How do you spot lead generation fraud and bot leads in your own campaigns?

This post is about junk that comes in through campaigns you pay for and forms you control: what it looks like, why it gets in, what Google and Meta do about it, and how to keep it out of your forms and your numbers.

If your worry is a lead seller passing you recycled or invented contacts, that's a different problem, covered in is lead generation a scam.

What counts as lead generation fraud in your own campaigns?

Anything that arrives looking like a lead but was never a prospect. It usually takes one of these forms.

• Bots that find your form and post into it again and again, with random text or details copied from elsewhere.
• Invalid clicks. Google's definition includes clicks from automated tools, manual clicks meant to run up your costs, and clicks meant to earn money for sites showing your ads.
• People paid or rewarded to fill in forms, typing believable details with no intention of buying.
• A real person's name and cellphone number, entered without their knowledge, so the person you phone has never heard of you.
• Low-intent taps. Meta can prefill a person's name, email address and phone number on its instant forms, so submitting is quick. It isn't fraud, but it wastes the same time.

The cost runs past the click. Your team phones numbers that go nowhere, and your cost per lead looks better than it is. Worse, your ad platforms learn from the bad examples.

Why do fake leads get into Google and Meta campaigns?

Mostly because the campaign was set up to collect anyone who fills in a form. Meta describes its Maximize number of leads goal as showing your ad to the people most likely to share their contact information. That isn't the same group as the people most likely to buy.

Google Ads has the same blind spot. If every form fill counts as a conversion, Smart Bidding can't tell a bot's submission from a buyer's, and it learns from both.

Settings make it worse. Google warns that a Display Network campaign that hasn't been optimised can show your ads on sites unrelated to what you sell, and that general keywords and ad text bring in people expecting something you don't offer. Forms that accept anything finish the job. Nothing is checked where the data arrives, and nothing asks a question only a real customer could answer. Google's own lead quality advice starts with server-side validation and double opt-in.

So before you go looking for a fraudster, look at how the campaign is built.

How can you tell which campaign is sending fake leads?

Read the lead next to the ad data. One odd enquiry tells you little. A pattern tells you where the junk comes from. Look for:

• Bursts of leads, often overnight, mostly from one campaign, ad set or placement.
• Conversions climbing in Google Ads or Meta while calls, booked visits and sales stay flat.
• Answers that don't fit the question, like a web address in the name field or a suburb you've never served.
• The same details arriving several times in a day, or through two different forms.
• Forms sent faster than anyone could type, if you record when the page loaded.

Say you run Meta lead ads for a solar installer in Pretoria, and Monday's inbox holds a run of leads sent after midnight, all from one ad set, several with numbers that don't ring. That ad set is your first suspect, not the whole account.

To trace leads like this, record where each one came from. Google's auto-tagging adds a click identifier, the GCLID, to the address people land on from your ad. Capture it in a hidden form field and store it with the lead, and every enquiry traces back to its click. Keep Meta leads tied to their campaign, ad and form when they move into your CRM.

What does Google Ads do about invalid clicks?

Google filters invalid traffic automatically, and you aren't charged for the clicks it catches. If it finds invalid activity after you've been invoiced, you get a credit on a later invoice, not a refund. The Invalid clicks column in your campaign table shows what was filtered. Google sets this out on its invalid traffic help page.

If you think something slipped through, you can ask for an investigation into the past 60 days of traffic. Google asks for dates, campaigns, keywords and server logs with IP addresses, user agents and GCLIDs. You can also exclude IP addresses, though Google points out that repeated clicks from one address aren't always invalid, because some internet providers share addresses between many users.

Google only judges the click. A genuine click followed by invented details in your form isn't invalid traffic. Google also notes that, in rare cases, a click is ruled invalid while the conversion after it stays in your reports. So check the leads themselves, even when the Invalid clicks column looks clean.

What does Meta offer against junk form fills?

Three instant form settings do most of the work, and the default isn't one of them. The default form type, More volume, is built for quick submission on a phone. Higher intent adds a review screen where people confirm their details, and Meta says it's meant to cut submissions from people who are only marginally interested.

The stronger filter is SMS verification. People confirm their mobile number with a one-time passcode before the form submits, so a made-up number, or somebody else's, goes no further. A landline can't receive the code, so its owner can't submit. If your customers give cellphone numbers anyway, that costs you little.

Then add custom questions that only a real prospect answers well, like the suburb the job is in or when they need it done. Each layer cuts your lead count, and what remains is worth phoning. If you're weighing an instant form against a WhatsApp chat or your own landing page, our Meta Ads South Africa page compares them.

How do you keep bots off your website forms?

Stack a few cheap checks, and send doubtful submissions to a review folder instead of deleting them.

• Add a honeypot, a form field your code hides from people but bots can still see. People leave it empty. Many simple bots fill in every field, so anything in it flags the submission.
• Score submissions with Google's reCAPTCHA. Its score-based version, documented as reCAPTCHA v3, runs in the background and scores each one from 0.0, very likely a bot, to 1.0, very likely a good interaction. Google suggests starting at a threshold of 0.5, tuning it to your traffic, and handling low scores behind the scenes rather than blocking people.
• Validate on the server. A bot can post straight to the address your form sends to, skipping any checks in the browser, so check the phone number, email address and required fields where the form is received.
• Confirm contact details with an email link or an SMS code before you count the lead. Google's lead quality advice recommends double opt-in to confirm interest.
• Record when the page loaded and when the form was sent. Nobody types a full enquiry in a second or two.

No single check catches everything. Together they raise the cost for a bot, and only the confirmation step adds work for a real person.

How do you keep your lead reporting honest?

Count outcomes, not submissions. A report you can trust shows form fills, qualified leads and sales side by side, with every junk lead tagged by reason: bot, wrong number, out of area, never enquired. Whether you run campaigns yourself or pay for lead generation, ask for those three numbers every month.

Judge campaigns on cost per qualified lead. Junk inflates the lead count and flatters the cost per lead. It also drags down your close rate, which throws out the maths behind what a lead is worth to you.

Then tell the platforms what happened. Google Ads has qualified lead and converted lead goals imported from your CRM, so bidding works towards leads that went somewhere. Enhanced conversions for leads matches those outcomes to the original ad using hashed details such as the email address. Meta's Maximize number of qualified leads goal does the same on Facebook and Instagram, and needs your CRM connected through Meta's Conversions API.

How does Position Xero deal with fake leads?

It starts with what counts as a conversion. On our Google Ads South Africa page we define conversions as the things you get paid for, such as a submitted quote request or a booked site visit, because vanity conversions train Smart Bidding to buy more of the wrong thing. Our Google and Meta ads management includes conversion tracking setup, a landing page review and negative keyword lists.

On lead generation campaigns, forms carry pre-qualification questions designed to filter out unsuitable prospects before they reach your inbox, and every lead is checked against criteria you set. The ad accounts are registered to your business and the reports are yours, so you can check the ad-driven lead counts in our reports against Google's and Meta's own data. We report on cost per lead and revenue, not impressions.

Where do you start if you suspect fake leads?

1. Export last month's leads and mark each one real, junk or unsure, with a reason.
2. Line the junk up against campaign, placement and time of day, and look for clusters.
3. Add a hidden GCLID field to your website forms.
4. Add the Invalid clicks column in Google Ads. If you find a pattern Google missed, gather your logs and request an investigation inside the 60-day window.
5. Switch on the protections that fit: higher intent and SMS verification on Meta, and a honeypot, reCAPTCHA and server-side checks on your site.
6. Report qualified leads and sales, and send them back to Google and Meta.

Run the same tagging a month later. If junk falls and qualified leads hold steady, the changes are working.

Related Articles