Quick answer
Most spam leads from Google Ads come from Display and partner placements, often through Performance Max, hitting forms with no bot protection. Fix the form first with reCAPTCHA v3, a honeypot field and validation. Then tighten placements, and count only verified leads as conversions so Google stops learning from junk.
This guide is for owners whose inbox fills with fake names, gibberish messages and phone numbers that don't connect. It is part of our Google Ads help centre.
Where the spam comes from
Spam leads usually have two causes working together.
- Low-quality traffic. Search partner sites, Display placements, and apps can send bots and accidental taps. Performance Max can show on all of these.
- An open form. A contact form with no bot check accepts anything. Bots don't need to click an ad to find it, but ad traffic makes the form easier to find.
The third part is what turns a nuisance into wasted spend. If every form submission counts as a conversion, Google's bidding sees the spam as success and looks for more traffic like it.
Check these first
- Look at the network split. In Campaigns, add the Network segment (Segment, then Network). Compare conversions from Google Search with Search partners and Display.
- Check the campaign types. Spam that started when a Performance Max or Display campaign went live is a strong clue.
- Check what counts as a conversion. In Goals, then Conversions, see whether the primary lead action is a thank-you page view or a button click. Both can fire for bots.
- Check your form. Does it have reCAPTCHA, a honeypot or any validation? Submit a test with a fake phone number and see if it goes through.
- Check the Invalid clicks column. Add it to your campaign table to see how many clicks Google already filtered out.
Cause and fix table
| What you see | What it means | How to fix it | How long it takes |
|---|---|---|---|
| Gibberish names and messages | Bots submitting an unprotected form | Add reCAPTCHA v3 and a honeypot field | 1 to 2 hours |
| Real-looking names, fake phone numbers | Form farms or low-quality app traffic | Validate phone format, tighten placements, review PMax channels | Same day |
| Spam mostly from Search partners | Partner sites sending poor traffic | Untick Google search partners in the campaign's network settings | Minutes |
| Spam started with Performance Max | PMax is buying cheap junk conversions | Protect the form, count qualified leads only, add placement exclusions | Days to set up; weeks to retrain |
| Conversions far higher than real enquiries | Conversion action counts spam | Change the primary conversion to a verified lead | 1 day |
Protect the form
This is the fix that helps every campaign, and organic traffic too.
WordPress sites
- Open your form plugin's settings (Contact Form 7, Gravity Forms, WPForms and similar).
- Turn on Google reCAPTCHA v3, or the plugin's built-in anti-spam option. You need a site key and secret key from the Google reCAPTCHA admin console.
- Add a honeypot field if the plugin offers one. It is hidden from people, so anything that fills it in is a bot.
- Make the phone field require an Australian format, such as 10 digits starting with 0 or +61.
- Send a test submission and check it still reaches your inbox.
Sites we build in PHP
Our PHP site builds already use reCAPTCHA v3 and a honeypot field on forms. reCAPTCHA v3 runs in the background and gives each submission a score between 0.0 and 1.0, with low scores more likely to be bots. The site then rejects or flags low scores. Every lead that passes is sent by authenticated SMTP and also saved in the site's admin panel, so a genuine enquiry isn't lost if an email goes astray. If spam still gets through, the score threshold can be tightened.
Wix, Squarespace and Shopify
These platforms include their own spam filtering for built-in forms. Check it is switched on in the form settings, and add a required field that bots tend to get wrong, such as a dropdown for the service needed.
Tighten campaign settings
- Search campaigns. Search partners are included by default. You can turn them off in the campaign's settings under Networks. The Include Google Display Network option in the same section is worth switching off for most lead-gen Search campaigns.
- Display and Demand Gen. Exclude mobile app categories and placements that send junk. Account-level placement exclusions are the quickest way.
- Performance Max. Account-level placement exclusions also apply to PMax. Google is testing controls for Search partners and Display in PMax, but not every account has them yet. See our guide to Performance Max for small businesses.
Does Google refund fake clicks?
Google says you won't be charged for invalid clicks or impressions. Most are filtered automatically before billing, and the Invalid clicks column shows how many. When Google finds invalid activity after a bill has closed, it adds a credit that appears as a line item in your billing and transaction history. Google also has an Invalid Activity Credit Report for Search and Performance Max campaigns.
If you suspect something Google missed, you can lodge a request through Google's click quality form, which covers invalid clicks and poor-quality form submissions. A spam lead is not always an invalid click, though. A real person can click an ad and then submit junk, and Google won't credit that.
Teach Google what a real lead looks like
Blocking spam at the form stops it reaching you. To stop paying for traffic that produces it, the bidding has to learn the difference.
- Count a conversion only when the form passes validation, not on every thank-you page load.
- Mark leads in your CRM or a spreadsheet as qualified or not.
- Send qualified leads back to Google with offline conversion import or enhanced conversions for leads. Google recommends qualified or converted leads as the goal for this data.
- Set the qualified-lead action as the primary conversion once it has enough volume.
Our conversion tracking guide explains how to check each conversion action fires correctly.
Australian detail
Validate phone numbers to Australian formats and postcodes to four digits. Most spam that reaches Australian businesses doesn't pass both. If you only service one state, a required postcode field also helps you screen leads. Don't publish or reuse personal details from spam submissions, and delete them under your normal privacy practice. The same issue on Facebook is covered in Facebook lead ads spam.
When to get help
If spam continues after the form is protected, a specialist checks placement reports, the network split, PMax channel data and which conversion actions the bidding uses. We fix the form and the campaign together, so the account stops paying for junk.
About this guide
Written by Amann Jhamb, Director of AR Digital Solutions, 17 years in web design, SEO and paid ads. Last checked: 3 November 2026 against Google Ads Help: Invalid traffic. Change note: first published 3 November 2026. Part of our Google Ads help centre.