Spam and Junk Leads in Google Ads: Where They Come From, and How to Stop Paying for Them

There is a particular kind of bad week in Google Ads that does not show up in any dashboard as a problem. Cost per lead drops. Lead volume climbs. The conversion column looks the best it has looked in months. Then someone on the sales side mentions, almost in passing, that the last forty enquiries were a mix of gibberish names, disposable email addresses and phone numbers that ring out. Nobody is lying to you. The numbers are accurate. They are just counting the wrong thing.

Spam and junk leads are one of the most common reasons a lead generation account looks healthy and performs badly. They are also one of the least understood, because the usual advice treats them as a form-security problem, when for a Google Ads account they are a bidding problem first. A bot submission that gets counted as a conversion does not just waste a lead slot. It teaches the algorithm what a “good” outcome looks like.

This post walks through where junk leads actually come from, what Google’s own filters do and do not cover, which fixes belong on your website and which belong inside the account, and how to tell a real quality problem from a normal amount of low-intent noise. It is written for people who run lead gen accounts, or who are deciding how much to trust the numbers in one.

First, separate three different problems that all get called “spam”

When someone says “we are getting spam leads,” they usually mean one of three things, and each has a different fix. Mixing them up is how people spend a month installing a CAPTCHA and then find the problem unchanged.

Bot submissions. Automated scripts that find your form and fill it in. The names are random strings, the emails are often malformed or from throwaway domains, and submissions can arrive in bursts, sometimes seconds apart. These are the easiest to stop at the form level, and the most damaging if they are firing your conversion tag, because the account has no way to know they are not people.

Human junk. Real people who submit a form with made-up details, or who were never a prospect. Someone looking for a job at your company, a student doing research, a competitor checking your pricing, a person who wanted a free resource and used a fake number to get it. A CAPTCHA does nothing about these. Better qualifying questions, clearer ad copy and a different conversion goal do.

Real people who are simply not a fit. Wrong location, wrong budget, wrong service. These are not spam in any technical sense and a lot of what gets reported as spam is actually this. They are a targeting and messaging problem, and the search term report is where you find the cause.

Before changing anything, take twenty recent leads and sort them into those three buckets by hand. It takes ten minutes and it will tell you where to spend your effort. If most of the junk is bots, start on the website. If most of it is human, start in the account. If most of it is “real but wrong,” start with your queries.

What Google’s filters cover, and what they leave to you

It is natural to assume that Google’s invalid traffic detection will catch fake submissions. It helps with clicks. It does not reliably help with what happens after the click.

Industry coverage of this gap, including reporting on Google’s own guidance, makes the same point: Google’s filters do not prevent invalid leads on their own, because most of the traffic checks happen after the ad has served. A bot or a person can reach your site and submit junk before a click is ever judged invalid. Google frames lead quality as a shared responsibility, and the controls it points advertisers to sit on the advertiser’s side: reCAPTCHA on the form, double opt-in email confirmation, and server-side validation.

There is also the matter of what a credit actually repairs. Google’s help documentation explains that invalid traffic detected before the end of the month is removed from your billing and reports automatically, and that if it is detected after you have been billed, you receive a billing adjustment for the value of the invalid activity. That is useful, and it is worth knowing it exists. But a credit gives money back for clicks. It does not remove a junk conversion that has already been fed into your bidding, and it does not give you back the weeks during which the algorithm was learning from bad signals. If you suspect poor-quality form submissions, clicks outside your location targeting or a sudden short-term jump in cost, Google provides a click quality form for submitting an investigation request. It is worth using for a clear pattern, with the understanding that it is a remedy for billing and not for the data.

If you want the wider picture on fraudulent clicks specifically, and how much of the vendor marketing around it to believe, we covered that in our post on click fraud in Google Ads. The short version is that invalid clicks and junk leads overlap but are not the same thing, and most accounts have more of the second than the first.

Why junk leads are worse in an automated account

In a manually bid account from ten years ago, a junk lead cost you the click and some wasted sales time. You saw it, you complained, you moved on. Today most lead gen accounts run on Smart Bidding, which means a junk conversion has a second, quieter cost.

Smart Bidding optimises toward whatever you have told it counts as a conversion. If a bot-filled form fires the same tag as a genuine enquiry, the system has no reason to treat them differently. It sees a pattern of clicks, devices, times, placements and queries that led to “conversions,” and it goes looking for more of the same. If the cheap conversions come from a particular placement or a particular type of query, spend drifts toward them, because on paper they are your best performers.

This is why the Performance Max version of the problem gets so much attention. PMax spreads spend across Search, Display, YouTube, Gmail and other surfaces, and practitioners describe a recurring pattern in lead generation: cheap form submissions turn up from Display and Gmail placements, the algorithm reads that as success and moves more budget there, and the CRM fills with leads nobody can reach. The commentary on this is partly vendor-driven, so treat the strongest claims with some caution. But the mechanism is simple and plausible, and it does not need a villain. It only needs a conversion definition that cannot tell good from bad.

The takeaway is uncomfortable. If you are optimising to a raw form fill, you are paying the algorithm to find the cheapest possible form fill. Whether that is a real prospect is a question the account cannot answer unless you give it a way to.

Where the junk is coming from: a practical diagnostic

Do this in order. Each step narrows the source, and the early ones are free.

Check whether the leads cluster by time

Pull submission timestamps from your form tool or CRM and look at them next to your Google Ads conversion times. A real enquiry pattern follows business rhythms: mornings, lunch breaks, a dip overnight. Bot traffic tends to arrive in tight bursts, at odd hours, or at a steady rate that no human audience would produce. If twelve leads land inside four minutes at 3 a.m., you do not need a model to tell you what happened.

Check the network and campaign type

Segment conversions by network. Search Partners are routinely named as a lower-quality source, and a lot of advertisers turn them off for lead gen as a matter of habit. In 2026 you can see more about how your Search Partner traffic breaks down than before, which we looked at in our write-up on Search Partners. If you are running Performance Max, the network picture is less transparent. Reporting in spring 2026 described Google testing the ability to switch Search Partners and the Display network off for Performance Max, shown as two separate checkboxes in some accounts. That coverage also noted there was no confirmed general release date. So check whether you have the option, and do not assume you do.

Check the queries

If the junk is human, it usually has a query fingerprint. Job seekers search with words like “jobs,” “salary” or “careers.” People after free material search for “free,” “template” or “DIY.” Learners search for “how to” and “course.” The search term report shows you these directly, and a disciplined negative keyword list removes a surprising amount of the human noise at the source. This is the unglamorous fix, and for service businesses it is often the one with the biggest effect.

Check the location settings

People physically outside your service area, or merely interested in it, can fill in a form as readily as anyone else. If your targeting setting is the broader “presence or interest” option, you may be paying for enquiries from people who cannot be served. We went through that in our post on location targeting. Switching to presence is one of the standard settings that practitioners list for cutting low-quality leads.

Check what your conversion tag is actually counting

This is the one people skip. Open the conversion action behind your lead goal and ask exactly when it fires. If it fires on a button click, it counts people who clicked and then abandoned the form. If it fires on page load of a thank-you page, anyone who finds the URL directly, or any bot that submits and gets redirected, counts. If it fires on a successful submission, it counts everything the form accepts, including garbage. None of these is wrong by default. But you need to know which one you have. If your numbers already feel off, the process in our guide to auditing conversion tracking is a good place to start.

Fixes on the website: stopping bots before they reach the conversion

The cleanest way to stop a bot from poisoning your bidding is to make sure its submission never fires the conversion. That is a website job, and it is mostly not complicated. The measures that come up consistently in advice from Google and from practitioners are these.

• reCAPTCHA or an equivalent challenge. Stops many automated submissions at the point of entry. It is a blunt tool and it adds a little friction, but it is the first thing Google itself points to.
• Double opt-in. The lead only counts once the person clicks a link in a confirmation email. This is strong because it proves the email address works and that someone with access to the inbox acted. It is also costly in volume, because a share of real people will not click. Use it where lead quality matters more than lead count.
• Server-side validation. Check the submission on your server rather than trusting whatever the browser sends. A lot of bot traffic posts directly to a form endpoint and never loads the page at all.
• Honeypot fields. A field hidden from people with CSS that bots dutifully fill in. Anything that completes it is rejected. It costs real users nothing.
• Submission timing. Record when the form loaded and when it was submitted. A form completed in a second or two was almost certainly not typed by a person.
• Email and phone validation. Check that the address is deliverable and the number is reachable, ideally at the moment of entry. This catches both bots and the human habit of typing a fake number to get past a form.

One detail matters more than any of these individually. Fire your Google Ads conversion only after the validation passes. If your tag fires on the click of the submit button or on a redirect that happens whether or not the lead was accepted, every one of these defences protects your inbox and does nothing for your bidding. The conversion should be the last step of a successful, validated submission, not the first.

It is also worth being honest about what these do not fix. A honeypot and a CAPTCHA will not stop a person who types a fake name and a real-looking number. For that you need either a verification step that proves the number works, or, better, a way of telling Google which leads turned out to be good.

Lead form assets: easy to complete, easy to abuse

Lead form assets deserve their own section, because they change the maths. A lead form asset is a Google-hosted form that can appear with a Search ad, so the person never reaches your website. That removes the friction that protects a normal landing page. It is also why several practitioner guides warn that lead forms are more exposed to low-quality submissions: they are quick to complete directly from the results page, and a website-based defence such as your CAPTCHA does not apply.

Google has built some controls into the format, and it is worth knowing what they are.

Phone verification by one-time password. For eligible Search lead forms, Google supports requiring an SMS code to verify the phone number. The point is to filter out invalid numbers, automated submissions and some kinds of spam. It adds a step, so expect fewer submissions in exchange for better ones. Whether that trade is right depends on your cost per lead against what a real customer is worth to you, and it is a perfectly reasonable thing to test.

Qualifying responses. You can turn a multiple-choice question into a qualifying question and mark which answers indicate a strong prospect. A submission with a qualifying answer is tagged as a qualified lead, and each lead carries a lead stage in the data sent to your CSV, webhook or API. This feature is documented as available for Search campaigns only. The useful part is not the filtering. It is that the lead arrives labelled, so your own systems can separate the promising ones without a human reading each one.

Both are worth switching on if you use lead forms. Neither is a complete answer. A person who really does own a working phone can still be an unqualified lead, and which answer a person picks on a multiple-choice question is easy to game once they know what you are looking for. They are filters on the way in. The more durable fix is on the way back out, which is the next section.

The fix that actually changes the algorithm: optimise for qualified leads

Everything above reduces how much junk gets in. This section is about changing what the account is trying to achieve, and it is where the most lasting improvement comes from.

Practitioners converge on the same conclusion, and Google’s own documentation points the same way: stop bidding on raw form fills and bid on qualified leads imported from your CRM. Google’s guidance for lead generation is to use offline conversion import or enhanced conversions so conversions can be valued correctly, and, when you use Maximize Conversions or Target CPA, to choose the deepest funnel conversion that still has enough frequency to be useful. The examples it gives are conversion names like “lead qualified” or “contract signed.”

The mechanism is how offline imports work. Every ad click carries a Google Click ID, the GCLID. You save it alongside the lead when the form is submitted. When that lead later becomes something, a qualified opportunity or a signed contract, you send the GCLID back to Google Ads with the conversion details. The account now knows which clicks led to real business. A bot submission never becomes a qualified lead, so it never produces that second signal, and the algorithm stops finding it attractive.

If you already import offline conversions, Google recommends upgrading to enhanced conversions for leads, which adds user-provided data such as hashed email addresses alongside the GCLID. Google’s documentation reports that advertisers who used first-party data alongside GCLIDs saw a median 10% increase in conversions compared with standard offline imports. Take that as Google’s own figure for its own feature, not a promise for your account. The practical benefit is resilience: if the GCLID is missing, the matching can still work.

We have written separately about the mechanics and the 2026 risks of this approach in our post on offline conversion imports, and about the signal-quality side in our piece on enhanced conversions. If you take one thing from this article into your account, it is that connecting the CRM matters more than any single form defence.

The volume problem, and how to handle it honestly

The objection is always the same. Qualified leads are rarer than form fills, and Smart Bidding needs enough conversions to learn. If you only get five qualified leads a month, switching your primary goal to them can leave the algorithm starved. We covered the thresholds in how much conversion data Smart Bidding needs, and the answer depends on your account.

There are sensible compromises. You can choose a conversion that sits partway down the funnel, such as a booked call or a lead that your team has actually reached, which is more frequent than a signed contract and still far harder to fake than a form fill. You can keep the raw form submission as a secondary action for reporting only, so you can still see the volume without bidding on it. And you can assign different values to different stages, so the system leans toward the ones that matter. That last idea is the subject of our guide to conversion value rules.

Whichever route you take, make the choice deliberately and write it down. The worst arrangement is the accidental one, where a raw form fill is the primary goal because it was the first tag someone set up two years ago.

Cleaning up the traffic sources that are most likely to be the problem

Once the conversion definition is sound, look at where the traffic comes from. The settings below are the ones that practitioners and agencies most often list for lead quality. None of them is guaranteed to matter in your account, which is why the diagnostic comes first.

• Search Partners. Test turning them off for lead gen campaigns and compare lead quality, not only volume. If the network is feeding most of your junk, the change is quick and easy to measure.
• Display expansion on Search campaigns. Same logic. If it is on and you did not choose it, find out why.
• Account-level placement exclusions. If you run campaigns that can serve on the Display network, exclude placements that consistently produce junk, and do it at the account level so it applies everywhere.
• Location targeting set to presence. As above.
• Negative keyword lists. Job, free, DIY and course terms are the usual starting set for service and B2B accounts, tuned to your business.
• IP exclusions. Useful when you have a specific, repeating source. Not a general solution, because motivated fraud rotates addresses, but it is cheap when the pattern is obvious.

For Performance Max specifically, the problem is that you cannot see inside the campaign easily. We wrote about how to approach that in auditing a Performance Max campaign when you cannot see inside it. If you are on lead gen and your PMax goal is raw form fills, with no qualified-lead feedback, that is the combination the most cautionary commentary is aimed at. Fix the conversion goal before you spend time on placement-level tinkering.

How to measure whether a fix worked

Most people judge these changes the wrong way. They look at cost per lead after the fix, see that it went up, and conclude the fix failed. Of course it went up. You removed cheap junk. Judge the change on the metric that sits one or two steps downstream.

Useful measures, in rough order of reliability:

• Cost per qualified lead, using whatever your sales team’s definition is. This is the number that matters.
• Share of leads that are reachable. What fraction of submissions have a working phone number or a deliverable email?
• Lead-to-opportunity rate. Of the leads you receive, what share become real sales conversations?
• Sales team time per lead. Rough and informal, but if people stop complaining about wasted calls, that is a signal too.

Give a change enough time to read. A change to your primary conversion goal can put bidding back into a recalibration period, and judging it after three days will mislead you. We looked at what that period involves in our post on the Smart Bidding learning phase. If you also need to tell the algorithm to ignore a period of bad data, such as a bot burst you have already cleaned out, data exclusions exist for that purpose.

Change one thing at a time where you can. If you add a CAPTCHA, switch off Search Partners and change the goal in the same week, you will never know which one worked, and you will not be able to reverse the right one if something goes wrong.

A sensible order of operations

If you take nothing else from this, take the order. People tend to start with whatever is easiest to do, and that is often not what is most useful.

1. Sort twenty recent leads into bots, human junk and real-but-wrong. Ten minutes, and it shapes everything else.
2. Confirm exactly when your conversion tag fires. Move it to fire only after a validated submission.
3. Add basic form defences if the junk includes bots: a challenge, a honeypot, validation on the server.
4. Tighten the obvious account settings: location on presence, negatives for job and free terms, Search Partners tested off.
5. If you use lead forms, turn on phone verification and a qualifying question and see what changes in volume and quality.
6. Connect the CRM and import a qualified-lead conversion. Move bidding toward it as soon as there is enough volume to support it.
7. Measure on cost per qualified lead over a long enough window, and keep the raw form fill as a secondary, observation-only action.

Where continuous monitoring fits

The reason junk leads do so much damage is mostly timing. Nobody is looking at the account at the moment the pattern starts. A burst of bot submissions on a Tuesday night, a new placement quietly picking up spend, a Search Partner share that creeps up after a campaign edit: these show up as a change in the numbers days before anyone notices a change in lead quality. By then the algorithm has been training on them for most of a week.

This is the kind of gap that Growera’s daily account monitoring is meant to narrow. It reads the account every day and flags unusual shifts, such as a sudden jump in conversions with no matching change in clicks or spend, so someone can look at the cause while it is still recent. It does not replace the CRM connection or the form defences described above, and it cannot see what happens inside your sales process unless the data is fed back. What it can do is shorten the time between something odd starting and a person noticing. If you want the longer argument for why that matters, see how often you should actually check your Google Ads account.

A few cases people get wrong

“Our cost per lead is great, so the account is fine.” Cost per lead is only as meaningful as the lead. A fall in cost per lead alongside a fall in sales conversations is a warning, not a win.

“We added a CAPTCHA and it did nothing.” It may have done exactly what it should for bots, while the real problem was human junk or real-but-wrong enquiries. Go back to the sort of twenty leads.

“We will just ask Google for a refund.” Invalid traffic credits exist and are worth requesting when there is a clear pattern. They do not undo the damage to what Smart Bidding learned, and they do not cover leads that were simply poor fits.

“Qualifying questions will fix it.” They help, particularly on lead forms. They are a filter that people can learn to pass. They work best combined with an import that tells Google what actually closed.

“We cannot switch to qualified leads because we do not have enough volume.” Sometimes true. But that is an argument for choosing a conversion partway down the funnel, not an argument for staying on form fills indefinitely.

The short version

Spam and junk leads are not mainly a website security issue. They are a measurement issue that happens to arrive through a form. Google’s filters cover invalid clicks reasonably well and invalid leads poorly, and the company says as much by describing lead quality as a shared responsibility. That leaves you with three layers of defence, and the order matters.

First, make sure your conversion only counts after a submission has passed validation, with a challenge, honeypot or server check where bots are the problem. Second, clean up the account settings and queries that feed the human junk: location, negatives, Search Partners, placements, and phone verification or qualifying questions on lead forms. Third, and most important, connect your CRM and give the account a conversion that is hard to fake, so the algorithm learns from real outcomes and stops rewarding the cheapest form fill it can find.

Judge the result on cost per qualified lead, not cost per lead. The first number will usually look worse for a while. That is what removing the junk looks like from the inside. If you want to see how Growera approaches ongoing account monitoring for lead generation accounts, you can look at the ERA AI page or the pricing page. And if you are a freelancer or agency managing several lead gen accounts, the agency page explains how that setup works.