Click Fraud

Click fraud is one of those online scams that rarely gets discussed outside marketing circles, yet it quietly drains real money from UK businesses every year. If you run pay per click ads, the cost shows up as budget spent on clicks that were never going to turn into customers, which pushes up your cost per sale and can skew the data you rely on to make decisions.

What click fraud actually is

Click fraud exploits the pay per click advertising model, usually shortened to PPC. The idea behind PPC is simple: a website or search engine shows an advert, and each time someone clicks on it, the advertiser pays a fee. On search engines like Google and Bing, advertisers bid against each other for keywords, and the bid helps decide how prominently the ad appears. An ad network sits in the middle, taking the advertiser's money and passing a share on to the site that displayed the ad.

Click fraud happens when those clicks are not genuine. Automated bots, or in some cases people paid to click manually, hit ads repeatedly with no intention of buying. The motive might be to earn a share of the click revenue, or to burn through a rival's advertising budget so their ads stop showing. Either way, the advertiser pays for clicks that were never going to lead to a sale.

Estimates vary, but industry research has long suggested that a significant slice of paid search traffic, often put at around a fifth, is invalid in some way. Individual clicks on competitive keywords in areas like legal services, insurance or finance can cost well over £10 each, so the waste adds up quickly.

How it is done

Most click fraud is automated. Software known as bots is set loose to click on ads across the web. The operators often run networks of infected computers, sometimes called botnets, which makes the traffic look like it is coming from thousands of ordinary users in different places.

A common setup involves a scammer running their own low-quality website, signing up to an ad network, and then using bots to click the ads shown on their own pages so they collect the payouts. In other cases, people are paid small amounts to sit and click on ads manually, which is harder to spot because the behaviour looks more human. IP addresses can be masked with VPNs or proxy services, so location data on its own is not reliable.

There is also the competitive angle. A rival business, or someone acting on their behalf, may click repeatedly on your ads with the sole aim of exhausting your daily budget. Once your budget is gone, your ads drop out of the auction and theirs get more visibility.

Scam Detector

Got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next.

Try our Scam Detector free, here on this site →

Spotting the signs

Click fraud is not always obvious, but patterns in your advertising data usually give it away if you look regularly. Things to watch for include:

• A sudden spike in clicks with no matching increase in enquiries, sign-ups or sales.
• A lot of traffic from locations that do not match your customer base.
• Repeated clicks from the same IP address or small range of addresses.
• Clicks at unusual hours, or at very regular intervals, which can point to automated activity.
• High bounce rates and almost no time spent on the landing page.
• One particular keyword or ad being hit far more than the others for no obvious reason.

If you are running paid ads, get into the habit of checking the reports at least once a week. For bigger budgets, daily checks are sensible. Google Ads and Microsoft Advertising both provide reports that break down clicks by location, device, time of day and IP range, and linking the account to Google Analytics will show you how visitors behave after they land on your site. You do not need specialist software to spot most problems, but you do need to look.

What the ad platforms do

Google, Microsoft and the other major networks have teams and automated systems dedicated to filtering out invalid clicks before you are charged. When their systems identify fraudulent or suspicious activity, those clicks are normally removed from your bill, or credited back if they have already been paid for. It is in the platforms' own interest to keep advertisers confident that the system is fair.

The filters are not perfect, though, and some fraudulent clicks slip through. If you think you have been charged for bad traffic, you can raise it with the platform's support team and ask them to review the account. Resolution times vary, and not every claim results in a refund, so be ready to point to specific dates, campaigns, IP ranges or patterns in the data when you make your case.

Third party click fraud protection tools are also available. They sit alongside your ad account and block or flag suspicious IPs. Quality varies, and they are an extra cost, so weigh up whether your spend is high enough to justify one. For a smaller business spending a few hundred pounds a month, tightening up location and device targeting, adding negative keywords and reviewing reports regularly will often deal with the bulk of the problem without needing to pay for extra software.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

If you think your business has been targeted

Start with the advertising platform. Before you open a case, pull together the evidence: screenshots or exports of the affected campaigns, the dates and times of the suspicious activity, the IP addresses involved if you can see them, geographic breakdowns, bounce rates on the landing pages, and any comparison with normal traffic patterns from earlier weeks. The clearer the pattern you can show, the better your chances of getting credit back.

If you believe a competitor is deliberately clicking your ads, that could amount to fraud under the Fraud Act 2006, though you would need to show intent to cause loss to you or gain for themselves, which is not always easy to prove from click data alone. The use of automated tools could also bring it within the Computer Misuse Act 1990, but again, tying specific activity to a specific person or business is often the hard part. Serious cases can be reported to Action Fraud at actionfraud.police.uk or on 0300 123 2040. Reports there feed into the National Fraud Intelligence Bureau, which assesses whether there is enough evidence to pass to a police force, so not every report leads to an investigation. For broader guidance on protecting a business online, the National Cyber Security Centre publishes practical advice at ncsc.gov.uk. Issues around misleading or unfair advertising practices can also be raised with the Advertising Standards Authority or, in more serious cases, the Competition and Markets Authority.

If money has been lost and your bank card or account was involved in the payments, speak to your bank as well. Keep copies of reports, invoices and any correspondence with the ad network, as this will help any investigation.

Is PPC still worth it?

For many businesses it still works well. Click fraud is a cost of doing business online, much like shoplifting is for a high street shop. The point is not to avoid PPC altogether but to manage it properly. Set a daily budget you can afford to lose on a bad day. Use location targeting to exclude countries and regions you do not sell into. Apply device and scheduling settings that match how your real customers behave. Build up negative keyword lists so your ads stop showing for irrelevant searches. Check your reports weekly, or daily if you are spending heavily. The sooner you spot unusual activity, the sooner you can get it stopped and your money back.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Scam Detector lets you got a text, call, email or offer that feels off? Paste it in below and we will tell you how scammy it looks, the warning signs to spot, and exactly what to do next. Try it now →