Click Fraud Study 2026

Between 1 January and 30 June 2026, ClickSambo's tracking template recorded 718,590 Google Ads clicks for 73 advertiser accounts, 164 websites and 21 industries, with traffic arriving from 90 countries. Every click was scored in real time and either passed as valid or flagged with a specific fraud type.

We paired that data with something numbers alone can't give you: one-to-one conversations with the advertisers behind it. When we ask customers who they think is clicking their ads, most give the same answer before we show them a single chart. This study checks whether the data agrees with them.

Known crawlers were removed before counting. Breakdowns with fewer than 100 clicks, or resting on a single advertiser, are not published. The full method is at the end of the page.

38.1% of paid clicks were invalid in Q1 2026. That is 33,020 of 86,638 Google Ads clicks.

In Q2 the rate climbed every single month: 38.0% in April, 62.0% in May and 73.1% in June. By June, almost three in four paid clicks we tracked were invalid. Click fraud didn't behave like background noise. It arrived in waves.

458,153 invalid clicks in six months. Across both quarters, that is how many paid clicks were flagged before or after they reached an advertiser's site.

Invalid IPs click more often than real customers. In Q1, 28.5% of unique IP addresses were classified as invalid, yet they produced 38.1% of all clicks. On average an invalid IP clicked 1.71 times, against 1.11 times for a valid one.

Our engine made 239.6 IP block decisions for every 1,000 clicks in Q2, almost exactly the 232.9 it made in Q1, even though tracked traffic grew more than sevenfold. The detection didn't get looser as volume rose.

Every invalid click is counted once, in the strongest category that applies.

Repeat clicks from a single IP were the largest category in both quarters: 70.4% of invalid clicks in Q1 and 54.8% in Q2. No botnet, no VPN, no clever software. Just the same device coming back to click the same ads.

Clicks from suspicious IP ranges more than doubled their share, from 19.1% to 42.7%. These are whole network blocks that had already produced invalid traffic, not single addresses. It is the signature of coordinated activity spread across many IPs at once, the kind of pattern you can't stop by excluding one address at a time.

VPN, proxy and Tor traffic fell from 9.7% to 2.3% of invalid clicks, and clicks classified only as bot behaviour from 0.8% to 0.2%.

The jump in range-based clicks lines up with what the security industry is seeing. On 2 July 2026, Google announced it had disrupted the NetNut residential proxy network with the FBI and other partners. Google estimated the network ran through at least 2 million home devices, and that its exit nodes were used by 316 distinct threat clusters in a single week of June. Residential proxies make traffic look like it comes from an ordinary household, which is exactly why range-level detection matters more each quarter.

In one-to-one calls, we ask advertisers a simple question: who do you think is clicking your ads? The answer is remarkably consistent. A rival across town. Another agency's client bidding on the same keywords. Someone who knows exactly what a click costs in their industry.

Anecdotes aren't evidence, so we went back to the clicks and looked for the patterns competitor click fraud should leave behind. Five of them show up clearly.

1. It looks human. Only 9.6% of page loads from paid Google Ads traffic showed bot signals in Q2, and 9.9% in Q1. Nine in ten paid visits moved, scrolled and behaved like a person.

2. It comes from ordinary connections. 84% of invalid clicks in Q2 came from home and mobile networks, and only 1.8% from data centres. Cheap bots usually run from servers. A competitor uses their own phone.

3. It happens on Search. 95% of invalid clicks in Q2 were on Search ads, the place where a rival types your service into Google and sees your ad at the top of the page. Search partner sites ran at only 21.9%.

4. It comes back. More than half of invalid clicks were the same IP returning to click again. Someone draining a budget doesn't need to be sophisticated. They need to be persistent.

5. It concentrates where clicks are expensive and competition is local. The highest rates in our data were in banking and finance, maintenance, beauty, home repair and emergency trades like electrical work and plumbing. These are businesses that compete for the same nearby customers, where one click can cost more than a coffee and a lost lead goes straight to the business down the road.

Mobile makes it easy. In Q2, 69.0% of mobile clicks were invalid against 34.3% on desktop. The desktop rate barely moved from Q1 (34.9%). Almost all of the increase happened on phones.

None of these signals proves who is behind any single click. Residential proxies can make automated traffic look like a home user, and some repeat clicks are simple curiosity. But taken together, the profile is hard to ignore: human, mobile, local, persistent and focused on Search. 

Banking and finance had the highest invalid rate in Q2, at 83.8%. It was also among the highest in Q1 (65.6%).

Maintenance services (70.8%), beauty and cosmetics (65.6%) and online retail (63.1%) followed. Beauty stands out for its size: 31,334 of its 47,738 clicks were invalid.

Emergency trades run hot. In Q1, electrical services reached 77.1%, home repair 51.3%, freight and storage 41.8% and plumbing 40.9%. In Q2, home repair stayed above half at 52.7%.

The largest industries by volume weren't spared. Transport and logistics (36.9%, 73,098 clicks) and tourism (25.8%, 56,158 clicks) sat below the most-attacked sectors, but one in four of their paid clicks was still invalid.

The cleanest were online gaming (4.5%) and medical services (16.1%). Medical services was also the cleanest sector in Q1, at 17.9%.

The spread itself tells a story. If invalid traffic were mostly random bots, rates would be similar everywhere. Instead they follow cost per click and local competition, rising more than eighteen-fold from the cleanest industry to the most attacked.

Search had the highest invalid rate of any ad network, 43.6% in Q1 and 69.1% in Q2.

Performance Max went from 18.8% to 51.0% in one quarter. Many advertisers assume automated campaign types are cleaner because Google controls placement. Our data says the opposite can happen fast, and with less visibility into where the clicks came from.

Display Network rose from 27.3% to 35.4%. Search partners stayed comparatively low at 19.5% and 21.9%.

Data centres are almost always invalid. 97.7% of clicks from hosting networks were invalid in Q1, and 96.1% in Q2. Real customers don't click ads from a server.

VPN, proxy and Tor clicks went from 53.3% to 84.5% invalid. Their share of all clicks also grew, from 8.3% to 11.0%.

Clicks from outside the target country were riskier. In Q1, 53.8% of clicks from outside an advertiser's main market were invalid, 16 points above domestic clicks. Tight location targeting is one of the cheapest fixes there is.

The invalid rate peaked between 11 p.m. and midnight, at 87.4% in Q2. The cleanest hour with meaningful volume was 9 a.m. to 10 a.m., at 35.7%. A 50-point swing between morning and late night is not how real customers behave.

In Q1 the peak came an hour later, between midnight and 1 a.m., at 51.5%.

Saturday was the worst day in Q2 (74.6%), and Monday the cleanest (58.0%). In Q1 the weekday spread was narrow, from 34.1% to 41.1%.

The pattern makes sense once you picture who is clicking. Late at night and at weekends, the advertiser isn't watching the account, and neither is anyone else in the office. Anyone who wants to burn through a daily budget knows that too.

Only 16.0% of invalid clicks in Q2 loaded the landing page. For valid clicks, the load rate was 60.9%. In Q1 the figures were 45.9% and 61.7%. Most invalid clicks are recorded, charged and never turn into a visit at all.

The valid-click load rate held at about 61% in both quarters. It is a useful check on the data: while traffic grew more than sevenfold, the behaviour of clicks we classified as valid stayed the same.

Invalid clicks show up in Google's click report as often as valid ones. For advertisers with a linked account, 87.9% of the clicks we flagged as invalid in Q2 also appeared in Google's own click report, against 87.0% of valid clicks. In Q1 the figures were 73.6% and 76.9%. The click report lists recorded clicks rather than invoice lines, but it shows how much of this traffic reaches the account.

Google's exclusion list has a ceiling. Google Ads allows up to 500 IP exclusions per campaign. Only 24.1% of our block decisions in Q1, and 22.8% in Q2, were passed to Google Ads as exclusions. The rest had to be handled on the advertiser's side.

Bots now outnumber people online. The Thales 2026 Bad Bot Report found that automated traffic made up more than 53% of all web traffic in 2025, up from 51% a year earlier. AI-driven bot attacks grew 12.5 times compared with 2024.

Ad fraud cost advertisers an estimated $84 billion in 2023, about 22% of online ad spend, according to Juniper Research.

Search is still where the money is. US digital ad revenue reached a record $294.6 billion in 2025, with search at $114.2 billion, according to the IAB/PwC Internet Advertising Revenue Report.

Google is fighting abuse at scale. Its 2025 Ads Safety Report says Google blocked or removed 8.3 billion ads and suspended 24.9 million advertiser accounts in 2025. Those figures cover policy violations rather than invalid clicks, but they show how much bad activity runs through the ad system.

Ad fraud is prosecuted as serious crime. In November 2021, a US federal court sentenced Aleksandr Zhukov, the operator of the Methbot scheme, to 10 years in prison. According to the US Department of Justice, the scheme used more than 2,000 rented data-centre servers, spoofed the domains of more than 6,000 publishers and took over $7 million from advertisers.

Fake traffic can make reports look better. A 2026 paper in Business Horizons by Hrnjadovic and Dost argues that fake traffic can make campaign metrics look healthier than they are. Our landing-page data shows the cost behind that: clicks that are counted and paid for, but never become a visit.

Assume the threat is human. Most invalid clicks in our data looked like people on phones. Bot detection alone misses most of it. Repeat-click thresholds and IP-range exclusions catch far more.

Watch your account when you aren't watching it. Late nights and Saturdays had the highest invalid rates. Check what happens to your budget outside office hours before deciding your ad schedule.

Don't treat automated campaigns as safe. Performance Max went from one of the cleanest networks to one of the riskiest in a single quarter.

Filter the obvious first. Data-centre traffic was invalid more than 96% of the time in both quarters. Clicks from outside your target market were invalid more than half the time.

Prevention beats refunds. Google credits some invalid clicks afterwards, but only within 60 days and only for what it can confirm. Our Google Ads invalid click refund guide explains how credits work. Stopping repeat sources early saves more than claiming money back later. For a wider set of industry figures, see our click fraud statistics roundup.

Data source. Google Ads clicks recorded by ClickSambo's tracking template between 1 January and 30 June 2026 (UTC). Q1 covers 86,638 clicks from 48 websites and 40 advertiser accounts. Q2 covers 631,952 clicks from 164 websites and 73 advertiser accounts. Local times use each website's time zone.

Definitions. Rows sharing a click ID on the same site count as one click. An invalid click is one our engine flagged with a fraud type: repeat clicks, suspicious IP range, VPN, proxy or Tor, bot behaviour or blacklist. Each invalid click is counted once, in its highest-priority category. The invalid click rate is invalid clicks divided by all clicks.

What we removed. Known crawlers (Googlebot, AdsBot-Google, bingbot, HeadlessChrome and others) and rows where Google Ads tracking parameters were never filled in. Cells with fewer than 100 clicks or resting on a single advertiser are not published.

Customer interviews. Qualitative input comes from one-to-one conversations with ClickSambo customers. We report the patterns in the click data that are consistent with what customers described. The data cannot identify who is behind an individual click.

Limitations. Our customers came to us because they were already worried about invalid traffic, so they may face more of it than the average advertiser. Most of the traffic comes from advertisers in Turkey and from local service businesses. The sample grew strongly between quarters, so quarter-on-quarter changes reflect a growing and changing set of advertisers as well as a changing threat. Industry rates depend on which advertisers were active in a quarter. Global figures in "The Global Picture" come from the sources named there.

How to cite. ClickSambo (2026). Click Fraud Study 2026:  The quarterly reports behind this study are on our invalid click report page.

All figures are anonymised and aggregated. The study contains no personal data, IP addresses, customer names, domains or spend figures.