Severe click fraud in Google Search from real people, not bots: how do you detect and stop it?

If the clicks come from real people, a bot filter will not catch them, and that is exactly why this is hard. You find it by looking at what those visitors do after the click, and you stop it by changing what you let count as a conversion, not by chasing every click.

Start with the boring explanations, because they are more common than fraud. Broad match pulling in the wrong searches, locations set to people in the area rather than people searching in the area, search partners, and a landing page that loads slowly on mobile can all produce clicks that look like waste. None of these are fraud, and none of them are fixed by a fraud tool.

Next, look at the pattern, not the individual click. Real-person fraud usually shows up as a cluster: many clicks from one city or one network in a short window, sessions that last a second or two, no scrolling, the same device type and screen size repeated, or a spike on one keyword and nothing around it. A made-up example, invented for illustration: a locksmith sees 40 clicks on one keyword between 2am and 4am, all from the same mobile carrier, none of them scrolling. That is worth a closer look. Forty scattered clicks across a day is not.

Google's own report only goes so far. The invalid clicks column covers what Google itself caught and refunded automatically. It will not show clicks Google considers valid that you consider worthless. So build your own check: log the visit, the time on page and whether the visit reached the form, and compare by campaign, keyword, network and hour.

Then change the incentive. If a click that does nothing still counts as a conversion, you are paying to be fooled. A form fill from one of these visitors is the real damage, because Smart Bidding learns from it and goes looking for more people like that. Move the optimisation point later: send booked or qualified as the conversion you bid on, so a fake enquiry that never books teaches the system nothing.

You can also tighten the front door. Exclude placements and search partners that do not convert, add negative keywords from the search terms report, and review the geography where the cluster comes from. These are cheap, reversible moves, and they tell you quickly whether the problem is the traffic source or the page.

For evidence, keep a record. If you decide to ask Google for a credit, a dated list of the suspect clicks, the IP ranges or networks, and what they did on the page is far more useful than a general complaint. Google decides what to credit, so treat it as a request, not a promise.

Where DataCops helps is on the website side of this. Every visit gets a bot verdict, and a Real people only switch per ad platform can keep flagged visits out of what that platform learns from. It is off by default, so you choose after looking at your own numbers. It will not label a real person who clicks for no reason as a bot, so the booked-not-lead rule above still matters.

If you tell me the vertical and roughly how many clicks a day you get, I can suggest which of the checks above to run first.