How to recognize ad click fraud

Click fraud shows up in analytics before it shows up in the Ads account

Ad platforms optimize CTR and CPC. Click fraud (competitors, bot farms, junk networks) inflates clicks with no intent to buy. The account shows a «normal» CTR, while CRM shows a CR collapse. This article is about how to recognize the pattern in GA4, Yandex Metrica, and logs, not about the economics of budget drain — we cover that separately.

If you need the picture «how much money bots ate and what to do strategically», see fraud traffic and ad-budget drain. Here — detective work for a performance marketer.

Signal 1: anomalous CTR without conversion growth

CTR grew 30–80% in a few days, impressions are stable, but leads/add-to-cart are not. Especially suspicious if the spike coincided with a competitor's activity or a keyword change to brand.

Compare CTR by hours of day: bots often come in waves in off-peak for your audience.
Slice the report by placement / network / keyword — one sub-source can pull the entire anomalous CTR.
Cross-check with ClikBy Audience on the same smart link: the share of confirmed vs bot explains the «pretty» CTR in Ads.

Signal 2: zero or microscopic time on site

A click is registered, but in Metrica/GA the session is 0–2 seconds, one hit, no scroll. A person rarely behaves that way on a meaningful landing; a bot «closes» the tab after simulating the visit.

Build a session duration distribution for paid vs organic traffic — a bimodal chart (peak at 0 sec + a normal tail) is typical of a mix of bots and people.
Check engagement rate (GA4) or «depth» in Metrica by utm_campaign.
On a ClikBy smart link, look at conversion score and bot_server / bot_filter statuses — an independent layer before the platform «saw» the conversion.

Signal 3: bounce rate 90%+ on a paid landing

High bounce by itself does not prove fraud (a poor ad-to-page match does too). But bounce 95–100% on several campaigns at once with a normal creative — a reason to dig deeper.

Rule out technical causes: slow TTFB, broken redirect, cookie consent blocking.
Segment bounce by geo and device — bot farms often cluster in «cheap» regions or headless Chrome.
Compare bounce from the Ads click ID with bounce by ClikBy alias — a gap points to clicks that do not reach your analytics the same way.

Signal 4: competitive click fraud

A competitor or dishonest affiliate intentionally burns your daily budget on brand queries so you drop out of the auction. Signs: spikes on brand keywords, one IP / subnet, zero goals.

Turn on IP exclusion lists where the platform allows; document the pattern for Ads support.
Split brand and non-brand across different smart links — easier to prove an anomaly on the brand alias.
Exporting fraud-IP via Pulse is an extra lever, not a replacement for contacting platform support.

Signal 5: bot farms and «perfect» traffic

Device farms with residential IP mimic CTR better than random datacenter bots. They are caught not by one rule, but by inconsistencies: perfect CTR + zero CR + lookalike user-agent / screen resolutions.

Look at new vs returning users in analytics: a farm often gives 100% new users with no returning tail.
Check the share of mobile traffic without mobile-specific events (add to cart, scroll depth).
In ClikBy Audience filter by alias and status — the confirmed/bot overview in the cabinet is described in the material fraud in Audience.

How to verify: smart links + Audience

Place a ClikBy smart link between the ad and the landing (a separate alias per campaign or ad group). 14 days baseline: bot share, conversion score, geo/device. Then match with GA/Metrica — matching anomalies strengthen the case for pausing the source or a refund request.

ClikBy does not automatically refund money from Ads and does not replace the platform's investigation. The product gives an independent click log with confirmed / bot statuses — what is missing in a dispute «everything is clean in our account».

Difference from the article on budget drain

Here — diagnosis in analytics (CTR, bounce, time on site). In the material on fraud-traffic-ad-budget-waste — economics and budget-protection strategy. Use both: first find the pattern, then calculate the damage and cut sources.

Marketer checklist for the week

CTR vs CR delta for each paid channel.
Session duration < 3 sec — share by utm_source.
Bounce on paid landing vs organic benchmark.
ClikBy Audience: confirmed/bot by alias, sync with anomalies in Metrica.
Brand campaigns — a separate alias and monitoring of off-hour spikes.

Check click quality with ClikBy

When working with personal data in Belarus, follow the requirements of the Republic of Belarus Law No. 99-3 “On Personal Data Protection”.