The usual symptom arrives before anyone names it. Cost per lead drops, form volume rises, and the bid strategy reports that it is learning well. Then sales says the phone numbers are dead, the emails bounce and nobody replies. The dashboard and the pipeline have stopped agreeing.
This guide works through that gap in order. First, what Google itself says about invalid leads. Then the form checks that stop bots, how fake leads teach Smart Bidding the wrong customer, how to feed qualified leads back, and what click-level protection can and can't add. If you want the media-side baseline first, read our guide to Google Ads invalid traffic benchmarks by campaign type.
What does Google's invalid-leads guidance say?
Google says its filters stop you paying for invalid clicks, but they do not stop invalid leads, so the form is your job. The "Prevent invalid leads" page explains why: "Most traffic checks happen after your ad serves," so "users or bots can still reach your website and submit fake or low-quality lead forms." It adds that real users can also type fake email addresses or phone numbers (Google Ads Help, answer 18179211).
The "About invalid traffic" page makes the same point from the billing side. Google combines automated filters, machine learning and manual reviews, and invalid clicks caught before billing are removed from your bill and metrics. Its section on invalid leads repeats that the filters "run after an ad serves" and points to the same safeguards (About invalid traffic, Google Ads Help). If the term is new, our invalid traffic glossary entry covers the categories Google uses.
Here is what Google recommends, grouped the way its page groups it:
| Google's recommendation | What it does | Where it applies |
|---|---|---|
| reCAPTCHA on web forms | Challenges automated submissions | Your website forms |
| Double opt-in | Counts a lead as valid only after the user clicks an emailed confirmation link | Your email and CRM flow |
| Server-side validation | Checks email domains and regional phone formats before the lead reaches your CRM | Your server |
| Lead goals | Optimize for goals such as Qualified lead, Converted lead, Book appointment or Request quote | Google Ads goals |
| Google tag and enhanced conversions | Tracks site actions and improves measurement accuracy | Google tag setup |
| Content suitability | Content and placement exclusions control where ads appear | Account and campaign settings |
| Brand exclusions | Keeps ads off branded queries you want to avoid | Campaign settings |
The list splits into three groups. The first three rows protect the form. The next two decide what Smart Bidding learns from. The last two narrow the inventory that tends to produce low-intent traffic. You need all three groups working, because a clean form with a soft conversion goal still teaches the bidder to chase volume.
How do you stop bot form submissions?
Stop bot form submissions with layered checks: a challenge in the browser, a trap the bot can't see, validation on your server, and confirmation that a human owns the email or phone. No single check is enough, because Google's page notes that "sophisticated bots can bypass browser controls and post fake data to your form."
Work through the layers in this order:
- Browser challenge. Add reCAPTCHA to every lead form, as Google recommends. It filters crude scripts and gives you a risk signal on the rest.
- Honeypot field. Add a hidden field that real visitors never see. A submission that fills it is almost always automated. Log it, then review how the field behaves before you auto-reject on it alone.
- Server-side validation. Re-check every field on the server, not just in the browser. Google asks for email domains that exist and phone numbers that match real regional formats before the submission reaches your CRM.
- Email confirmation. Use double opt-in. Google's wording is to mark someone as a valid lead only "after they click the verification link," which confirms the address is "real, active, and human-monitored."
- Phone verification. For high-value offers, send a one-time code by SMS or call back before sales picks the lead up.
- Pattern checks. Flag duplicates, the same values submitted across many forms, and bursts of submissions from one source in a short window.
Two edge cases catch teams out. A human click worker can pass reCAPTCHA and fill the form correctly, so you only catch them through the pattern checks and through what happens after the click. And a lead form asset or a Meta Instant Form never loads your site, so none of these website checks apply. The in-ad settings for those forms are covered in our Google Ads lead form spam guide, linked below, and in the Instant Form guide.
Industry matters too. High-CPC B2B accounts tend to feel this first; see click fraud protection for B2B SaaS for website-form checks in that setting. Local trades get junk calls alongside junk forms, and click fraud in home services ads for HVAC, plumbing and roofing shows how to keep short calls out of conversions. Legal Search carries the same risk at a higher click price, and click fraud in Google Ads for law firms shows how intake dispositions separate junk consultations from real cases.
How do fake leads train Smart Bidding?
Fake leads train Smart Bidding because the bidder treats every conversion you count as a success and goes looking for more traffic like it. If a bot form fill fires the same conversion action as a real enquiry, the model can't tell them apart. It will happily spend more on the queries, placements, devices and audiences that produced the junk, because that junk was cheap.
The loop runs like this. Weak or automated traffic clicks the ad. A form fill or soft event fires as a conversion. Google Ads records it as a win. Smart Bidding raises bids on traffic that resembles it. More of the same junk arrives, and reported cost per lead improves while sales acceptance falls.
The model is not broken. It is doing what the conversion data told it to do. That is why the damage reaches well past one bad lead:
- Bid strategy. Bids rise on the contexts that produce cheap conversions.
- Expansion. Broad match, Performance Max and Search partners extend into more of the same inventory.
- Budget allocation. The campaign with the lowest visible CPA wins more budget, even if it closes nothing.
- Reporting. The team stops trusting the numbers, or worse, keeps trusting them.
You usually see the warning signs before you can prove the cause:
| What the platform shows | What the business sees | What it usually means |
|---|---|---|
| Cost per lead falling | Sales acceptance rate falling | The bidder found cheaper, weaker conversions |
| Lead volume rising | Close rate flat or falling | Volume is coming from traffic that never buys |
| Performance Max or Search partners looking efficient | Sales complaining about those leads | Expansion inventory is feeding soft conversions |
| Bid strategy unstable after expansion | Junk patterns in the CRM | The model is learning from mixed signals |
Search partners deserve a specific look here, and our guide to Google Ads Search partners and lead quality shows how to split them out. For the wider review routine, pair this with the Google Ads traffic quality review and Performance Max click fraud protection.
When data exclusions help, and when they don't
Data exclusions are the tool people reach for once they spot a run of junk conversions, but Google built them for something narrower. Its page describes them for conversion data outages, such as broken tracking, a tag placed incorrectly, or offline conversions you temporarily couldn't upload (Use data exclusions for conversion data outages, Google Ads Help). It does not describe them as a filter for spam leads.
If an outage does apply, three rules from that page matter:
- Dates apply to clicks, not conversions. Because conversions lag clicks, exclude earlier click dates too. Google's example covers an issue from 15 to 18 October with a 5-day conversion delay, so the exclusion runs from 10 to 18 October.
- Cover most of the damage. Google calls it "a best practice to exclude at least 90% of clicks associated with impacted conversion data."
- Use them rarely. Google warns that frequent or long exclusions can hurt Smart Bidding performance, and says not to remove an exclusion once applied.
For ongoing fake leads, the fix is upstream: block the sources, tighten the form, and change which conversion the bidder optimizes toward.
If the junk comes from duplicate tags, test fills or the wrong counting setting, our guide to Google Ads fake conversions shows how to find and fix each one.
How do you feed qualified leads back to Google Ads?
Feed qualified leads back by importing your CRM outcomes as Qualified lead and Converted lead goals, and by using enhanced conversions for leads to match them to the original click. This shifts the bidder's target from "any form fill" to "a lead your sales team accepted."
Google's page on these goals says a Qualified lead tracks a lead "further qualified offline," for example in a CRM, and a Converted lead tracks one that reached a step you define, such as a closed deal. Both rely on an offline conversion import, and Google says the deeper signals can help Smart Bidding and Performance Max (About qualified leads and converted leads, Google Ads Help).
Enhanced conversions for leads is how the match works. Your site sends hashed lead details, such as a hashed email, when the form is submitted. When the lead qualifies or closes, you import the same hashed data, ideally with the GCLID, and Google matches the two (About enhanced conversions for leads, Google Ads Help). Our walkthrough of enhanced conversions for leads and fake leads covers the setup and the checks to run before you upload.
One change matters for anyone with an older integration. The same Google page says that from 15 June 2026, offline conversion imports and enhanced conversions for leads uploads "will be migrated to the Data Manager API," and these uploads are blocked in the Google Ads API. If your CRM sync was built on the old upload method, confirm it now sends through Data Manager or the Data Manager API.
A practical order for the switch:
- Tag sales outcomes in the CRM: accepted, qualified, disqualified as junk, closed.
- Create the import: a Qualified lead or Converted lead conversion action, fed from the CRM.
- Turn on enhanced conversions for leads: hashed email on the form, the same hash in the import.
- Check the upload path: Data Manager or the Data Manager API, not the legacy Google Ads API upload.
- Demote raw form fills: keep them as secondary so they report without steering bids.
- Review by campaign type: compare cost per qualified lead, not cost per form fill.
Credits from Google don't replace any of this. They may return some billed spend, but they don't undo wasted sales time, a polluted CRM or the bidding lessons already learned.
What can click-level protection add, and what can't it see?
Click-level protection stops repeat fraud sources before they reach your forms, which keeps both your budget and your conversion data cleaner. Form checks catch bad leads after the click. Click protection works one step earlier, on the traffic itself.
On the landing-page path, ClickFortify scores every paid click against 100+ device, network and behavior data points in real time. It excludes invalid IPs automatically through your Google Ads IP exclusion lists and keeps an evidence trail for each block. Fewer fraudulent clicks reach your forms, so less junk reaches the conversion data Smart Bidding learns from. The Google Search protection page shows how the exclusions and evidence log work.
What it can't see matters as much. ClickFortify cannot see Google Ads lead form asset submissions or Meta Instant Form submissions, because those forms open inside the ad and never load your site. It also can't see call-asset calls. For those, the platform's form settings and your webhook or CRM checks are the defence. Our guide to Google Ads lead form spam covers the form settings and webhook checks that do the filtering instead.
Put together, the layers split the work cleanly:
| Layer | Catches | Misses |
|---|---|---|
| Google's invalid traffic filters | Invalid clicks, removed from your bill | Fake leads submitted on your site |
| Click-level protection | Repeat fraud sources on the landing-page path | In-ad lead forms and Instant Forms |
| Form checks and double opt-in | Bots and fake contact details | Real people with no buying intent |
| Qualified and Converted lead goals | Junk that never qualifies, so it stops steering bids | Nothing at the form; it changes what the bidder learns |
For teams weighing manual cleanup against a tool, pricing, features and how it works set out what is included, and the click fraud protection software page covers both supported platforms.
Check your account this week
If you suspect fake leads, run this on the last 30 days:
- Break leads out by campaign type: Search, Performance Max, Display, Shopping and Demand Gen.
- Compare cost per lead with sales acceptance rate and qualified lead rate for each.
- Flag any source where cost per lead is improving while qualification is falling.
- Check device, geography and network splits inside those sources.
- Confirm which conversion action your bid strategies optimize toward, and whether raw form fills are still primary.
Our verdict: if cost per lead and qualified lead rate move in opposite directions for more than a few weeks, believe the pipeline, not the dashboard. Fix the conversion goal first, because that is what the bidder learns from, then tighten the form and the traffic.
