Last updated: 12 July 2025
Click fraud is a billion-dollar scam that drains advertising budgets, floods your campaigns with fake leads, and trains ad networks to send you more bot traffic. This article breaks down how click fraud works, why it’s so common, and what you can do to stop it.
The flow of money in online advertising
To understand click fraud, it helps to start with how online advertising is paid for. Most ads work under one of two pricing models:
- PPC (Pay-per-click): You pay when someone clicks your ad. For example, if you're paying $20 per click, every time someone clicks, you’re charged $20 - whether it's a human or a bot.
- CPM (Cost per mille): You pay per 1,000 impressions - that is, each time your ad is displayed, not clicked. A typical rate might be $20 per 1,000 impressions.
Both models have pros and cons. In either case, advertisers pay money, and publishers (the websites that show your ads) earn money - either for the clicks or impressions they generate.
If an ad network uses only PPC, then advertisers pay per click and publishers earn per click. If it uses CPM, publishers are paid per 1,000 impressions - regardless of whether anyone actually engages with the ad.
Here’s the key point: whether you’re paying for clicks or impressions, you still want real people to engage with your ads. The ultimate goal isn’t awareness - it’s sales. Fake impressions don’t convert. Fake clicks don’t buy.
Even if you’re running a CPM campaign, bots still hurt you. Bots can view your ads, click on them, and even trigger fake conversions like form submissions - all of which trains the ad network to send you more bots in the future.
How publishers take advantage of this model
Most click fraud happens on publisher websites - many of which are run by criminals.
These scammers sign up for publisher accounts on ad networks like Google or Microsoft, build basic websites, and then deploy bots to generate clicks or impressions. These bots run on residential and cellphone proxy networks, allowing them to look like real users with unique IP addresses.
Each fake click or impression steals a small amount of your ad budget - but at scale, it adds up to billions of dollars in fraud.
There are two major forms of click fraud:
- Publisher click fraud – where fake websites use bots to click on ads and generate revenue.
- Retargeting click fraud – where bots get cookied by the ad networks, get retargeted with more ads, then repeatedly click those ads later.
Learn more about retargeting click fraud.
Why there are fake conversions
Ad networks use conversion signals - like someone adding to cart or filling out a lead form - to decide whether a campaign is working. If they see lots of conversions, they send you more of the same traffic.
Scammers know this. That’s why their bots don’t just click on ads - they also submit fake leads, sign up for mailing lists, or simulate checkouts.
These fake conversions trick the ad networks into thinking the bot traffic is high quality - and the networks continue rewarding it.
Learn more in our article on conversion fraud.
The consequences of click fraud and fake conversions
Click fraud doesn’t just waste your budget - it damages every part of your advertising strategy:
- You pay for traffic that never converts.
- You train the ad network to send more bots.
- Your sales team wastes time chasing fake leads.
- You risk violating data privacy laws by contacting people whose info was stolen and submitted by bots.
- Your analytics are skewed, making it look like your campaigns are working when they’re not.
Why aren’t ad networks stopping this?
Ad networks have a conflict of interest: they get paid for every click or impression - whether it comes from a human or a bot. There’s no financial incentive for them to fix the problem.
Polygraph consistently outperforms ad networks in detecting click fraud - which raises questions. If a small cybersecurity company can catch fraud at scale, why aren’t the billion-dollar ad platforms doing the same?
How Polygraph solves click fraud
Polygraph detects and blocks click fraud in real time, using advanced methods that go far beyond what ad networks offer. Here’s how:
- Advanced detection – We identify fake clicks by tricking the bots to reveal themselves.
- Bot blocking – We stop bots from submitting lead forms, adding items to carts, and triggering other fake conversions.
- Retraining the ad networks – By blocking fake conversions, we help train ad platforms to send you real human traffic - not bots.
- Zero false positives – Polygraph has been independently audited and confirmed to never block real humans.
The result? You get cleaner traffic, better leads, and lower customer acquisition costs.
In summary
Click fraud is one of the biggest hidden threats in digital advertising. Whether you’re paying per click or per impression, bots can drain your budget, fake your leads, and poison your campaign data.
Polygraph protects your ads from fraud, stops fake conversions before they happen, and helps you get the real value you paid for.