In short: part of what you spend on Display, video and PMax goes to an ecosystem built to charge for impressions and clicks: site farms, filler apps, bots, malicious clicks and form spam. Google filters the obvious and refunds invalid clicks, but doesn't stop the subtle stuff. Unwatched, between 20 and 50 % of Display spend can be rubbish.
Part of the money you spend on Google Ads — above all in Display, video and PMax — never reaches a single interested person. It goes to an ecosystem that exists to get paid for impressions and clicks. This module is the map of that ecosystem and the defence of an account. It starts by understanding who gets paid, and how.
Who takes part in ad fraud?
| Player | How they make money | Where it hits you |
|---|---|---|
| Site farms (MFA, made for advertising) | Sites with copied or generated content, dozens of ad blocks per page, bought traffic or bots; they get paid per impression and click through AdSense/Ad Manager | Display, PMax, Demand Gen (partners), video (partners) |
| Filler apps | Children's games, torches, wallpapers; ads placed where the finger lands; rewards for clicking | Display, PMax, apps |
| Non-human traffic | Bots that load pages and press ads to simulate an audience; proxies and data centres | Display; also Search (repeated clicks) |
| Competitor clicks and malicious clicks | People or tools that drain your budget in Search | Search (expensive keywords) |
| Form spam | Bots that fill in forms: they do not steal clicks, they steal conversions (Smart Bidding learns from them) | Acquisition |
| Farm networks | Dozens of domains belonging to one operator: same IP, same name servers, same publisher; exclude one and another takes its place | The whole of Display |
The incentive is simple: inventory is paid for per impression/click and any impression is worth the same to whoever is selling it. Creating fake inventory is a high-margin business.
Which fraud does Google detect?
Google filters invalid traffic (clicks and impressions it considers accidental, duplicated or fraudulent) and does not charge you for it; you can see it in the "Invalid clicks" column. It reasonably detects the obvious: repeated clicks from the same IP within seconds, known bots, mass patterns. You can also exclude IPs at account level (up to a certain number) — today that is an account setting and it affects every campaign.
Which fraud doesn't Google stop?
- Farms with real human traffic (bought or from clickbait): the people exist, they are not interested in you, and the impression counts.
- Accidental clicks in apps: those are human.
- Sophisticated bots (residential, human-like behaviour).
- Rubbish content: Google sells that inventory; its quality filter is lax.
- Form spam: that is not invalid traffic, it is a conversion.
Google has a structural conflict of interest: it is both the seller of the inventory and the referee of its quality. It filters what would damage it as a brand (scandalous fraud), not what only damages you.
How much money is lost to ad fraud?
It varies by sector and setup; in Display accounts with no monitoring, finding that between 20% and 50% of the spend went to placements with no value at all is routine (the cases from the Basic level). In Search, malicious clicking is smaller but concentrated on expensive keywords. In acquisition, form spam can be the majority of the "leads" from a campaign with no filters.
Why is the defence against fraud yours?
Nobody else has the incentive: not Google (it sells the inventory), not the farms (they live off it), not the intermediaries. The defensive tools exist — placement reports, account-level exclusions, IP exclusions, form filters, lead scoring — but someone has to use them, and at scale you can only use them automated. The rest of the module is that defence.
💡 Ninja trick: Ninja Shield was born from this observation: fraud repeats across accounts. The same farm that turned up in a training client turns up in a home improvement one; the torch app is the same for everybody. What one account learns protects the rest. That is why the Shield keeps a shared census of domains and signals: the community against an ecosystem that is also a community.
What you should remember
- The players: farms, filler apps, bots, malicious clicks, form spam, networks.
- Google filters the obvious and refunds you the invalid clicks; it does not stop farms with humans, apps, sophisticated bots or form spam.
- Between 20% and 50% of unmonitored Display spend can be rubbish.
- The defence is yours, and at scale, automated.