How do I know if I'm getting click fraud on Google Ads?

Short answer: you usually cannot prove it from Google Ads alone, but you can spot patterns that make it likely, and you can check most of them yourself in an afternoon. The strongest signals are clicks that cost money and never behave like a person.

Let me start with a made-up story. A plumber in a mid-sized city runs search ads on emergency terms. One week the account shows 300 clicks, and the phone rings twice. Cost per call triples. Nothing in the ads changed. That is the moment most people start suspecting fraud.

Suspecting is fine. But there are several boring explanations that look the same, so rule those out first: a broad match keyword pulling odd searches, a location setting that includes a wider area than you meant, a competitor budget change pushing your cost up, or a landing page that broke on mobile.

Then look for the patterns that point to non-human or non-buyer traffic.

Clicks with almost no time on the page. If a big share of visits from one campaign last a second or less, something is clicking without reading.

Odd bursts. A pile of clicks in a few minutes, often overnight, with no matching change in your budget or bids.

The same location or network showing up again and again, especially somewhere you do not serve.

Clicks with no matching activity in your own analytics. If Google reports 300 clicks and your site logs 120 visits, part of the gap is normal, since some people leave before the page loads. A very large gap is worth digging into.

Now the honest part. Google filters a lot of invalid traffic before it bills you, and if it finds more after the fact it issues credits to your account. Look in the invalid clicks column in your reports to see what it caught. That is real, but it only covers what Google itself detects. I have seen no trustworthy public number for how much it misses, and any confident percentage you read online is a guess.

What can an outside tool do? It can look at each visit on your own site and label it likely human or likely bot, so you can compare the ad click count with what actually behaved like a person. It can also help you build the evidence, such as the times, addresses and behaviour, if you want to raise a case with Google. What it cannot do is stop Google charging you for a click that already happened, and it cannot tell you a person's intent. A competitor browsing your site by hand looks like a visitor.

For reference, DataCops gives every visit a bot verdict, and Real people only is a per-platform switch that is off by default, so nothing changes until you turn it on. It does not automatically reclaim spend from Google.

A practical checklist. Export clicks by day and hour. Compare with site sessions. Sort by placement and location. Look at the invalid clicks column. Exclude places you do not serve. Tighten match types and negative keywords. Then wait a couple of weeks and compare. If cost per lead stays high after those cleanups, fraud becomes a more reasonable suspect.

Have you compared your click count with your session count lately? What was the gap?