Most clicks that feel fake are not. Before spending money on click-fraud tooling, it is worth learning the signals that separate an automated click from a real person who was simply never going to buy from you — because the two cost you identically, look identical in the cost-per-click column, and have completely different fixes.
The four innocent explanations, ranked by how often they turn out to be the answer
In rough order of frequency, a campaign that produces expensive clicks and no business is usually suffering from:
- Broad match doing what broad match does. Your ad showed for a query you would never have chosen. Check the Search Terms report before anything else — this explains more "fraud" than fraud does.
- Wrong intent, right keyword. Someone searching your term to research, compare, or do their homework. A real human, a real click, no possible sale.
- A landing page that does not match the ad. The click was genuine; the page lost them in four seconds.
- Display or app placements you did not realise you opted into. Worth checking separately — this one blurs into genuine invalid traffic and is covered below.
Work through those first. If the pattern survives all four, then the signals below become meaningful.
Signal 1: clicks that never became a page view
Compare Google Ads clicks against analytics sessions for the same campaign and period. Some gap is always normal. A gap that is large, one-sided (only one campaign), and widening is the strongest single indicator that something is clicking without loading.
Signal 2: sessions with no human behaviour
A real visitor, even an uninterested one, does something: scrolls a little, moves the mouse, takes a couple of seconds to read the headline. Sessions with zero scroll depth and sub-second durations, in volume, from one source, are not people skimming. One or two of these mean nothing; a hundred in a day from one campaign means something.
Signal 3: form fills faster than a human can type
This is the cleanest signal there is, because there is no innocent explanation. A form completed in under about two seconds was not typed by a person. If your form captures the time between page load and submission, you have a reliable bot detector for free — and it also catches the far more common case of a script filling in your contact form directly.
Signal 4: repeated identical values
The same phone number on eight enquiries. The same "name" with different emails. Addresses that follow a visible pattern. Automated submissions reuse data because generating convincing unique data is more effort than most operators bother with.
Signal 5: timing that does not match human behaviour
Look at when the clicks arrive. Real demand for most Indian SMB categories has a shape — it rises through the morning, dips, rises again in the evening. Traffic that arrives in a flat line through the night, or in tight bursts at exact intervals, has a machine behind it. This one is easy to check and hard to argue with.
Signal 6: where the visitor actually is
A campaign targeted at one city receiving steady clicks from far outside it deserves a look. Be careful here though: VPN use is completely normal, IP-based location is approximate, and geo-targeting includes people who show interest in a location as well as those physically in it. This is a supporting signal, never a conclusion on its own — accusing genuine customers of fraud because they used a VPN is a real and avoidable mistake.
One signal is never enough. Each of the six above has an innocent explanation on its own. What matters is several of them appearing together, in the same campaign, at the same time. That combination is hard to produce accidentally.
What to do once you are reasonably confident
Two things, in this order. First, report it to Google — they investigate and refund what they confirm, and it costs nothing but a form. See what you can actually claim on an invalid click refund for what that process realistically achieves.
Second, stop the source yourself rather than waiting. IP exclusion is the only lever that prevents the next click rather than reclaiming the last one.
The measurement that makes all of this easier
Every signal above is easier to read when a lead carries its origin with it. If you can look at one screen and see that a campaign produced forty enquiries, thirty-one of which had unreachable phone numbers and arrived between 2am and 4am, you are not guessing any more.
That is what Claudphic Ads records automatically on every lead — submission timing, the click ID, the campaign, and a traffic-quality score built from exactly these signals. It is not the only way to get there; it is just considerably faster than assembling it from three separate reports.