Fake Leads in Google Ads 2026: Three Form Checks and Protecting Smart Bidding
The account reports 400 conversions. Sales reached 90 people. Eleven deals closed. The other 310 were fake leads: dead numbers, disposable mailboxes and names like “asdf qwerty”. The wasted calling time is the smaller problem. The bigger one is that all 400 submissions went into Smart Bidding as conversions, and the algorithm spent a week learning to find more sources like the ones that produced them.
In September 2026 Google published dedicated guidance on preventing invalid leads, and stated something advertisers do not enjoy hearing: its own invalid traffic filters do not solve this on their own, because most traffic checks run after the ad has served, and lead quality is a shared responsibility. Here is what Google actually recommends, which three form checks remove most of the junk, how to restructure your conversion actions, and how to tell real spam apart from merely unqualified leads.
Fake leads in Google Ads: why Google’s filters do not close the gap
Google’s invalid traffic protection is built around clicks and impressions. It catches bots, click fraud and bad inventory, issues credits and removes offending placements. We covered that machinery in invalid clicks in Google Ads: reporting, credits and real fixes.
A lead, though, is an event on your side. Your form sits between the click and the submission, and Google does not look inside it. Two consequences follow:
- A bot that reaches the form and submits it produces a conversion that looks perfectly normal to the ad platform.
- So does a real person who types a made-up email address. Google calls this out explicitly: real users enter false details.
Keep the scale in proportion. Lunio measured 5.28% invalid traffic in retail AI Max campaigns in Q2 2026 against 3.07% for standard search — one vendor’s retail measurement, not a universal constant, and it transfers to lead generation only with caveats. In the same firm’s July 2026 survey of 131 marketing leaders, 51.1% named bidding toward non-human converters as a leading risk.
The core point: an invalid lead costs more than an invalid click. A click burns budget once. A lead poisons the training set and pushes the algorithm to buy more traffic exactly like it.
The three form checks Google itself recommends
1. reCAPTCHA on web forms
The baseline layer. Google’s guidance names no version, no score threshold and no position in the submission flow — that is left to your developers. A practical frame: an invisible, score-based check outperforms a checkbox because it does not tax real users, and the cut-off should be set empirically after a week of watching the score distribution. Starting with an aggressive threshold is a reliable way to reject genuine submissions alongside bots.
2. Double opt-in
An automated email with a unique confirmation link goes out after submission, and the lead counts as valid only once that link is clicked. It eliminates invented and borrowed addresses entirely. The cost is obvious: some real leads never confirm, especially in B2C and especially on mobile.
Which is why double opt-in rarely belongs in front of the form. Put it in front of the conversion instead: the user sees a normal thank-you page, and the conversion fires to Google Ads after confirmation.
3. Server-side validation
The most underrated layer. Bots increasingly skip the browser entirely and POST straight to the form endpoint, where no client-side check can see them. On the server, validate:
- that the email domain resolves an MX record and is not on a disposable-mailbox list;
- that the phone number matches the numbering plan of the declared country;
- that the stated location is consistent with the request;
- basic sanity in text fields — repeated characters, URLs inside a name field, mismatched scripts.
Two more layers that are not in the guidance but work
Google’s page stops at those three. In practice two more techniques are worth adding, both cheap and nearly invisible to real users:
- Honeypot field. A field hidden with CSS that a human never sees or fills. Automated fillers complete it, and the submission is discarded without any user-facing check.
- Rate and timing limits. Cap submissions per IP over a window, and reject forms submitted 1.5 seconds after page load. Nobody reads and types that fast.
Both cost almost nothing to implement and remove the bulk of unsophisticated bots before reCAPTCHA is even consulted.
Conversion architecture: not every submission should teach the algorithm
Filtering the form is half the job. The other half is deciding what you hand Google Ads as an optimisation target.
| Event | Conversion type | Why |
|---|---|---|
| Form submission | Secondary (observation only) | Useful for funnel diagnostics, not for training bids |
| Verified contact | Secondary or primary | Depends on volume; primary when volume is thin |
| Qualified lead (MQL/SQL) | Primary | This is what Smart Bidding should learn from |
| Closed deal | Primary, with value | Ideal when event frequency allows it |
Primary and secondary conversions are the native mechanism for exactly this; the full breakdown is in primary and secondary conversions: what your algorithm actually learns.
The honest constraint: optimising toward a qualified lead needs volume. Google’s lead generation guidance points to at least 15 conversions in 30 days at account level, with conversion delay ideally inside seven days. If your SQLs number three a month, you cannot bid on them — you need an intermediate proxy such as a verified phone number, a connected call, or a booked meeting.
Feeding quality back into the system
The most direct route is sending Google Ads the outcome from your CRM rather than the submission itself. The GCLID-based mechanics are in offline conversion import in Google Ads, including adjustments and retractions for conversions that were counted and later turned out to be junk.
Enhanced conversions for leads is the adjacent tool: it lifts match rates and gives you the hashed identifier that carries the CRM outcome back. Setup is in enhanced conversions in Google Ads.
What to fix on the campaign side
Some of the junk is not bots at all — it is irrelevant traffic, and it is fixed with settings rather than form code:
- Search terms and negatives. The usual suspects: “free”, “DIY”, “jobs”, “salary”, “complaints”. The working routine is in negative keywords and the search terms report.
- Location settings. Check presence versus interest targeting — submissions from areas you do not serve are a large share of what teams call spam.
- Lead form assets. They have their own dynamics: the form sits inside the ad, friction drops, and so does the threshold for an idle submission. What changed in 2026 is in lead form assets in Google Ads.
- Performance Max without a feed. Lead-gen PMax is where low-quality submissions from partner inventory surface most often — see Performance Max for lead generation.
Diagnosis: spam or simply unqualified?
Before tightening anything, confirm which enemy you are fighting. Export the last 200 submissions and tag them:
| Signal | What it indicates |
|---|---|
| Form completed in under 2–3 seconds | Automation, almost certainly |
| Disposable email domain | Deliberately false contact |
| Phone fails the country numbering plan | False data, or a broken form |
| Several submissions from one IP within minutes | Bot or deliberate flooding |
| Contact is valid but says they never enquired | Someone else’s details, submitted by a third party |
| Contact is valid, interest is not | Not spam — irrelevant traffic, fixed with targeting |
The distinction matters. Spam is fixed with form and server-side checks; irrelevant traffic is fixed with campaign settings, negatives and landing page copy. Conflate the two and you will tighten the captcha, lose genuine leads, and fix neither cause.
One button teams forget: you can request an investigation into activity from the previous 60 days. It is not a substitute for your own checks, but with a sharp spike from an identifiable source it is worth filing.
Calls: the parallel problem teams forget
If some of your enquiries arrive by phone, none of the form logic applies to them — and they have junk of their own. The usual sources: auto-dialers, three-second connections, off-topic questions (“where are you based?”, “are you hiring?”), and repeat calls from the same person counted as separate conversions.
What works here:
- A duration threshold. Count a call as a conversion past 30–60 seconds rather than on connection. Set the threshold from your own data: look at the duration distribution of calls that became deals.
- Deduplication by number. A repeat call from the same caller inside a window should not create a second conversion. How Google Ads handles this is in duplicate conversions in Google Ads.
- Call outcome tags. If agents record the outcome in the CRM, that outcome can go back to Google Ads as an offline conversion, exactly as it does for forms.
- Hours of operation. An unanswered call outside business hours is not a conversion, it is wasted budget — check your ad schedule.
The principle is identical to forms: only what the business genuinely counts as a result belongs in the training set.
Scoring beats a binary gate
The common implementation mistake is turning every check into its own barrier: failed reCAPTCHA, reject; suspicious domain, reject. That reliably costs you real users whose only sin is a strict corporate proxy or an unusual mail domain.
A weighted model works better. Each signal contributes points and the decision follows the total:
| Signal | Weight | Strength |
|---|---|---|
| Honeypot field filled | 100 | Reject outright |
| Form submitted in under 2 seconds | 60 | Strong |
| Disposable email domain | 50 | Strong |
| No MX record for the domain | 40 | Medium |
| Phone fails the country numbering plan | 40 | Medium |
| Low reCAPTCHA score | 30 | Medium |
| Third or later submission from one IP within an hour | 30 | Medium |
| Request location inconsistent with the stated one | 15 | Weak |
Then use three bands instead of one line: under 40, accept as a normal lead; 40–79, pass into the CRM but hold the Google Ads conversion until the contact is verified; 80 and above, reject. Borderline submissions stay available to sales while the algorithm is fed only clean data. Tune the weights against your own sample — start here and revise after tagging your first two hundred submissions.
A one-page brief for your developer
To keep this from turning into a month of discussion, write the task in implementation terms:
- Add a hidden honeypot field and a page-render timestamp; validate both server-side.
- Accept submissions only through the server handler; reject direct POSTs to the endpoint without a valid session token.
- Validate server-side: domain MX record, disposable-domain list, phone format per country, basic sanity on text fields.
- Wire reCAPTCHA so the score reaches the handler. Block nothing in week one — log the distribution first.
- Implement the scoring table above and store the final score alongside the lead in the CRM; you will need it to settle disputes.
- Fire the Google Ads conversion from the handler after the threshold check, not from the form itself.
- Log every rejected submission for at least 30 days. Without that log you cannot know what you cut by mistake.
The last point is the one most often dropped to save time, and the most expensive to skip. Without a rejection log, threshold tuning is guesswork, and the first complaint from sales about a “lost customer” becomes an argument nobody can settle.
A 30/60/90 plan
- Week 1. Honeypot field and a minimum completion time. A day of work, immediate effect on unsophisticated bots.
- Weeks 2–3. Server-side email and phone validation, disposable domain list, per-IP rate limits.
- Week 4. reCAPTCHA with a lenient threshold, a week of observing the score distribution, then the real cut-off.
- Month 2. Rebuild the conversion architecture — submission to secondary, qualified lead to primary. Plan around relearning; which edits trigger it is in the Smart Bidding learning period.
- Month 3. CRM outcome import, adjustments and retractions for bad conversions, and a recalculated allowable CPA based on your real qualification rate.
The economics usually land like this: with 70% junk in the flow, the true cost per qualified lead is three times what the interface shows. After the clean-up the reported number goes up — and starts matching reality for the first time. That is the correct outcome, even though the first fortnight looks like a regression on every dashboard.
The logical next step after a clean-up is asking how many qualified leads the channel adds beyond what would have arrived anyway. Since October 2026 you can measure that yourself: Conversion Lift for Search and Performance Max. Run it after the clean-up, not before, or the study compares two groups on junk. If your lead gen runs through PMax, also revisit your asset group structure — a share of low-quality volume comes from groups built without distinct audiences and landing pages.
If you run lead generation at a volume where this clean-up pays back inside a month, the rest of the operating stack deserves the same attention — stable ad accounts included. What we handle on that side is on the Google Ads agency accounts page and across PPC Rebels services.
FAQ
Why doesn’t Google filter fake leads itself?
Because its traffic checks run before and around ad serving, while the submission happens on your site. Google describes lead quality as a shared responsibility and recommends advertiser-side checks.
We already have a captcha and still get junk. What is wrong?
Most likely the form endpoint is being posted to directly, bypassing the browser. Client-side checks never see that traffic; server-side request validation does.
Won’t double opt-in kill conversion rate?
It will cost you some confirmations. That is why it belongs in front of the conversion rather than the form: the user’s journey is unchanged, and only confirmed leads train the algorithm.
What should the primary conversion be in lead gen?
The event you genuinely want more of, provided it happens often enough. If qualified leads run under 15 a month, bid on the closest proxy higher in the funnel and keep qualification as a secondary action.
Can a conversion that already counted be retracted?
Yes, through conversion adjustments — you can retract it or restate its value, provided you pass the click identifier or hashed data. That capability is the main reason to wire up the CRM.
Do junk leads really damage Smart Bidding?
Yes. The algorithm optimises toward whatever you label a conversion. If 70% of the training set is fake, it will seek out sources that produce more of the same.
How is spam different from an unqualified lead?
Spam means false data or automation. An unqualified lead is a real person who is not a fit. The first is a form problem; the second is a targeting, negatives and ad copy problem.
How many conversions do I need to optimise on quality?
Google’s guidance points to at least 15 conversions in 30 days at account level, with conversion delay preferably within seven days. Treat it as a benchmark, not a hard gate.
Does hardening my form help if the leads come from lead form assets?
No — that form lives inside the ad, beyond the reach of your checks. Different levers apply there: the asset’s own settings, qualifying questions, and verifying the contact on your side afterwards.
Should I block all data-centre IP ranges?
As a scoring signal, yes. As a hard block, be careful: corporate users behind proxies and VPNs will be caught alongside the bots.
Can I report a spike of junk to Google?
You can request an investigation covering the previous 60 days. Reasonable for a sharp spike from an identifiable source, but not a replacement for your own validation.
What happens to my reports after the clean-up?
Conversion counts fall and CPA rises. That is not a decline — it is the shift from counting submissions to counting leads your sales team can actually work.
Filtering junk at the door is cheaper than paying for it three times over: once in click spend, once in sales time, and once in the week your algorithm spent learning to find more of it.
