What is click fraud?
+
Click fraud is any click on your paid ads that comes from something other than a real potential customer: bots, scripts running on cloud servers, click farms, competitors, or people clicking again and again. You pay for the click and get nothing back. Google calls these invalid clicks.
How common is click fraud in 2026?
+
In our October 2026 benchmark of 2,334,216 paid clicks, almost 1 in 10 (9.1%) showed at least one warning sign of invalid traffic, and 1 in 24 (4.1%) were high risk: cloud servers, commercial VPNs or proxies, Tor or automation. It varies a lot between advertisers. The typical advertiser saw 7.8% with warning signs, but for 1 in 10 advertisers it was 14% or more.
Does Google Ads refund invalid clicks?
+
Yes, for the ones it catches. Google filters many invalid clicks before you are billed and credits others later, "when appropriate and possible". But its reviews and investigations only cover the past 60 days, its new Invalid Activity Credit Report covers Search and Performance Max only, and it does not publish how many invalid clicks it misses.
Is click fraud worse on Microsoft Ads than Google Ads?
+
In our data, yes. 7.7% of Microsoft Ads clicks were high risk against 3.9% on Google Ads, almost twice the rate. Among advertisers running both with enough clicks to compare, Microsoft was worse for more than 8 in 10. Most of the gap was VPN and proxy traffic rather than data centres.
What is invalid traffic (IVT), GIVT and SIVT?
+
Invalid traffic is the industry term for activity that does not come from genuine human interest, as defined by the Media Rating Council (MRC). General invalid traffic (GIVT) is the easy kind, caught with lists and routine checks, such as known bots and data centre traffic. Sophisticated invalid traffic (SIVT) needs deeper analysis: hijacked devices, residential proxies and bots built to look human. Google says about 80% of the invalid clicks it catches are GIVT.
Are AI agents clicking my ads?
+
Hardly any that admit it. Self-declared AI agents made about 1 in 50,000 paid clicks over 91 days, on the accounts where our tracking can spot them. The catch is that most agents do not declare themselves: a Cambridge and MIT study found 21 of 30 had no documented disclosure that they are AI. Google has not said how it bills their clicks.
Can competitors click my ads?
+
Yes, and it is hard to stop through the courts. In the US Motogolf case a computer misuse claim against a rival accused of clicking ads was dismissed because the ads were public. In our data, 1.1% of paid clicks came from an IP address that clicked the same advertiser five or more times in one day. Excluding repeat clickers and reporting them to Google within 60 days is the practical route.
How much does click fraud cost?
+
For your account, multiply your spend by your rate. On £5,000 a month at the typical advertiser's 7.8%, about £390 a month goes on clicks showing warning signs. Globally, we could not find an independently funded estimate: every recent headline figure we traced was produced with, or paid for by, a company that sells fraud protection, so we do not quote one.
How did ClickGuardian measure these statistics?
+
We took a 91-day snapshot, 22 July to 20 October 2026, and analysed every paid click on Google Ads and Microsoft Advertising from the advertisers whose clicks we tracked in that window: 2,334,216 clicks, each counted once by its click ID. A click is high risk when it came from a cloud data centre, a commercial VPN or proxy, or Tor, or showed clear signs of automation. Privacy tools such as iCloud Private Relay are not counted. The full method is on this page.
