Is click fraud eating your Google Ads budget? Three popular fixes, checked against Google's own rules

A click on a Google ad for "traffic ticket paralegal" in Ontario costs about US$13, according to Google Ads keyword data for Ontario, as reported by DataForSEO on 12 November 2026. If a rival clicks your ad ten times over lunch, that is US$130 of your budget, and the click fraud advice doing the rounds on social media says you should be afraid of exactly that.

Three fixes keep coming up: buy blocking software, stay on manual bidding until you have 100 qualified leads, and split your campaigns by city so one drained budget cannot take the rest offline. We tested each against Google's own help pages and Ontario click prices. Our finding: most click fraud worry is better answered by settings Google gives you free, and by telling Google which leads were real. At the end is a self-audit, most of which you can run alone in about 20 minutes.

The click prices here are historical averages in US dollars, rounded, not a quote for any account; yours will differ. The settings work the same for a dental clinic or an accounting office.

What counts as click fraud, and what does not

Google's term is "invalid clicks," and its help page on invalid clicks defines them as "clicks on your ads that don't represent a genuine interest in your business." It lists three kinds: accidental clicks, automated traffic from "bots, or other deceptive software," and manual clicks that increase your costs.

The worry most owners have is the competitor across town, and Google names it. Its page About invalid traffic lists "competitors who manually click to increase your spend" as invalid activity. If your rival has the patience to click your ad forty times on a Tuesday afternoon, they have the patience to chase their own receivables, and they should probably do that instead.

Three things that look like click fraud often are not, according to the same page:

• A spike in clicks. Google says a spike "doesn't always indicate invalid traffic," and names seasonal demand, a competitor pausing its ads and your own changes as ordinary causes.
• A zero-second visit. Google says it "doesn't always mean the visitor left immediately."
• The same IP address over and over. Google says "An IP address isn't always unique to one device," because offices, universities and mobile carriers put many people behind one address.

Fake leads are a different problem. A bot filling in your contact form is a form problem first, and Google's page on protecting your account from invalid leads says its traffic filters "don't prevent invalid leads on their own."

What Google already filters and credits in your account

Google's About invalid traffic page says "Google automatically removes any invalid traffic found before the end of your billing cycle from your campaign metrics and billing," and "If Google finds invalid traffic after you receive your invoice, you'll receive a credit where appropriate and possible."

The same page answers the drained-budget worry directly: "If Google identifies an ad interaction as invalid before the end of the month, Google restores those costs directly to your campaign budget." A click Google catches goes back into the pot for a real searcher.

How much does it catch? Nobody neutral can tell you. Google says "There is no industry standard for a normal invalid traffic rate." The companies that do publish rates sell fraud protection: Fraud Blocker, a blocking vendor, reports about 11% invalid clicks on Search campaigns across its customers' accounts, and TrafficGuard, another vendor, puts Search between 14% and 22%. We found no neutral figure for Canada or for legal practices, so we will not hand you one.

Where to see it in your own account

I spent 33 years in Ontario courtrooms, and the habit that carries over is reading the record before anyone's summary of it. Your account is the record: Google's help page names the "Invalid clicks" column, an "Invalid traffic" card on the Overview page, "Invalid activity" adjustments in Billing and the Report Editor's "Invalid Activity Credit Report," and steps 1 to 3 of the self-audit below walk you through them.

How to ask Google to investigate

If something still looks wrong, Google says "you can submit an invalid traffic investigation request for activity within the last 60 days," using its Click Quality Form (you need to be signed in to Google Ads). Step 9 of the self-audit lists what Google asks for, and Google says the review "typically takes several business days."

Does click fraud blocking software pay for itself?

The first fix is blocking software, usually ClickCease, owned by CHEQ since 2020 according to CHEQ's acquisition announcement. ClickCease's pricing page listed the Starter plan's regular price at US$99 a month when we checked on 12 November 2026, with 30% off the first three billing cycles. The page also marks plans "Billed annually," and we could not tell what a month-to-month customer pays, so treat US$99 as the published regular price.

Now the arithmetic. US$99 pays for about 11 clicks on "paralegal hamilton," which the same Ontario keyword data puts at about US$9 a click. To pay for itself, the software has to stop about 11 or more bad clicks a month that Google's filters missed, because the ones Google catches already cost you nothing.

ClickCease's comparison page says it uses "native API integrations for automatic IP and audience exclusion," which means the software pushes IP and audience exclusions into your Google Ads account. IP exclusion has limits of its own.

The 500-address ceiling

Google's IP exclusion help page says "You can exclude up to 500 IP addresses per campaign." It also says campaign-level IP exclusions are not available for Performance Max, video, App, hotel and Smart Display campaigns.

ClickCease's own page about blocking IP addresses says "manual blocklists become obsolete almost immediately," because "A bot operator using a residential proxy network can cycle through thousands of IPs in a single day." That is ClickCease on blocking by hand. For its own software, ClickCease's comparison page describes "intelligent IP rotation based on threat priority," which, as we read it, changes which addresses fill the 500 slots rather than lifting the cap.

The same IP page warns that a blocked range "could belong to a major mobile carrier, a university, or a large corporation." Block the wrong address near a campus and you may have stopped your ad from showing to a whole residence of students, every one of them a future speeding ticket.

Nor does the vendor promise to catch everything. The ClickCease terms of service say "we cannot and do not guarantee that the Service will detect or prevent all types or all instances of invalid traffic." Google's invalid traffic page says third-party tools "often flag invalid traffic that Google defenses already detected and filtered," so a tool's report of "fraudulent" clicks may be counting clicks you were never charged for.

Our verdict on fix one: it has real limits and a monthly cost that a small account will find hard to win back. A larger account with a documented problem may see it differently. Either way, check the free columns above before you pay anyone to read them for you.

Do you need 100 qualified leads before automatic bidding?

The second fix says: stay on manual bidding until you have collected 100 qualified leads, then upload them to Google and switch to automatic bidding. Half of that is Google's own advice. The number is not.

Google does not set a 100-lead minimum on any help page we read. Its Target CPA page says "Advertisers can start using Target CPA with no conversion history, and Target CPA is effective for campaigns of all sizes." Its Smart Bidding page recommends judging results "over longer time periods that have at least 30 conversions, such as a month or longer." That 30 is for judging whether bidding works once it is running. On Google's Ads Decoded podcast, Brandon Ervin, Director of Product Management for Search Ads, put the general guidance at "roughly 15 conversions over a 30 day period."

We found 100 only on marketing blogs. If your ads bring in eight qualified consultations a month, 100 is more than a year of manual bidding before you are allowed to try anything else.

The part worth keeping

Telling Google which leads were real is the strongest idea in the set. Google's invalid leads page recommends you "Use lead-specific goals" such as "Qualified lead, Converted lead, Book appointment, or Request quote," and "Use enhanced conversions." When your bidding chases booked consultations instead of any form fill, a bot that submits your form stops looking like a success. Traffic that never turns into a client is the same gap we describe in why you can rank #1 and still lose the client.

The tool for this is enhanced conversions for leads. Google's help page describes it as "an upgraded version of offline conversion import that uses user-provided data, such as email addresses." Google's offline conversion import page says "If you have not already adopted offline conversion import, we recommend starting with enhanced conversions for leads instead."

One caution. This means sending a hashed version of a prospective client's email or phone number to Google. Whether that fits a practice's confidentiality obligations is a question we have not researched, and we are not answering it here. Ask before you switch it on, and make sure your website privacy policy describes the site you actually run.

Our verdict on fix two: switching to automatic bidding does not stop a single click. As a bidding plan, the instinct to feed Google qualified leads is right, and the 100-lead waiting period has no basis in anything Google publishes. Measuring leads instead of clicks is the same discipline we argue for in why you should report leads, not traffic.

Should you split your Google Ads campaigns by city?

The third fix says: run one campaign for Hamilton, one for Toronto and one for Mississauga, each excluding the others, so one drained budget cannot take the rest offline.

Google already answers that worry twice. Its invalid traffic page says caught costs are "automatically restored to your campaign budget so it can be used for valid clicks." And on the same Ads Decoded episode, Brandon Ervin recommends a shared budget for campaigns with the same goal, "so that budget can now work fluidly across the campaigns that share the same objective."

Splitting also cuts against the second fix. Google's guide to account structure says "Segmented traffic forces Smart Bidding to optimize for multiple targets separately, potentially reducing efficiency." Give each city its own bid strategy and each one learns from its own share of the same leads.

How Google pools thin data

Google's answer is to pool the conversions. On the podcast, Ervin says the conversions are "not necessarily having to come from a single campaign," and that campaigns with the "same conversion action, same targets" should be considered for "a portfolio bid strategy." Google's Smart Bidding page adds that it "can optimize based on data from all of your campaigns."

The same Ontario keyword data shows how thin a city slice gets. It puts "paralegal near me" at about 1,900 Ontario searches a month, "paralegal toronto" at about 720 and "paralegal hamilton" at about 320. A Hamilton-only campaign is fishing in the smallest of those ponds.

The exclusions leak, too. Google says it "doesn't guarantee location accuracy in every situation," and that "Your ad can show to users outside your targeted area if their search query includes your targeted location name." Someone in Toronto who types "Hamilton paralegal" can see your Hamilton ad, even if your Hamilton campaign excludes Toronto.

The free location setting the advice leaves out

Open your campaign's location settings. The default is "Presence or interest," which Google's location options page calls its "default and recommended option," reaching "people who are likely to be in or regularly present" in your area "as well as people who have shown interest in your targeted locations." The other choice, "Presence," shows your ads to people likely to be in, or regularly in, your area.

Google says Presence makes sense when "You only want to target users in specific locations and not users who may be in other locations." A paralegal who appears in Hamilton courtrooms usually wants Hamilton people. Google's invalid traffic page lists the same switch, "from 'Presence or interest' to 'Presence'," among its fixes for an unexplained spike.

Our verdict on fix three: Google's structure guide leans toward consolidated campaigns, and Brandon Ervin called it "quite reasonable to consider replicating that structure in Google Ads" where budgets are "split by region." If you run two offices on separate budgets, separate campaigns make sense. If you split only to guard against fraud, you have thinned your data to solve a problem Google's filters and credits already address. For the drained-budget worry, use a shared budget and the Presence setting first.

A 20-minute click fraud self-audit

Each step below comes from Google's help pages cited above; step 6 also uses the figure Brandon Ervin gave on Google's podcast. None needs paid software. Steps 1 to 6 and 8 take about 20 minutes. Step 7 may need whoever built your website, and step 9 applies only if a spike survives the rest.

1. In the Campaigns table, add the "Invalid clicks" column and look at the last 30 days.
2. In Billing, open Summary, then the Month card, then the "Adjustments" dropdown, and look for "Invalid activity" lines.
3. On the Overview page, look for the "Invalid traffic" card. It may not be in your account yet.
4. In each campaign's location settings, check whether you are on "Presence or interest" or "Presence," and decide which you mean.
5. Check where your clicks came from. A search that names your city can show your ad to someone outside it, so out-of-area clicks are not proof of fraud.
6. Count conversions per bid strategy over 30 days, against Google's 30 for evaluation and the roughly 15 Brandon Ervin cited. If separate campaigns each fall short, a portfolio bid strategy or fewer campaigns lets Google learn from all of them together.
7. Look at your contact form. Google recommends reCAPTCHA, double opt-in by email, and server-side checks on email domains and phone formats.
8. Check what you count as a conversion. A qualified lead or a booked consultation tells Google more than any form fill.
9. If a spike still has no matching conversions, gather dates, campaign names, server logs with IP addresses and GCLIDs (Google's click identifiers), and an explanation of the trend, and file the Click Quality Form within 60 days.

Check your ad text against the Law Society marketing rules

While you are in the account, read your ads again. The Law Society of Ontario's Paralegal Rules of Conduct, Rule 8, says in subrule 8.03(1) that "marketing" includes "advertisements and other similar communications in various media." Subrule 8.03(2) says marketing must be "demonstrably true, accurate and verifiable," and subrule 8.03(5) says a paralegal "shall specifically identify in all marketing materials that he or she is licensed as a paralegal." For lawyers, rule 4.2-1 of the Rules of Professional Conduct sets the same "demonstrably true, accurate and verifiable" standard. Newer ad channels bring their own limits, as we found when we asked whether lawyers can advertise on ChatGPT. We point to where the rules are. Whether a given headline complies is a question for the Law Society.

Talk to us about managing your Google Ads

Exhibit A Media manages Google Ads for professional practices. Our fee is 15% of your ad spend plus HST, with a minimum ad spend of $5,000 a month, so the smallest fee is $750 a month plus HST. Your ad spend bills directly to Google with no markup from us. The reasons we put that number in public are in why we publish our prices.

If you spend well under $5,000 a month, you are below our management minimum. The self-audit above is written for you, and it costs nothing. If you spend more, or plan to, read about our Google Ads management and book a call with us. Bring your last 30 days of invalid clicks.

Common questions

Does Google refund click fraud?

Mostly, it never charges you for it. Google's About invalid traffic page says it removes invalid traffic found before the end of your billing cycle from your metrics and billing, and restores those costs to your campaign budget. Invalid traffic found after you are invoiced is credited "where appropriate and possible," and shows in Billing as an "Invalid activity" adjustment. Google lists competitors who click to increase your spend as invalid traffic.

Where do I see invalid clicks in Google Ads?

Add the "Invalid clicks" column to your Campaigns table: click the Columns icon, search "Invalid clicks" and apply. Credits for invalid activity found after billing appear under Billing, Summary, the Month card and the "Adjustments" dropdown, labelled "Invalid activity." Google is also rolling out an "Invalid traffic" card on the Overview page showing "Estimated savings" and "Credited cost," but it may not be in your account yet, according to Google's help page.

How do I report suspected click fraud to Google?

Use Google's Click Quality Form for activity within the last 60 days. Google asks for your Customer ID, the date range, campaign and keyword names, server logs with IP addresses and GCLIDs, lead details with your assessment of each lead, and an explanation of the trend. Google says a review typically takes several business days, and it credits you only if it finds invalid traffic its automated filters missed.

Is ClickCease worth it on a small budget?

Often not, on the arithmetic. ClickCease's pricing page listed its Starter plan's regular price at US$99 a month, marked "Billed annually," on 12 November 2026; we could not confirm what a month-to-month customer pays. That buys about 11 Ontario clicks on "paralegal hamilton" at about US$9 each. Google already removes the invalid clicks it catches from your bill, caps IP exclusions at 500 per campaign, and ClickCease's own terms say it cannot guarantee detecting all invalid traffic.

Do I need 100 leads before automatic bidding?

No. Google's Target CPA help page says "Advertisers can start using Target CPA with no conversion history." Google recommends judging Smart Bidding over periods with at least 30 conversions, and a Google product director cited roughly 15 conversions in 30 days as general guidance on Google's Ads Decoded podcast. We found the 100-lead figure only on marketing blogs. The useful part of the advice is telling Google which leads were qualified, which Google itself recommends.

Should I split Google Ads campaigns by city?

Only if you already run and budget each city separately. Google's account structure guide says segmented traffic makes Smart Bidding optimize for several targets separately, "potentially reducing efficiency," while a Google product director called regional splits "quite reasonable" when budgets are split by region, on Google's Ads Decoded podcast. If the worry is one drained budget, Google's answers are a shared budget and its automatic restoring of invalid click costs.

What is the difference between click fraud and fake leads?

Click fraud is a paid click with no genuine interest behind it, which Google filters and credits. A fake lead is a bogus form submission, and Google's invalid leads page says its traffic filters "don't prevent invalid leads on their own." For fake leads, Google recommends reCAPTCHA on your forms, double opt-in by email, server-side checks, and conversion goals such as qualified leads instead of any form fill.