How do I stop spam and fake leads from my Google Ads campaigns?

TofuAnswer by the Tofu team · checked

You can't block them all inside Google Ads, so stop them at your form and stop rewarding them in bidding. Google filters invalid clicks, but says those filters don't prevent invalid leads, because most checks run after the ad serves. Add reCAPTCHA, double opt-in email and server-side validation to your forms. Bid on a lead-specific goal such as Qualified lead, send CRM results back with enhanced conversions for leads or offline conversion import, and make raw form fills a secondary action. Then narrow where ads run with location, network and placement settings.

As of October 2026.

Why is Google Ads sending me junk form fills?

Because Google's traffic checks mostly happen after your ad serves, bots and people can still reach your site and submit a form. Google's "Prevent invalid leads" help page says its filters "don't prevent invalid leads on their own," and that real people also type fake emails or phone numbers. If those submissions count as conversions, your bidding learns from them as if they were real leads. As Google puts it, "your inputs, especially accurate conversion data, control the output of AI-powered campaigns." Google calls lead quality "a shared responsibility."

Doesn't Google already filter out bots?

For clicks, yes; for form fills, no. Google removes invalid clicks, impressions and conversions it catches before the end of the month from your bill and your reports, and credits you, where possible, for invalid traffic it finds later. Add the "Invalid clicks" column to your campaigns table to see what it filtered. But that filter can't stop a bot or a person from submitting your form, which is why you can get junk leads while reported invalid traffic stays low. Google also removes some invalid conversions later, which can show up as a small drop in conversions over time.

What should I add to my website forms?

Google recommends three checks:

CheckWhat it does
reCAPTCHAGoogle's bot check, added to your web forms
Double opt-inSends an automated email with a unique link. Count the person as a lead only after they click, which shows the address is "real, active, and human-monitored"
Server-side validationYour server checks that the email domain is valid and the phone number fits a real regional format before the lead goes to your CRM

The server-side check matters because, as Google puts it, "sophisticated bots can bypass browser controls" and post straight to your form. Google's Performance Max lead generation guide also suggests adding qualifying questions to cut spam.

How do I stop Smart Bidding from chasing fake leads?

Bid on leads your team has qualified, not on every form fill:

  1. Pick a lead-specific goal. Choose Leads as the campaign objective and bid on a goal such as Qualified lead, Converted lead, Book appointment or Request quote. Google says these goals "automatically trigger invalid traffic protections, built specifically for lead generation campaigns."
  2. Send CRM results back to Google Ads with enhanced conversions for leads or offline conversion import, ideally every day. If you upload through an API, see how to upload offline conversions with the Data Manager API.
  3. Make the raw form fill secondary. Secondary actions are "for observation only": they show in the "All conversions" column but aren't used for bidding (unless they sit in a custom goal).
  4. Check the volume. Google asks for at least 15 conversions in the last 30 days on the action you bid on, ideally one that happens within 7 days of the ad interaction.

Expect a 7 to 14 day learning phase after you change goals, and avoid other big changes during it.

Can I remove fake leads that already counted as conversions?

Yes, with a conversion adjustment, if you can identify the conversion: by its order ID (transaction ID), or, for an imported offline conversion with no order ID, by its GCLID and conversion time. Upload a retraction with the order ID and the conversion action name, the same way you import offline conversions. It removes the conversion from your counts and from CPA and ROAS bidding. Google suggests uploading at least 24 hours after the conversion, and bidding only reads adjustments made within 7 days of the conversion being recorded (you can adjust for up to 54 days in total). You can't undo a retraction, only re-upload the conversion as a new event.

Do Google's lead form assets get fewer fake leads?

They have settings built to filter junk. Lead form assets work in Search and Performance Max campaigns, and three settings help:

  • "More qualified" form type: adds steps, so you get fewer leads with more interest. The default is "More volume."
  • Phone number verification: adds a one-time SMS code that Google says filters "invalid numbers, automated spam, and bots." It works in Search campaigns only for now.
  • Qualifying questions: mark a multiple-choice question as qualifying, and matching answers are tagged as qualified leads.

Google keeps form leads for 60 days and lets you download the last 30, so send them to your CRM with a webhook, the Google Ads API or Zapier.

Which campaign settings cut low-quality traffic?

Start with these:

  • Location: change "Presence or interest" to "Presence," so ads show to people in or regularly in your locations.
  • Networks: Search campaigns let you opt out of Search partners and the Display Network. As channel prioritization reaches your account (it's rolling out over the coming months), you can instead set them to Low priority with a budget allocation, where 0% means no spend. Performance Max gets the same Low priority setting for Search partners and Display. See how to stop Display from using your Search budget.
  • Placements: account-level placement exclusions (up to 65,000) keep ads off specific sites, apps and videos on YouTube, the Display Network, Google video partners and Search partners. For Performance Max, Google says these may need to be set at the account or manager account level.

Should I block IP addresses?

Only for repeat offenders from a fixed address. You can exclude up to 500 IP addresses per campaign, and use an asterisk (*) in place of the last 3 digits to block a range. Performance Max doesn't take campaign-level IP exclusions, but account-level IP exclusions cover every campaign, including Performance Max. Google notes that offices, universities and mobile carriers often share one public IP address across many devices, so one address can stand for many real people.

How do I report fake leads to Google?

Use the Click Quality Form for activity in the last 60 days. For lead problems, Google asks for a spreadsheet with the GCLID of each lead and your assessment of it (such as what happened when you emailed or called), plus dates, campaign names and server logs with IP addresses. To have GCLIDs, turn on auto-tagging and save each lead's GCLID in your CRM. Reviews take several business days, and Google credits you if it finds invalid traffic its filters missed, though it won't say which clicks were invalid. A credit pays back clicks; it doesn't clean the leads out of your CRM.

Do I need a third-party click fraud tool?

That's your call. Google says third-party tools often flag traffic that its defenses already caught and didn't bill you for, and it can't compare their reports click by click. Before you buy one, add the Invalid clicks column and see whether your junk leads come from clicks Google already filtered. Whatever you use, the form checks and conversion setup above are what keep junk out of your CRM and your bidding.

Sources (15)

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

Related answers

More on