How to Investigate Suspicious Google Ads Traffic Using First-Party Evidence

Start with a hypothesis, not a fraud percentage

Write what changed, where and what evidence would support or weaken the explanation. For example, ask whether repeated form payloads from one campaign correspond to confirmed non-enquiries. Include a competing explanation such as a form release or slower sales follow-up. This prevents a search for examples that merely confirm the initial suspicion.

Freeze the investigation period

Choose exact start and end times, a timezone and a comparison period. Preserve exports with collection dates and field definitions. Record campaign edits, tracking releases and form changes. Keep original snapshots available so a later platform adjustment or CRM status change does not silently alter the historical result.

Collect campaign identifiers

Export the campaign and available ad group or asset-group identifiers with names and network context. Prefer stable IDs for joins because names can change. Do not assign a lead to a placement when the account only provides placement totals; record the missing association as a limit of the investigation.

Preserve GCLID and timestamps

Check that the landing identifier reaches the accepted submission record. Store the interaction, submission and outcome timestamps separately. Treat duplicate identifiers, redirects and overwritten attribution as exceptions to review. A temporal match by itself should not replace a reliable event association when several visits can overlap.

Join web/session data

Map accepted submissions to the request and session evidence available for the same process. Check clock alignment and session rules. Report the number of unmatched records and ambiguous joins; do not fill gaps with an assumption that a shared IP means the same person or bot.

Join CRM data

Add the recorded contact and qualification results using stable lead IDs. Distinguish pending, uncontactable, genuine but unsuitable and supported fabrication findings. Preserve the decision reason and review date. Verify whether repeated CRM entries represent new submissions, retries or a synchronisation defect.

Use consistent outcome categories when reviewing CRM data

Segment by source, geography, device, timing

Compare like-for-like cohorts, taking tracking availability and follow-up age into account. Choose segments relevant to the hypothesis rather than searching every possible slice for an unusual number. Geography or device labels may be inferred and imperfect, so keep their evidential strength distinct from a confirmed submission outcome.

Look for clusters rather than anomalies

Review recurring sequences across multiple records: payload repetition, request timing, route choices and outcome consistency. Compare the pattern with ordinary traffic. One unusual session rarely supports a broad block, and several events from a shared exit are not necessarily controlled by the same actor.

Interpret multi-signal bot evidence and its limitations

Review legitimate explanations

Test whether the pattern could arise from internal tests, accessibility software, retries, mobile networks, privacy tools or a misleading offer. Inspect the tracking path for duplicated events. Include representative accepted sessions, not just rejected examples, when evaluating whether a proposed rule separates abuse from demand.

Assign confidence

State what is observed, what is inferred and what is unknown. A repeatable automated sequence may support a stronger classification than actor identity or motive. Document the data needed to resolve an inconclusive case instead of using a precise-looking score without explaining its basis.

Decide what action the evidence supports

Select a scoped response with an owner, review date and outcome measure. Preserve the pre-change evidence and a suitable comparison where feasible. For a Google billing investigation, check the current submission requirements and 60-day review window; the platform decides whether credits are appropriate. An internal finding does not guarantee recovery.

Separate billing credits from the lead-quality findingScope an evidence-led review of the suspected traffic patternBuild the evidence package for a Google invalid-traffic review