How to Stop Fake Leads from Google Ads (Step-by-Step)

Google will give you your money back for a bot click. It will not give you your afternoon back for the twenty junk enquiries that bot left in your CRM. That asymmetry is the core reason you have to stop fake leads from Google Ads yourself: the platform's defences and your lead quality are two different systems, and the seam between them sits exactly where a click becomes a form fill.

Google's own documentation is unusually frank about the gap. Its invalid traffic guide notes that automated protections "cannot block traffic from your site because they run after an ad serves, but you can take steps to protect your lead quality." Billing protection is not form protection. The rest of this guide is the second half of that sentence: an ordered fix using the controls Google actually ships, plus the one layer it cannot ship, at the form itself.

Why do fake leads keep getting through Google's filters?

Because Google's invalid-traffic filters are built to protect your invoice, not your inbox. They detect bots and accidental clicks after the ad serves, strip detected traffic from your billing and reports, and leave everything that happens on your website, including every form submission, entirely to you. Fake leads live in that gap.

The filters do real work. Google cites bots and automated software, accidental clicks, clickjacking and ad stacking among the traffic it detects and filters, and it automatically removes invalid traffic found before the end of your billing cycle. If you spot it later, there is an investigation request route covering activity from the last 60 days. Worth knowing; use it where it applies.

The catch is what the filters cannot see. A person typing a disposable email address into your landing-page form is a valid click, a valid session and, if your tracking is naive, a valid conversion. Nothing about the traffic is invalid, so no filter flags it. That is the expensive end of the problem, and no amount of waiting on Google's side closes it.

Nor is the waste trivial further upstream. The ANA's 2023 programmatic transparency study, covering $123 million in spend across 35.5 billion impressions, concluded that roughly 23% of the $88 billion open-web programmatic ecosystem, some $20 billion, was recoverable waste. Search leads are a cleaner lane than open-web display, but the lesson transfers: the buyer, not the platform, owns quality.

Step-by-step: how to stop fake leads from Google Ads

Work the steps in order. Each one is small; together they close the loop from traffic to enquiry to bidding signal.

1. Measure your junk rate before touching anything. Export a fortnight of leads, mark each one genuine or junk, and compute the split. Guesswork here wastes every later step, because you cannot tell a fix from a quiet week without a baseline. If you want a second opinion on the export, LeadShield's free audit screens up to 250 rows with no signup, no card and no install, and returns a verdict, risk score and reasons per row. Bulk mode runs deterministic checks only, a CSV row has no browser session or IP, and the tool says so rather than pretending otherwise. (run the free audit; how to measure your rate properly)

2. Turn the search terms report into negative keyword lists. The report shows the actual searches that triggered your ads, and it is the cheapest junk filter you own. Build shared negative keyword lists from it, up to 5,000 keywords per list and 20 lists per account, and apply them across campaigns rather than patching one ad group at a time. ⚠️ One documented limitation: Google omits search terms without enough query activity for privacy reasons, so a clean report is not proof of clean traffic. Watch the search terms insights sub-themes too.

3. Exclude the placements that repeatedly send junk. Account-level placement exclusion lists override campaign and ad group settings, cap at 20 lists with 65,000 exclusions each, and since March 2024 they also cover the Search partner network. For Performance Max, placement exclusions are managed at account level only. Leave off the "www." when you exclude a domain, so the subdomains come with it. Serial offenders, single junk-heavy apps and made-for-advertising style sites belong here.

4. Exclude IP addresses, at both levels. You can exclude up to 500 IP addresses per campaign, and IP exclusions are now supported at account level across campaign types including Performance Max, Demand Gen, Search and YouTube; Google merges the lists. Use every version of an address you see (IPv4 and IPv6), and use the asterisk form to exclude blocks. ⚠️ Keep expectations honest: most form-fill junk arrives from rotating or residential ranges, so IP exclusion trims repeat offenders rather than solving the problem alone. The layers further down catch what this one misses.

5. Stop counting junk as conversions. This is the step that pays compound interest. Use lead-specific conversion goals, such as qualified lead or converted lead; Google says these "automatically trigger invalid traffic protections, built specifically for lead generation campaigns". Then feed bidding the truth: import offline conversions, or better, enhanced conversions for leads, which matches conversions on first-party data like email addresses instead of leaning on the click ID. When only verified genuine enquiries count, Smart Bidding stops being subsidised by ghosts.

6. Suppress known junk identities with Customer Match. Take the email addresses behind repeated junk submissions, hash them with SHA-256 (or let Google hash them on upload), and load them as an exclusion audience, subject to Google's Customer Match policy and eligibility. Files need a minimum of 100 user records, and a list stays eligible only if at least 100 members are added or refreshed within 540 days. 🔍 Calibrate expectations: match rates on throwaway addresses are naturally low, so this suppresses repeat identities rather than stopping new junk. It is a backstop, not a frontline defence.

7. Validate the enquiry at the form itself. The one place you can inspect a lead before it becomes a conversion is the moment it is submitted. LeadShield does this with a single JavaScript snippet: each submission is scored in real time across email, disposable-domain, MX and typo checks, phone validation, behavioural bot detection and IP reputation, and every blocked lead carries a plain-English reason plus a CSV export trail. On Professional plans and above, the Google Ads IP-exclusion export turns your blocked-lead IPs into the step-4 list, and the SHA-256 hashed suppression export feeds the step-6 audience. Both are exports you upload yourself; nothing touches your ad account automatically. 14-day trial, no card, plans from $39/month.

How do junk leads distort Smart Bidding?

Every junk form fill your tracking counts as a conversion teaches Smart Bidding that the campaign which produced it works. The algorithm then buys more of what generated it: the same queries, placements and audiences, at a slightly better reported CPA than reality justifies. Your reported cost per lead falls while your cost per genuine lead rises, and the two lines keep diverging until someone reconciles them against the CRM.

This is why step 5 matters more than any exclusion list. Exclusions reduce the junk that arrives; conversion hygiene stops the junk that still arrives from steering budget. We have covered the mechanism in detail before, including how junk conversions quietly train ad platform optimisation towards more of the same traffic.

What can't keywords, IPs and placements fix?

The leads that cost you the most are the ones that look least like bots. A person typing a disposable address, or an AI-assisted enquiry paced like a human, produces a clean click, a real session and a well-written message. No exclusion list catches that, because nothing about the traffic is identifiable as junk. Only the enquiry is.

This is also why a passed CAPTCHA proves so little: a human-typed fake address clears every visual puzzle you show it, a trade-off we examined in our piece on whether reCAPTCHA stops fake leads. The same gap explains why form-builder defaults disappoint on WordPress sites; the builders stop scripts, not fake enquiries. The missing layer is always the one that judges the lead itself: the domain, the phone number, the behaviour.

How do you know the fix worked?

Compare cost per genuine lead, not cost per lead, across equal windows either side of the change. A fortnight before, a fortnight after; divide spend by verified genuine enquiries in each window and keep the junk rate visible alongside. If cost per genuine lead falls while the junk rate falls, the fix worked. If only the junk rate falls, you blocked traffic that was never buying anyway, keep tuning.

⚠️ Change one layer at a time where you can. If you deploy negatives, IP exclusions, conversion fixes and validation in the same week, you will never know which one carried the results, and you will relearn the lesson the expensive way next quarter. Any dashboard "savings" figures along the way are estimates of avoided cost based on your own cost-per-lead input, not money recovered; treat them as a compass, not a bank statement.

Frequently asked questions

Does Google refund invalid traffic on lead campaigns? For traffic Google itself detects as invalid, yes: it is removed from billing and reports before the end of your billing cycle, and later finds can earn credits. The catch is that fake enquiries from valid human sessions are not invalid traffic, never register as such, and are not refundable. That class of junk is yours to filter.

How many IP addresses can you exclude in Google Ads? Up to 500 IP addresses per campaign, with account-level exclusions also supported and merged across campaign types, including Performance Max. Remember to exclude all versions of an address, and expect this control to catch repeat offenders rather than rotating bulk junk.

Do negative keywords stop fake leads? They stop junk queries, which is necessary but partial. Negative keyword lists (5,000 keywords per list, up to 20 lists) will cut the obvious dross from your search terms report, but they do nothing about a well-formed enquiry from a disposable address on a perfectly relevant query. Keywords filter intent, not honesty.

Can you upload junk leads back to Google as a suppression list? Yes, via Customer Match: SHA-256 hash the emails, upload as an exclusion audience with at least 100 user records, and refresh within 540 days to stay eligible. Match rates on disposable addresses are low, so treat it as suppression of repeat offenders, not a primary defence.

What is the single best first step? Measure your own junk rate from your own export. It takes minutes, needs no install, and every later decision, negatives, IPs, conversion fixes, validation, depends on knowing whether your problem is 5% junk or 50% junk.