Every time someone clicks your Google advert, you pay. That model works when the clicker is a real person weighing up your service. It works against you when the clicker is a bot, a click farm, or a competitor running down your daily budget. This guide explains what click fraud protection on Google Ads actually covers, how to spot invalid clicks in your own account, and where a small UK business should spend effort versus money.
What is click fraud on Google Ads?
Google's own systems treat several things as invalid: automated bot traffic, clicks from farms paid to inflate numbers, repeated clicks from the same source, and even accidental double clicks or Google's internal testing. Not all of it is malicious, but all of it is spend you would rather not make. For a plumber or a solicitor buying local search terms, the most damaging version is a rival clicking your advert daily so your budget empties before real customers search.
How much does click fraud cost UK small businesses?
Reliable UK-specific loss totals are hard to pin down, and you should treat any headline national figure with caution, since methods and sample sizes differ widely. What industry trackers tend to agree on is the direction rather than an exact number. TrafficGuard reports that around 14% of paid search clicks come from non-genuine sources and that roughly a fifth of all digital traffic is non-human. Applied to a small local budget, even a share of that waste can be the difference between a full diary and a quiet one.
Those estimates matter most at the small end, where a single wasted week of budget hurts far more than it would for a large advertiser. If ad spend is a line you watch closely, it belongs in the same review as your wider cash flow forecasting.
Does Google already protect me from invalid clicks?
Google's help documentation is clear on the mechanics. If Google identifies an interaction as invalid before the end of the billing cycle, you do not pay for it. If it detects invalid traffic after the cycle closes, it issues an invalid activity credit in the next billing cycle when appropriate and possible. This runs in the background on every account with no setup required.
The limit is what slips through. Google filters what its systems recognise, which leaves a residue of borderline or novel patterns that only show up in your conversion data as clicks that never turn into enquiries.
How do I spot click fraud in my own account?
Inside Google Ads, open Campaigns, click the columns icon, search for Invalid clicks, add both Invalid clicks and Invalid click rate, and apply. Now watch for three tell-tale patterns: a sudden click spike with no matching enquiries, repeated clicks clustered in one region at unusual hours, and a campaign whose cost per conversion drifts upward for no obvious reason. None of these prove fraud on their own, but together they justify a closer look or a manual investigation request.
Can I get a refund for invalid clicks from Google?
Check Tools, then Billing, then Transactions for any invalid activity credit already applied. If you spot a pattern Google appears to have missed, Google allows an invalid traffic investigation request for activity within the last 60 days. File it with dates, affected campaigns and a short description of what looks wrong. Google re-checks the traffic against its own logs and applies a credit if it agrees. Since Google has already filtered what it caught, manual claims tend to recover the harder, ambiguous cases rather than the obvious bots.
What does click fraud protection software actually add?
These tools track the IP, device and behaviour behind each click, score it, and auto-exclude sources that trip their rules. For competitive local markets, where a rival can click your advert repeatedly, that automation catches what Google's broad filters leave behind. The trade-off is a monthly fee and the risk of over-blocking, which is why the decision should rest on your own numbers rather than a vendor's headline stat. Treating ad tooling as a build-versus-buy call is the same discipline you would apply to any other spend, much like weighing what AI tools genuinely cost a UK small business.
How do I set up click fraud protection step by step?
A sensible order for a small UK business:
- Add the invalid clicks columns and record your baseline invalid click rate for a fortnight.
- Note any IP or region that clicks repeatedly without ever converting.
- Add clear repeat offenders to your Google Ads IP exclusion list manually.
- If waste is still visible after that, trial a third-party tool for one month and compare its blocked-click report against your conversion trend.
- Keep or drop the tool based on whether recovered spend beats the fee.
This keeps control in your hands and treats software as the last step, not the first. If paid search is one of several channels you run, review it alongside how you approach AEO, SEO and answer-engine visibility so budget flows to whatever brings genuine enquiries.
What are the honest trade-offs of blocking clicks?
Aggressive exclusion lists grow into walls if nobody prunes them. After any blocking change, watch conversions and search impression share for a dip. If genuine enquiries fall, loosen the rules straight away. There is also an opportunity cost: hours spent policing clicks are hours not spent improving your landing page or your offer, which often moves revenue more than fraud prevention does. Balance is the whole game.
How do I know if click fraud protection is working?
Track three figures before and after any change: invalid click rate, cost per conversion, and total enquiries. Success looks like a steady or lower cost per conversion with the same or more enquiries, achieved on less wasted spend. If blocked-click counts rise but enquiries stall, the protection is theatre. Review monthly, keep the exclusion list lean, and let your own results, not a dashboard's alarm colour, decide what stays switched on.
Click fraud is real, measurable, and worst for the smallest budgets, but it is rarely the biggest lever in an account. Filter the obvious waste, claim what Google owes you, and spend the freed budget on the clicks that actually become customers.
Invalid Click Protection — FAQ
What counts as click fraud on Google Ads?
Click fraud is any click on your advert that is not a genuine person with genuine interest. Google groups these under the wider label of invalid traffic. It covers automated bots, click farms paid to inflate numbers, and repeat clicks from a competitor trying to burn your daily budget. Accidental double clicks and Google's own testing traffic also count as invalid, which is why not every filtered click is malicious. The practical point for a small business is the same either way. You paid, or nearly paid, for a click that was never going to become an enquiry, so it is worth measuring and reducing.
Does Google refund invalid clicks automatically?
Partly. Google states that if it identifies an interaction as invalid before the end of the billing cycle, you do not pay for it, so most filtering happens silently before you are charged. If it detects invalid traffic after the cycle closes, it issues an invalid activity credit in the next billing cycle when appropriate and possible. You can see these under Tools, Billing and Transactions. What Google does not do is refund clicks it never flagged. That gap is why some advertisers file a manual investigation request or add third-party protection, and why watching your own conversion data still matters.
How do I request a manual invalid click investigation?
Google lets you submit an invalid traffic investigation request for activity within the last 60 days. Before you file, add the Invalid clicks and Invalid click rate columns to your campaign view so you have the numbers to hand, and gather evidence such as sudden click spikes with no conversions, or repeated clicks from one region at odd hours. Submit the form with dates, campaign names and what looks wrong. Google reviews the traffic against its own logs and applies a credit if it agrees. Keep expectations realistic, since Google has already filtered what its systems caught, so manual claims recover the harder cases.
Is third-party click fraud protection worth it for a small budget?
It depends on how much you spend and where. If your monthly Google Ads budget is small and mostly on low-competition search terms, Google's built-in filtering may be enough and a monthly tool fee could cost more than it saves. If you run competitive local search, where rivals and bots are more active, third-party software that auto-blocks suspicious IPs can pay for itself. The honest test is arithmetic. Estimate your wasted spend from your own invalid click rate, then compare it to the tool's fee. Protect the budget only where the maths clears the cost.
Will blocking clicks hurt my genuine traffic?
It can if you are heavy handed. Aggressive IP exclusions or tight blocking rules risk shutting out real customers who share an IP range, use a VPN, or sit behind a corporate network. That is the main trade-off with click fraud protection on Google Ads. The safer approach is to start with monitoring, block only clear repeat offenders, and review your exclusion list monthly so it does not quietly grow into a wall. Watch conversions and impression share after any change. If genuine enquiries dip, loosen the rules. The goal is less waste, not fewer customers.
