I think competitors are click-frauding my Google Search Ads. How do you protect yourself from this?

[lemon97]

Hi everyone.

I never really believed the stories and rumors that dishonest competitors could click on your search ads just to burn your ad budget. But after,decided to build my own brand, create a service, and run ads, my entire ad budget started getting eaten by very suspicious traffic.
I started noticing that out of roughly 200 impressions, I could get 50-80 clicks. The CTR looked extremely high. At first, I was happy about it. But out of 80 clicks, I would get only 3-4 real inquiries at most.
I set up conversion tracking for phone number clicks and WhatsApp clicks. The tracker was showing 50-70 successful goal conversions. But in reality, there were only 3-4 actual inquiries.

After three days, I started suspecting that something was wrong. At first, I thought my website was bad or that my ad settings were wrong. I made adjustments, but the situation did not really change.
Then I opened session recordings / Webvisor to see what visitors from Google Search Ads were actually doing on my website.
What I saw shocked me.

In one hour, around 30 people visited the site. Most of them spent around 1–9 seconds on the page, some stayed longer. But almost all of them had the same behavior pattern: they entered the site, instantly scrolled very quickly all the way to the bottom, and then left. Some just opened the site and did nothing.
This does not look like normal customer behavior to me. I am confident that I am not just imagining things or blaming the website for no reason.

I need advice from people who really understand paid ads. How do you deal with this kind of unfair competition?
Is there any point in constantly writing to Google and asking them to remove bot/invalid clicks? I doubt it will fully solve the problem.

I also understand that it is possible to create a farm of 100 phones connected to mobile carrier internet, where the IPs are dynamic and almost impossible to block directly.
What surprised me even more is that 99% of my clicks were from mobile devices. Almost no desktop traffic at all. I started thinking maybe nobody uses desktop anymore, but in the recordings I saw both old Android phones and newer Android devices. The point is that these mobile click farms with dynamic carrier IPs are very hard to block.

How do you fight this?
I know there are people here who spend hundreds of thousands of dollars on ads. Please give me advice on how not to shut down my company and how to survive in this harsh advertising environment.

 

[Inem2]

I wouldn't jump straight to competitor click fraud.

The biggest red flag in your post is that Google is reporting 50-70 conversions, but you're only getting 3-4 actual inquiries. That sounds more like a tracking issue than a traffic issue.

Also, quick scrolling and short visits are very common on mobile traffic and don't automatically mean bots.

Before assuming fraud, I'd check:

• Search terms report
• Conversion tracking setup
• Location targeting
• Device performance
• Landing page relevance

Click fraud does happen, but in many cases the real problem is poor-quality search traffic or misconfigured conversion tracking.

 

[lemon97]

The biggest red flag in your post is that Google is reporting 50-70 conversions, but you're only getting 3-4 actual inquiries. That sounds more like a tracking issue than a traffic issue.

Also, quick scrolling and short visits are very common on mobile traffic and don't automatically mean bots.

Before assuming fraud, I'd check:

• Search terms report
• Conversion tracking setup
• Location targeting
• Device performance
• Landing page relevance

Click fraud does happen, but in many cases the real problem is poor-quality search traffic or misconfigured conversion tracking.

Yeah, I get what you mean. I also don’t want to be that guy who instantly screams “competitors are clicking my ads” just because the campaign didn’t print money.

But here is the thing we checked the tracking multiple times.

The goals were not just pageviews or some random scroll events. We had separate goals for:
- click on phone number
- click on WhatsApp button/link

We tested it in GTM and also in another analytics system. The goals fired when the phone/WhatsApp links were clicked. So the setup itself was working.

The weird part is the gap.

For example, Google/analytics showed something like 70 phone/WhatsApp click goals, but in reality we had around 7 real inquiries. So basically 10x more “conversions” than real calls/messages.

Then I opened session recordings during the exact time when the click spike happened. This was around 15:00–15:30. In that short period I checked around 20–30 paid visits.

Almost all had the same pattern:

- Google Ads traffic
- same keyword/search intent
- all mobile
- all Android / Chrome
- mobile carrier internet
- long landing page
- user enters the site
- instantly scrolls super fast all the way to the bottom
- doesn’t read anything
- leaves in 3–6 seconds, some a bit longer

And the strange part: all of these sessions still triggered phone/WhatsApp goals, but in the recording I don’t even clearly see a normal intentional click on the CTA. Also no real call, no WhatsApp message after that.

The landing page is not some random mismatch. It’s like this:

User searches for “buy orthopedic mattress”
Ad says “Orthopedic mattress”
Landing page sells only orthopedic mattresses

So if the visitor is real and interested, even if my landing page is not perfect, I’d still expect at least some normal behavior: reading, checking price, clicking contact, asking a question, something.

But what I saw was not normal mobile browsing. It looked like some task was done: open site → fast scroll to bottom → exit.

If it happened 2–3 times, okay, I’d ignore it. But when 20–30 paid visitors do almost the same thing in a short window, all from Android/mobile carrier traffic, and the budget burns with almost no real inquiries that looks very suspicious to me.

So I agree with you on one point: phone
& WhatsApp clicks are weak micro-conversions and should not be used as primary conversions. That part is definitely a mistake.

But I don’t think this is only a tracking issue.

My current view is:

1. Tracking was technically working, but the conversion goal was too weak.
2. Google probably optimized toward garbage micro-actions.
3. The session recordings show an abnormal repeated pattern.
4. Real inquiries were about 10x lower than tracked phone/WhatsApp clicks.
5. This doesn’t look like just “bad landing page” or “normal mobile users.”

Now I’m reducing budget, removing those clicks from primary conversions, adding CPC limits, tightening keywords/negatives, and sending evidence to Google for invalid traffic review.

Not saying 100% it’s competitors, but this traffic definitely doesn’t look clean.


Who really meet this fraud and what to do ?
I've heard about different services, but in my opinion, they're ineffective because blocking IP bots doesn't make sense since they use mobile proxies or internet providers.

What you're describing is a classic click fraud pattern and your diagnosis is correct. The behavior you saw in session recordings — instant scroll to bottom, 1-9 seconds, then exit — is the fingerprint of automated click fraud, not bad landing page performance. Real users who bounce do it within 0-2 seconds before any scrolling. The rapid-scroll pattern indicates a script simulating human-like behavior.
Immediate steps that actually help:
1. IP exclusion list in Google Ads. Go to Campaign Settings → IP Exclusions and block the IPs of suspicious sessions. Yes, mobile IPs rotate, but you'll still catch some repeat sources. Export your click IPs from Google Ads reports and cross-reference with sessions that had 0 conversions and under 10 seconds on site.
2. Click fraud protection tools. ClickCease, TrafficGuard, or ClickGUARD automate the detection and IP blocking in real time. These tools also auto-submit invalid click reports to Google, which speeds up the refund process. Not a complete solution but significantly reduces the bleeding. Cost is $50-150/month — worth it if your budget is being drained.
3. Geo and device targeting restrictions. If 99% of fraud clicks are mobile, create a mobile bid adjustment of -30% to -50%, or temporarily exclude mobile entirely while you stabilize. Also narrow geo targeting to specific cities if your business is local — it reduces the attack surface significantly.
4. Google invalid click credit requests. File them consistently. Google refunds more than people think if you document the pattern clearly with screenshots of session recordings and conversion data discrepancies. It won't stop the attack but recovers some budget.

Human?

 

[WPGads]

the scroll-to-bottom thing is actually a giveaway - pure bots dont scroll at all or do it perfectly linear. what you saw sounds more like a human farm where people get paid per "task" (click ad, scroll page, leave). ive seen this exact pattern before in local niches where competition is tight.

check the time distribution of those clicks. fraud like this usually hits in spikes - like 30-40 clicks in 20-30 min window then goes quiet. if thats what your log shows, its coordinated not random.

also your whatsapp/phone click goals are super easy to trigger programmatically, switch to something harder to fake like actual form submission

 

[lemon97]

I see in the logs that 160 people clicked on my ad 3-6 times on different days, then either did nothing or scrolled down to the bottom within 5 seconds and exited, while still managing to click all the targets (call, WhatsApp). What should I do? I only have a client ID, but Google doesn't allow blocking by client ID. Their IP is dynamic, and they have a mobile operator's IP.

 

[AdPotato]

Google already filters a large amount of invalid clicks, so it is usually not just competitors or bots causing this. targeting issues are more common.

 

[lemon97]

Guys, bhw is authority forum, best ad specialist but no way to guard business from click fraud?
I changed keys and have 3-4 clients a day without bots, but when I activate best keys for my sphere, 90% bots, 120 clicks a day 0 conversion.
But when some 1-2 another keys, 10 clicks ,3 conversion but I need more.
10000% bots, ad setting is perfect, that is bots. How counter this?

 

[elaxa]

If you suspect invalid traffic, submit reports to Google and monitor the Invalid Clicks section. Google often filters bad clicks automatically, but tightening targeting usually has a bigger impact than trying to block IPs.

 

[roydan]

I work a lot in the local home services niche, where this is usually considered a problem.
Some clients insist on a tool like Clickcease, which I think is nonsense for all sorts of reasons, but the cost is equivalent to 1-5 clicks, which is really a no brainer even for the slim chance that it does anything.

As a side note, don't just track click to call and whatsapp clicks, it will mess up your data collection.
It's better to get a few tracking numbers and track whatsapp submissions through a small form rather than track the click to chats.

 

[André Cristhian]

I had a similar problem, i used "Honeypot Fields", which can be form fields or links hidden via CSS so humans don't see them, and whenever i received clicks or form submissions involving them, i would discard the conversion and ban the IP.

 

[lemon97]

I've seen similar patterns before, but I'd be careful not to assume it's competitors without more evidence. Before blaming click fraud, I'd check your search terms, location targeting, audience settings, and whether your conversion tracking is firing correctly.

If the traffic still looks suspicious, report it to Google, enable invalid click protections, tighten your targeting, and consider excluding locations or devices that consistently perform poorly. Session recordings are useful, but I'd rely on multiple data points before concluding it's a click farm.

These basic tips are everywhere, and we applied them first. Yes, it is competitors click-frauding us, and yes, we have proof of it.

I work a lot in the local home services niche, where this is usually considered a problem.
Some clients insist on a tool like Clickcease, which I think is nonsense for all sorts of reasons, but the cost is equivalent to 1-5 clicks, which is really a no brainer even for the slim chance that it does anything.

As a side note, don't just track click to call and whatsapp clicks, it will mess up your data collection.
It's better to get a few tracking numbers and track whatsapp submissions through a small form rather than track the click to chats.

As for tracking, I have secondary tracking set up for clicks on the messenger link and phone number. The main conversion goal is based on real inquiries that come through messenger and calls from actual clients, tracked through call tracking and WhatsApp tracking. I also recently added tracking for closed deals, including the company’s net margin.

The only thing that really helped was when I successfully set up tracking for real inquiries and switched from the Maximize Clicks strategy to Maximize Conversions with a target CPA limit. That helped eliminate almost 70% of the attacking bots. Inquiries from real clients increased, while impressions shown to bots decreased.

I had a similar problem, i used "Honeypot Fields", which can be form fields or links hidden via CSS so humans don't see them, and whenever i received clicks or form submissions involving them, i would discard the conversion and ban the IP.

Blocking by IP is pointless in our case, because the attack is quite sophisticated. The bots are running through dynamic mobile networks, where they can easily switch to a new IP every minute. They also imitate real user behavior on the website.

 

[roydan]

As for tracking, I have secondary tracking set up for clicks on the messenger link and phone number. The main conversion goal is based on real inquiries that come through messenger and calls from actual clients, tracked through call tracking and WhatsApp tracking. I also recently added tracking for closed deals, including the company’s net margin.

The only thing that really helped was when I successfully set up tracking for real inquiries and switched from the Maximize Clicks strategy to Maximize Conversions with a target CPA limit. That helped eliminate almost 70% of the attacking bots. Inquiries from real clients increased, while impressions shown to bots decreased.

Wow that's good. Like, real good. That looks like what I'd do for clients, so seeing someone do that for themselves is impressive.

One test I'd suggest you to consider, assuming you report gross profit fairly consistently and accurately, is to scale up with maximize conversion value rather than keep relying on tCPA.
I wrote a whole case study about that, was super successful. DM me if you want and I'll send it.
No sales pitch.

 

[lemon97]

Wow that's good. Like, real good. That looks like what I'd do for clients, so seeing someone do that for themselves is impressive.

One test I'd suggest you to consider, assuming you report gross profit fairly consistently and accurately, is to scale up with maximize conversion value rather than keep relying on tCPA.
I wrote a whole case study about that, was super successful. DM me if you want and I'll send it.
No sales pitch.

Got it, thank you for the advice. I’m planning to apply this once I have enough data with different order values and around 30–50 successful closed deals. After that, I want to test the Maximize Conversion Value strategy.

For now, I’m still collecting data.

I’ll definitely write to you.

 

[johnydriver]

1. filter targeting by cities
2. exclude from targeting entire countries that you don't need
3. get a list of known subnet proxies and ban entirely in google ads account settings.
4. make a list of microworkers websites and reject all the clicks that have any of them as referrer
5. make conversion fire on easier to confirm its a human action
6. try only target MacOS and iOS (iOS 16+), bots usually use linux, human farmers use Windows, usually Windows 10 and lower because they don't have good PC's to support Windows 11.

 

[ClickPilotPro]

Don’t stop ads immediately. Collect data, remove poor traffic sources, improve targeting, and keep reporting suspicious activity to Google.