How to check whether your Google Ads clicks are real: a 10-minute audit

You can check whether your Google Ads clicks are real without buying anything first. Google Ads, your analytics and your own inbox already hold most of the evidence. This audit walks through it in three short passes: about four minutes in Google Ads, three in your analytics and three with your own lead records.

The aim is not to prove fraud. It is to find out whether the clicks you pay for behave like people who might buy, and, where they don’t, to narrow down why. A short visit or a repeat visit is a reason to look closer, not a verdict.

Minutes 1–4: what Google Ads already tells you

1. Add the invalid click columns

Google Ads has two columns that many advertisers never switch on: Invalid clicks and Invalid click rate. Add them to your campaigns table through its column settings. They count clicks that Google’s own systems identified as invalid, such as accidental repeat clicks or automated activity, and filtered out so you were not charged for them. See Google’s definition of invalid clicks.

Read these columns as a floor, not a total. They describe what Google caught. A low figure means Google’s filters found little; it does not mean every remaining click came from a potential customer. A campaign whose invalid click rate stands clearly above your others is the first place to apply the checks below.

2. Read the search terms report

The search terms report shows the actual queries that triggered your ads. Scan the terms that collected clicks but no conversions. Irrelevant queries usually point to broad matching or missing negative keywords rather than fraud, but that is still budget you can stop spending by adding negatives. Strings that look machine-generated, or long runs of near-identical variations on one query, are worth noting for later.

3. Compare where users were with where you targeted

Your location reporting can show where the people who clicked your ads actually were, not only the locations you chose to target. If you serve one region and a noticeable share of clicks comes from people outside it, check two things.

• Your location setting. Depending on the option you chose, Google can show ads to people who are interested in your area as well as people who are in it.
• What those clicks produced. Out-of-area clicks that never convert, concentrated in places you have no business reason to reach, form a pattern worth recording.

4. Segment by time of day and device

Segment clicks and conversions by hour of day, day of week and device. Real demand has a shape: it follows your customers’ working hours, breaks and evenings. Clicks that arrive steadily through the night in your target market, or a jump on one device type with no matching rise in conversions, deserve a closer look. Compare with a period you trust before drawing conclusions, because some businesses genuinely get late-night buyers.

5. Check networks and placements

Open the settings of your Search campaigns and check which networks they use. Search campaigns can include Google search partners and, in some setups, the Display Network. Neither is fraudulent in itself, but both behave differently from Google Search. Segment performance by network and compare conversion rate, not just click-through rate, for each.

For campaigns that show ads on websites and apps, review where your ads appeared. A placement with a high click rate and no conversions is a stronger signal than either number alone. People who click and buy look different from clicks that arrive in volume and leave nothing behind. Exclude placements based on the quality of what they send you, not on their cost.

Minutes 5–7: what happens after the click

Google Ads tells you about the click. Your analytics tells you what the visitor did next. In GA4 or a similar tool, filter to paid Google traffic, for example the google / cpc source and medium or your linked Google Ads campaigns, and compare it with organic and direct traffic over the same period.

6. Engaged sessions from paid traffic

GA4 counts a session as engaged when it lasts beyond a short minimum, includes a key event or views more than one page. Compare the engagement rate of paid traffic with your other channels and between campaigns. One campaign far below the rest while sending visitors to the same landing page is a lead. If every channel is low, look at the page itself: load speed, the mobile layout and whether the offer matches the ad.

7. Very short sessions

Look at how engagement time is distributed for paid traffic, not just the average. An average can hide a cluster of sessions that end almost immediately. Some short visits are normal: a mistaken click, or a visitor who found your phone number in seconds and called. A large cluster of near-zero sessions tied to one campaign, keyword or placement is not.

8. Repeat arrivals from the same address

Most analytics tools, GA4 included, do not show visitors’ IP addresses. Your server or hosting access logs usually do. Paid Google Ads visits normally carry a click identifier such as gclid in the landing-page URL, so you can filter the logs to paid arrivals and sort them by address. A few addresses landing on ad URLs again and again within a short window is exactly the kind of pattern that click-frequency rules exist for.

Treat addresses with care. Offices, mobile carriers and VPNs put many people behind one IP, and one person’s address can change during the day. An address is a lead to follow, not an identity. Read how IP blocking and person-based detection differ.

Minutes 8–10: what reaches your business

The last pass is the one only you can run, because the evidence sits in your inbox and your CRM.

9. Form submissions

Read the last few weeks of form submissions from paid traffic. Signs of automated or bad-faith entries include:

• nonsense names, or names and email addresses that don’t belong together;
• disposable email domains and phone numbers in the wrong format for your market;
• the same message submitted again and again;
• bursts of entries seconds apart, often outside your normal hours.

Form spam does more than clutter your inbox. If those submissions count as conversions, they become the signal Google Ads optimizes towards, which can steer automated bidding towards more of the same traffic.

10. Leads that never answer

Check what happened to the leads. How many could you reach, how many were real enquiries, and how many never answered or left details that don’t exist? Split the answer by campaign. A campaign that produces submissions nobody can reach costs you twice: once for the click and again for the time spent chasing it.

How to read what you found

Each of these checks has an innocent explanation on its own. Signals that line up in the same place are much harder to explain away. Write the audit up in four lines:

• Where: the campaign, keyword, network, placement or location that stands out.
• What: the signals that line up there, such as invalid clicks, low engagement, repeat arrivals and leads that never answer.
• When: the dates and hours, in one timezone.
• Ruled out: the tracking, form and landing-page problems you have already checked.

Then act on what you control: add negative keywords, tighten location settings, revisit network and placement choices, and exclude IP addresses that repeat on ad URLs where your campaign type supports it. The Google Ads protection checklist covers those settings in more detail.

If you believe you were charged for invalid clicks that Google did not filter, you can contact Google and request an invalid-click investigation. Keep your write-up ready: the dates, campaigns and repeated pattern are what an investigation needs. Google decides whether a credit is due.

What a manual audit cannot do

A manual audit is a snapshot. You find a pattern after the money is spent, and by the time you exclude an address, a persistent source may already be using another one. Three limits are hard to work around by hand:

• You see addresses, not people. Logs show IPs, and one visitor can arrive from several.
• You see summaries, not visits. Analytics aggregates sessions; it does not assess each one.
• You act later. Every exclusion waits for your next review.

What a dedicated tool adds

AdProtektor runs this kind of check on every visit as it happens. One script on your site scores each visit from 0 to 100 using more than 150 behavioral and technical signals, from engagement and device traits to network and campaign parameters.

• Person-based detection. Visits are linked to a person, meaning one browser on one device, and that identity survives IP changes. Repeat clicks from someone switching addresses still count against the same person.
• Classification. Each visitor is classified as Real, Crawler, Bot, Competitor or Click Farm. Legitimate crawlers such as Googlebot are always whitelisted, never blocked. A Competitor classification describes the activity; it does not identify a business.
• Automatic exclusions. When a visitor crosses your configured threat threshold or click-frequency rule, eligible IP exclusions are submitted to Google Ads through your connected account, with an audit trail. You set the rules once rather than approving each visitor.
• Evidence you can review. Person profiles show linked sessions and the reason behind each decision, and you can whitelist a legitimate visitor in one click. On Pro and above, session recordings let you watch flagged visits; disclose recording in your privacy notice where required.
• A refund report. The refund report exports the available invalid-click evidence to support an investigation request to Google.

It does not change how Google bills. The click that first reveals a fraudulent visitor is still charged; protection reduces the repeat clicks that follow it.

Run the automated version of this audit

The free click fraud audit is the hands-off version of this checklist. Install the script, keep your campaigns running as usual, and after three days of traffic you get a report built from your own visitors: how many were real, how many were bots, competitors or click farms, the paid clicks that were blocked, and an estimate of the budget they represent.