Every time someone clicks your Google or Bing ad, you pay. The uncomfortable part:
a meaningful share of those clicks were never going to become customers. They come
from bots, competitors burning your budget, click farms, and misconfigured scripts
hammering your landing page. Independent studies — and our own data at
ProtectAds —
put invalid traffic at roughly 15–30% of paid-search spend.
If you run PPC, that's not a rounding error. On a €10,000/month budget, it's
€1,500–€3,000 quietly leaking out every month. This article breaks down how click
fraud actually works, why the ad platforms don't fully stop it for you, and why the
"just block the IP" approach falls apart at scale.
First, the vocabulary: invalid traffic vs. click fraud
The ad industry (IAB/MRC) splits Invalid Traffic (IVT) into two buckets:
- GIVT — General Invalid Traffic: the obvious stuff. Known data-center IPs, declared bots and crawlers, spiders. Detectable with lists and simple rules.
- SIVT — Sophisticated Invalid Traffic: the expensive stuff. Hijacked devices, headless browsers pretending to be Chrome, residential-proxy networks, click farms with real fingerprints, automation that mimics human timing.
Click fraud is the malicious, intent-driven slice of IVT aimed specifically at
your ads — a competitor draining your daily budget, or a click farm monetizing fake
engagement. GIVT you can filter with a blocklist. SIVT is where real detection
earns its keep. (We go deeper on this distinction
here.)
Why the platforms don't fully solve this for you
Google and Microsoft do filter obvious invalid clicks and issue some credits. But
their filtering is conservative, opaque, and applied after the fact — you find out
in aggregate, weeks later, with little per-click evidence. They're also structurally
conflicted: invalid clicks are still billed first and credited later, if at all.
That leaves a gap for sophisticated invalid traffic that looks human enough to pass
platform filters but never converts. Closing that gap is an engineering problem:
score every click in real time and act on it before the budget is gone.
Why sophisticated click fraud is so hard to catch
The obvious stuff (GIVT) is easy to filter. The expensive stuff (SIVT) is hard on
purpose — it's built to look human:
- It rotates through fresh IPs and residential proxies, so any static blocklist is out of date the moment you save it.
- It runs on real or convincingly spoofed devices, so a single attribute rarely gives it away.
- It mimics human timing and behavior well enough to slip past simple rules.
That's why "detect fraud" isn't one trick — it's continuous analysis at scale,
correlating signals across many clicks and campaigns over time, with thresholds
tuned so you catch the bad traffic without blocking real buyers. Doing that
reliably, and fast enough to act before the budget is gone, is the hard part — and
it's why most advertisers are better off with a dedicated system than a homegrown
script. (Here's
how ProtectAds approaches it.)
Why "just block the IP" doesn't scale
The first instinct is a spreadsheet of bad IPs pasted into Google Ads exclusions.
It breaks down fast:
| Problem | Manual blocklist | Automated protection |
|---|---|---|
| New IPs every day | You're always behind | Handled continuously |
| Attackers rotate IPs constantly | Whack-a-mole | Doesn't rely on a static list |
| Ad platforms cap exclusion lists | Fills up fast | Prioritizes the worst offenders automatically |
| Evidence for refund claims | None | Per-click log you can export |
| Across many campaigns/accounts | Doesn't | Centralized |
IPs are cheap and disposable for attackers; your manual list is neither. Sustainable
protection has to run continuously, automate the exclusions, and keep an audit trail
you can take back to the ad platform.
Turning detection into protection
Detection is only half the job — you have to act on it. A working pipeline:
- Observe ad clicks as they hit your site.
- Assess each one in real time to tell genuine visitors from invalid traffic.
- Block offending IPs by pushing them to your campaign exclusion lists automatically — no manual copy-paste.
- Report with a per-click, per-campaign log so you can request ad credits with evidence instead of vibes.
This is exactly what ProtectAds
does for Google Ads (including Performance Max / PMax) and Microsoft (Bing)
Ads. You connect your account once, and it runs the detect → block → report loop
continuously. Agencies running multiple client accounts and domains get dedicated
agency plans
for managing protection at scale.
A note on scope: ProtectAds protects Google Ads and Bing Ads. Meta/Facebook Ads
aren't covered — paid search is where competitor and bot click fraud hits
hardest, so that's where we focus.
How much is this worth to you?
Take your monthly paid-search spend and multiply by 15–30%. That range is your
realistic exposure to invalid traffic. Even at the low end, recovering it usually
dwarfs the cost of detection — which is the entire economic argument for automating
this instead of eyeballing reports once a quarter. (You can sanity-check your own
number with the
click fraud calculator.)
Try it on your own campaigns
If you're spending on Google or Bing ads and you've ever wondered why your
click-through looks healthy but conversions don't follow, invalid traffic is a prime
suspect. The fastest way to find out is to point real detection at your live
campaigns and watch what it flags.
Start a free ProtectAds trial —
connect your Google Ads or Bing account, see the invalid clicks in your own data,
and cancel anytime. Your ad budget is better spent on people who might actually buy.
Written by the team at ProtectAds —
real-time click fraud detection and protection for Google Ads and Microsoft (Bing) Ads.
Top comments (0)