Google Says Your Ad Clicks Are Fine. Half May Be Fake.
You are paying for clicks that will never become customers, and Google's dashboard is telling you everything looks healthy. That gap is the whole problem. Google catches some fake clicks and quietly credits you for them, which is not the same thing as your budget landing in front of real buyers. This piece proves you cannot trust the all-clear, shows you a five-minute check to see the damage yourself, then hands you one targeting lever that cut invalid clicks in half in a documented case.
The dashboard says "we caught it, you weren't charged." Read that again. It means Google found some bad clicks after the fact. It says nothing about the ones that slipped through, got billed, and burned your daily budget before a single qualified person saw your ad. So the fix is not to trust the note. Check it yourself, then pull the lever.
Bots and click farms are quietly eating a quarter of some budgets
A study of 43,700 advertising accounts by fraudblocker.com in February 2026 put the average invalid click rate at 11.4%. Picture a physical therapy clinic in Denver spending $6,000 a month on Google Search ads. At that rate, roughly $684 a month walks out the door on clicks from bots, click farms, and people who were never going to book. That is one new patient's worth of revenue, gone, every month, with no note in the dashboard flagging it as a loss.
The same study found accounts in competitive industries running above 40% invalid clicks. A personal injury lawyer, a water damage restoration company, a locksmith, these are the businesses where a click can cost $50 or more and where competitors and fraud rings circle hardest. At 40%, that Denver clinic scenario becomes a $2,400-a-month hemorrhage on a $6,000 budget. Almost half the money never had a chance.
The macro number tells you this is not a rounding error. Search Engine Land, citing Juniper Research, reported that "advertisers are estimated to lose $172 billion a year due to ad fraud by 2028." You do not lose $172 billion a year on the occasional stray bot. That number exists because most owners never look, and the ones stealing the clicks know it.
In real terms, that costs you budget. Every fake click does two things at once. It bills you, and it eats a slice of your capped daily budget, so a real buyer searching at 4pm finds your ad already paused for the day because bots spent it by noon. You pay twice: once in cash, once in the customer you never got to reach.
The word "invalid" on your dashboard is doing a lot of quiet work
Most owners see the invalid-activity credit line, think "good, Google handled it," and move on. That reflex is exactly what keeps the problem alive. Google's automated systems do catch and refund a portion of obviously invalid traffic. Nobody is disputing that they catch some. The catch is what "some" hides.
When Google credits you for invalid clicks, it is telling you about the fraud it detected and reversed. It is not telling you about the fraud it missed and billed. Those are two completely different buckets, and the dashboard only shows you the first one. So a healthy-looking credit column can sit right next to a campaign that is bleeding on undetected clicks, and nothing on the screen connects the two for you.
There is a structural reason the misses pile up. The people running click fraud are not sitting on one IP address waiting to get blocked. They cycle through VPNs and proxies, hundreds or thousands of addresses, so each click looks like it came from a fresh, ordinary visitor. Google's own tooling gives you a defense here that sounds useful and is nearly worthless against this: you can exclude IP addresses, but the cap is 500 per campaign. Against an operation rotating through more addresses than that before lunch, 500 exclusions is a screen door on a submarine.
This is the same blind spot that lets broad, account-wide waste hide in plain sight. If you have ever felt your account was leaking money without knowing where, the mechanics are worth understanding in full, and I walked through the wider version of that problem in a piece on the quarter of every dollar a typical account leaks on bad targeting and irrelevant search terms. Fake clicks are the sharper, uglier cousin of that same leak. The audit finds where you waste money on the wrong real people. This finds where you waste it on people who are not real at all.
A Premier Partner watched invalid clicks fall 50% with one setting
Google Premier Partner John Horn, CEO of the agency StubGroup, documented a case that shows both the scale of the problem and a fix, and it is worth noting this was his test, not mine. Writing in Search Engine Land on July 2, 2026, Horn described a book-editing and ghostwriting client whose numbers were, by any honest reading, broken. Google's own interface was reporting an invalid click rate of 60% to 80%. Click-through rates were coming in above 80%, some over 100%, which is a mathematical tell that something automated is hammering the ads. And GA4 sessions sat far below the clicks Google was reporting and billing.
That last detail is the one you can use. Say Google reports it sent you 1,000 clicks but your analytics only recorded 300 sessions. Those 700 missing "visitors" clicked your ad and never actually loaded your site as a real human would. Bots click. They do not browse. That gap is one of the cleanest signals of invalid traffic you can read without any special software.
Horn's fix was not a fraud-blocking app or an IP blacklist. He added 540 Google-defined audiences to the Search campaigns and set them to "Targeting" rather than "Observation." The difference matters and I will keep it plain. "Observation" means Google watches how those audiences behave but still shows your ad to everyone. "Targeting" means Google only shows your ad to people who fall inside those defined audiences. By restricting delivery to real, categorized human audiences Google already understands, the campaigns stopped serving to the anonymous, uncategorized traffic where the bots were living.
We added 540 Google-defined audiences set to "Targeting" to our Google Search campaigns. The invalid click rate immediately dropped by 50%, and the conversion rate increased to profitable levels.
John Horn, CEO of StubGroup, in Search Engine Land, July 2, 2026.
Read what happened there in business terms. The invalid click rate did not shrink a little. It halved, right away, and the campaign went from losing money to making it, because the budget that had been feeding bots was now reaching people who could actually buy. The lever was a setting most owners have never touched, sitting inside the same interface they log into every week.
The five-minute check first, then the lever, and test it on one campaign
Do the diagnostic before you touch a single setting, because you need to know whether you have a real problem or a healthy account. It takes about five minutes and costs nothing.
Start with the gap. Open GA4 and pull your sessions from Google Ads traffic for a date range, say the last 30 days. Then open Google Ads and pull the reported clicks for the same 30 days. Compare the two numbers. If Google says it sent you 2,000 clicks and GA4 shows 1,900 sessions, that small gap is normal, some real people bounce before analytics fires. If Google says 2,000 clicks and GA4 shows 800 sessions, you have found your red flag. Over half of what you paid for never became a real visit.
Then read the credit column. In Google Ads, find the "Invalid activity" or invalid-click credit line and see what Google already refunded. This is not the answer, it is context. A large credit tells you Google is actively catching fraud on your account, which means there is fraud to catch, which means some is almost certainly getting through. Treat a big credit as a smoke alarm, not an all-clear.
If the gap is ugly, pull the targeting lever, and note the caveat that most people selling you a quick fix will skip. Setting audiences to "Targeting" narrows who sees your ads. It can block legitimate buyers who happen to fall outside Google's audience definitions, a new mover, someone whose browsing Google has not categorized yet, a private-browsing regular. That is a real trade-off, not a free win. You are trading some reach for a lot less fraud, and you need to confirm the math works for your business rather than assuming it will.
So do not roll it across your whole account on a Monday morning hunch. Pick one campaign, ideally your worst-offending one from the diagnostic, and apply the audience targeting there first. Watch it for two to three weeks. If invalid activity drops and your conversions hold or improve, expand it. If your qualified leads dry up because you cut off too many real people, you have lost nothing but one campaign's worth of test data, and you learned it cheap. This is the same discipline I push on people who hand delivery decisions to Google's automation without a control, which I get into in the piece on what happens when Google's smart bidding starts spending on autopilot.
Watch the money, not the metrics that make you feel busy
High click-through rate looks like a win. In a fraud context it is the opposite. Once your test is running, the wrong things will tempt you to celebrate, and a soaring CTR is the first of them. Remember Horn's client hit CTRs above 80% and some over 100%, and that was the fraud, not the success. A click-through rate that looks too good for your industry is a symptom to investigate, not a trophy to screenshot.
Track three things that actually move your bank balance. First, the GA4-sessions-versus-Google-clicks gap you measured at the start, rerun after two weeks, because a shrinking gap means fewer ghost clicks got billed. Second, your invalid-activity credit, which should trend down as your targeting starves the bots of impressions to click. Third, and this is the one that pays the rent, your conversion rate and cost per real lead. If invalid clicks fall but real conversions come with them, you narrowed too far and you dial the targeting back.
Give it time before you judge. Two to three weeks of data beats two to three days of nerves, because early swings can be noise. And keep watching after you expand, because fraud adapts. The operation that was cycling VPNs against your Search ads does not retire when one campaign gets harder to hit, it moves. A quarterly recheck of that clicks-versus-sessions gap should become a habit, the same way you would reconcile a bank statement you actually cared about. If you want to be sure your conversion numbers themselves are trustworthy before you lean on them for these decisions, that is a separate rabbit hole worth its own look at why an account can report healthy conversions that are quietly lying to you.
Frequently Asked Questions
Does Google automatically refund all fake clicks so I don't have to worry?
No. Google catches and credits a portion of invalid clicks, and that credit shows up on your dashboard. What it does not show is the fraud it missed and billed you for. The credit column tells you fraud is happening on your account, not that all of it was caught. That is exactly why you check the gap between GA4 sessions and Google-reported clicks yourself instead of trusting the note.
Can't I just block the bad IP addresses in Google Ads?
You can, but it barely helps against real click fraud. Google caps IP exclusions at 500 per campaign. Fraud operations cycle through VPNs and proxies, using far more than 500 addresses, so by the time you block one it has already moved to a fresh one. IP exclusions are fine for a single known nuisance. They are not a defense against an organized VPN-cycling operation.
What is the difference between Observation and Targeting for audiences?
Observation means Google still shows your ad to everyone but reports on how specific audiences behave, so you can watch without limiting reach. Targeting means Google only shows your ad to people inside those defined audiences. Switching to Targeting is what cut invalid clicks by 50% in the documented StubGroup case, because it stops your ads from serving to the uncategorized, anonymous traffic where bots live. The trade-off is narrower reach, so test it on one campaign first.
Log into your account tomorrow and pull two numbers: the clicks Google reported and the sessions GA4 recorded for the same month. If they roughly match, breathe easy and move on. If Google's number towers over your real visits, you have been paying to entertain machines. And that quiet "you weren't charged for invalid activity" note you have been treating as proof you are safe? It was only ever telling you about the fraud Google admits it found.
