection requires client-side detection that blocks or flags bots before they click again.
FAQ
How often should I audit my Google Ads account for fake clicks?
Monthly for active accounts spending over $5,000/month. Quarterly for smaller accounts. Run an immediate audit if you see sudden CTR spikes, conversion rate drops, or budget exhaustion without lead growth.
What's the difference between invalid clicks and click fraud?
Invalid clicks is Google's umbrella term for any non-genuine click — including accidental double-clicks, crawler traffic, and fraud. Click fraud specifically means intentional, malicious clicking (competitors, click farms, botnets). Google refunds both, but fraud requires stronger evidence.
Can I get refunds for clicks from months ago?
Google's standard window is 60 days, but some third-party services have successfully recovered spend dating back to 2017 by submitting behavioral evidence packages that meet Google's dispute criteria. The farther back, the harder the recovery.
Does opting out of Search Partners stop fake clicks?
It removes the highest-risk network, but bots also operate on Google Search proper and Display. Opting out is a good first step, not a complete solution.
What behavioral signals does Google accept as evidence?
Mouse movement paths (linear vs. natural), click timing (superhuman speeds), scroll behavior (absence), session duration anomalies, VPN/proxy detection, and device fingerprint inconsistencies. Package these with GCLIDs and timestamps.
How much does a professional audit cost?
Many providers offer a free initial bot audit. Ongoing protection typically scales with ad spend: under $10K/month, $10K–$50K, $50K–$250K, $250K–$1M, $1M–$5M, and enterprise tiers above $5M. Some charge a percentage of recovered spend.
Will auditing hurt my Quality Score or ad delivery?
No. Auditing is passive analysis. Installing detection scripts adds negligible page weight. Blocking bots in real time can actually improve Quality Score by cleaning conversion signals.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.