How much of your ad budget goes to click fraud?
More than most business owners would guess. Practitioners commonly estimate that 15% to 25% of the traffic on Google and Facebook ad campaigns comes from bots rather than real prospects. For a practice spending a few thousand dollars a month on ads, that can mean hundreds of dollars a month paying for clicks that will never become patients or clients.
Why would anyone click your ad with a bot?
Money. Fraudsters build networks of low-quality websites, fill them with display ads, and drive fake traffic to them. Every time a bot clicks an ad on one of those sites, the site owner gets paid — and the advertiser whose ad happened to appear there pays for a click that was never going to convert.
In expensive categories like personal injury law, where a single search click can cost well over $100, the incentive for fraud is enormous.
Why is click fraud getting worse?
Because bots have learned to imitate customers. Modern bots don't just click; they fill out forms and trigger the same conversion events you're telling your ad platform to optimize for. If your campaign is set to maximize form submissions and bots are submitting forms, the platform's algorithm sees success — and goes looking for more of the same traffic.
In other words, an unprotected campaign can end up optimizing itself to be defrauded.
What are the warning signs?
- Form submissions with fake names, gibberish, or the same email patterns
- Leads with phone numbers that are disconnected or never answer
- A spike in conversions with no matching increase in booked appointments
- High click volume from placements, apps or websites you've never heard of
- Clicks clustered at odd hours or from locations outside your service area
- A rising cost per real customer even though your reported cost per lead looks great
How do you protect your campaigns?
- Optimize for real outcomes. Track booked appointments and signed clients, not just form fills, and feed those back to the ad platform where possible.
- Review placements regularly. Check where your ads are showing and exclude websites, apps and channels that spend money without converting.
- Tighten your geography. Target people located in your service area, not people "interested in" it.
- Validate leads. Use form protections, phone verification and quick human or AI follow-up to separate real people from bots.
- Consider a fraud-protection service. Several tools monitor traffic and block known bad actors automatically.
- Compare ad reports to your front desk. If ads claim 50 leads and your team spoke to 20 real people, you have a problem.
Why does this matter beyond the wasted spend?
Because bad data leads to bad decisions. If fraud inflates your results, you may scale the wrong campaigns, cut the right ones, or conclude that advertising "doesn't work" for your business when the real issue is who's clicking.
Frequently asked questions
Do Google and Meta refund fraudulent clicks?
Platforms filter some invalid traffic and issue credits, but they don't catch everything.
Is click fraud worse on display ads than search ads?
Display and partner networks are generally more exposed, but search campaigns aren't immune.
How do I know my true cost per customer?
Divide your total ad spend by the number of new customers who actually booked or signed — not by the number of leads.
Adapted with permission from Question.Marketing. Statistics are reported findings from the studies named, not DigitalOS guarantees.
