Lesson 2 of 8 · 8 min read · intermediate
Click fraud: bots, botnets and click farms
How fake clicks are produced by software and by paid people, why search feeds are a target, and the warning signs that give them away.
Click fraud means producing clicks on pay-per-click ads with no intention of ever buying, in order to take money from the advertiser. In a search feed the thief is usually on the publisher side: someone who owns or supplies a page showing feed ads and earns a share of every click. The more clicks, the more they earn, so they manufacture clicks.
Anatomy of a click-fraud scheme
A feed pays whenever a sponsored result is clicked. An honest publisher earns that by bringing interested people. A dishonest one looks for the cheapest thing that resembles a click, which is click fraud.
- Paid per click, so clicks get faked: A feed pays whenever a sponsored result is clicked. An honest publisher earns that by bringing interested people. A dishonest one looks for the cheapest thing that resembles a click, which is click fraud.
- Visits that cost almost nothing: The fraudster sources bot traffic, or people with no interest: pop-unders nobody asked for, or incentivised traffic paid a reward to click. A real interested visitor costs $0.20 in our example; these cost a fraction of a cent.
- Blended with real visitors: Sent alone, fake visits stand out. So they are mixed with a layer of genuine traffic until the averages look normal (traffic blending), or passed through other sites first to hide where they came from (traffic laundering).
- Searches and clicks nobody meant: On the page, the fake visits “search” and “click” sponsored results. Queries no human chose are query fraud. To the feed, each one arrives looking like an ordinary ad click.
- The advertiser pays for nothing: Each click bills an advertiser about $1.00. No customer arrives, so its money buys nothing. Honest publishers in the same feed suffer too: when partner traffic converts poorly, engines pay less for all of it (smart pricing).
- What gives it away: Reviewers look for clicks that never convert, visitors from data centres or a single device model, click rates that are too high and too steady, night-time activity as busy as daytime, and one-second sessions. No single sign proves fraud; together they form a pattern of invalid traffic.
- Refunds, clawbacks and a closed account: When the engine acts, invalid clicks are credited to advertisers, the publisher’s revenue is clawed back and the feed is usually terminated (feed suspension). The feed provider above it can lose its contract as well.
Why the two-click journey attracts fraud
Most arbitrage pages use a two-click flow: the visitor clicks a keyword on the keyword lander or a related search on a content page, then clicks an ad on the results page. Only the second click earns money. Honest operators spend heavily to get real people to the first page and hope enough of them continue. A fraudster skips the hoping. They arrange for something, software or cheap labour, to complete both clicks every time.
The three sources of fake clicks
| Source | What it is | Why it is hard to spot | What usually betrays it |
|---|---|---|---|
| Simple bots | Scripts or a headless browser running on rented servers | Cheap and fast | Data-center traffic, odd browser details, no mouse or touch behaviour |
| Botnet | Malware on thousands of real home computers and phones, controlled remotely | Real home IP addresses and real devices | Clicks at inhuman hours and rhythms, the same journey repeated, zero advertiser conversions |
| Click farm | Rooms of low-paid people or racks of phones clicking by hand | Genuine human touches on genuine devices | Clusters of devices in one place, identical session lengths, nobody ever buys |
| Incentivised traffic | Real users rewarded with points or unlocks to click | Real, varied people | Very high click rate with no interest afterwards |
Fraudsters also hide where the clicks come from. A residential proxy routes automated traffic through ordinary household internet connections so that the IP address looks like a family home rather than a server farm. This is why modern IVT detection cannot rely on IP lists alone. It combines many weak signals, such as device fingerprinting, timing, behaviour on the page and what happened after the click.
A casino knows some players cheat. It cannot tell from one hand. It watches for players who win too regularly, who never chat, who always sit at the same table at the same minute. Click fraud is caught the same way: one fake click looks fine, ten thousand of them form a pattern no crowd of real people would produce.
What real traffic looks like, and what fake traffic gets wrong
Real audiences are messy. Most visitors leave without clicking anything. Those who do click take different amounts of time, arrive in waves that follow the working day, use a wide mix of phones and browsers, and occasionally buy something. Fake traffic tends to be tidy in exactly the places where reality is untidy.
- Click rates that are too good. A Lander CTR or Ad CTR far above the norm for the vertical, especially from a new or cheap source.
- Flat daily curves. Clicks spread evenly across 24 hours, or sharp spikes at times when the target country is asleep.
- Narrow device mix. One browser version, one screen size or one phone model producing a large share of clicks.
- Geography that does not fit. A campaign aimed at one country producing clicks whose time zone, language or network belongs to another.
- No life after the click. Sessions that end the instant the ad is clicked, and advertisers who see no advertiser conversion at all.
- Revenue that later disappears. A source that looks profitable on estimated numbers and loses a large share when revenue is finalised.
A worked example
Say an operator buys 10,000 visits a day from a new native placement at $0.05 each, so $500. On their normal traffic, about 30% of visitors click a keyword and about 35% of those click an ad, giving roughly 1,050 paid clicks. The new placement shows 70% and 60%, giving 4,200 paid clicks. At an illustrative RPC of $0.30 the dashboard shows $1,260 of revenue on $500 of spend. It looks like the best source they have ever found.
Three weeks later the feed provider finalises the month. Most of those clicks are deducted as invalid, the operator's quality rating drops, and their revenue per click on all the other, honest traffic is reduced. The $500 a day was real money paid to the traffic source. The $1,260 a day never existed.
Who does it, and why
- Traffic sellers who are paid per visit and pad their volume with bots so buyers see high engagement.
- Sub-publishers under a feed provider who earn a revenue share and click their own feed, directly or through hired clickers.
- Criminal groups running botnets that are rented out to whoever pays.
- Competitors of advertisers, who click a rival's ads to drain a budget. This happens mostly on the search engine's own results, not on arbitrage pages.
This lesson describes the mechanisms only at the level needed to recognise them. The following lessons cover schemes that are specific to search feeds, starting with the one that involves real humans being misled.
Key takeaways
- Click fraud in a search feed is usually committed on the publisher side, by someone paid per click or per visit.
- Fake clicks come from simple bots, botnets on real devices, human click farms and rewarded users.
- Residential proxies make IP checks unreliable, so detection combines device, timing, behaviour and post-click signals.
- Unusually high click rates, flat daily curves, narrow device mixes and zero conversions are the classic red flags.
- A buyer who was sold fake traffic still carries the consequences under the feed's rules.
Questions people ask
What is click fraud in search arbitrage?
Click fraud is the deliberate creation of ad clicks with no real interest behind them, to collect the publisher's share of what the advertiser pays. In search arbitrage it typically means bots, hijacked devices or paid people completing the keyword click and the ad click on a feed page. The advertiser is billed, the fraudster earns a share, and nobody ever buys.
How do click farms work?
A click farm uses low-paid workers or racks of real phones to click ads by hand, so each click comes from a genuine device and a genuine touch. That defeats simple bot checks. Farms are found through patterns instead: many devices in one location, repeated journeys of identical length, unusual hours and a complete absence of purchases afterwards.
Can bots click on Google search ads?
Yes, bots attempt it constantly. Google says it uses automated filters, manual reviews and research teams to detect invalid clicks, removes detected ones from billing and credits advertisers when it finds them later. No filter is perfect, which is why advertisers also watch conversion data and can limit or exclude partner traffic that performs poorly.
How can I tell if traffic I bought is fake?
Compare it with your known good traffic. Warning signs are click rates far above normal, clicks spread evenly through the night, a very narrow range of devices, locations that do not match your targeting, sessions that end at the ad click, and revenue that shrinks sharply when finalised. One sign alone proves little. Several together justify pausing the source.