Click Farms in Google Ads: How to Spot and Stop Them in 2026
Maria Gladko · Content & Education · · Updated · 13 min read Click farms beat bot detection because humans pass biometric signals. The 5 behavioral patterns that catch them and how to block them in Google Ads.
A click farm is a real-world operation where paid humans, not bots, click on paid ads from real phones on real residential networks. In Google Ads, that single fact is what makes them so hard to stop. Click farms beat every technical detection layer that catches bot traffic, because the clicks really are coming from a human finger on a real device. Juniper Research projects global ad-fraud losses will reach $172 billion by 2028, up from $84 billion in 2023, and click farms are taking a growing share as bot detection improves. (Juniper Research, 2024)
Google Ads is the most attractive target for click-farm operators because the CPCs are high, the Sophisticated Invalid Traffic (SIVT) detection is structurally weak, and the refund process is slow. This guide explains what click farms actually are, how they target Google Ads, and the behavioral signals that catch them when fingerprinting and IP intelligence cannot.
- Click farms are real humans on real devices, not bots. Every technical signal (fingerprint, TLS, device, IP) looks legitimate. Detection must come from behavior and funnel depth, not from device inspection.
- Google Ads is the prime target because CPCs are high (local-service campaigns commonly $30 to $80 per click) and platform SIVT detection systematically under-catches farm traffic on residential IPs.
- The five reliable signals are conversion-rate collapse, time-on-page clustering at 8 to 15 seconds, geo concentration in farm hubs, identical device-model strings repeating, and multi-account same-IP correlation.
- Bot-detection tools miss click farms entirely because farm workers pass CAPTCHAs, generate real touch physics, and produce human cursor entropy. Behavioral funnel analysis is the catch layer.
- Refunds are available with timestamped per-click evidence, advertisers running multi-signal detection recover 8 to 22 percent of paid budget within 60 days in our field data. (Spider AF, 2024)
What are click farms, exactly?
A click farm is a coordinated operation where real workers, paid per task, click on paid ads or perform other engagement actions on behalf of a buyer. The Spider AF 2024 ad-fraud report documented farms operating with 10,000 to 100,000 physical phones racked in warehouses, each connected to mobile or residential networks, each driven by a low-wage operator. (Spider AF, 2024)
This is the part most marketers get wrong: a click farm is not a bot operation. It is a sweatshop. Workers are typically paid between 0.5 cents and 5 cents per click, with daily quotas in the thousands. Investigations by the BBC, Vice, and HUMAN Security have documented farms in Bangladesh, Indonesia, the Philippines, Vietnam, and increasingly Eastern Europe. (BBC News, 2018)
In two recent Adsafee customer audits, the farm traffic was so well-disguised that the customer initially refused to believe it was fraudulent. The IPs were clean residential ranges. The devices were real Samsung and Xiaomi phones. The user-agents matched the screen resolutions. The only tell was that none of these “users” ever made it past step two of the lead form, and every session ended within a 7-second window.
Citation capsule
According to multiple ad-fraud investigations including HUMAN Security and Spider AF, modern click farms operate physical warehouses with tens of thousands of real consumer phones, paying low-wage workers 0.5 to 5 cents per click. Because the devices and IPs are genuine, click farms bypass the technical detection layers that catch bot traffic, making them the fastest-growing category of Sophisticated Invalid Traffic targeting Google Ads.
Why do click farms beat bot detection?
Click farms defeat conventional bot detection because every technical signal a fingerprint-based tool inspects is genuinely human. The HUMAN Security 2024 Quadrillion Report noted that fingerprint-based detection alone catches under 40 percent of sophisticated invalid traffic, and click farms with real devices sit squarely in that uncaught majority. (HUMAN Security, 2024)
Here is what farm traffic passes that bot traffic fails:
- TLS / JA3 fingerprint is the real Chrome or Safari handshake from the device.
- Canvas and WebGL fingerprints are real GPU hashes from real Android and iOS hardware.
- Touch event physics show real pressure variance and motion drift from real fingers.
- Mouse and scroll entropy are produced by real humans, not by a deterministic script.
- CAPTCHAs are solved by the worker, not by a CAPTCHA-solving service.
- navigator.webdriver flag is false because there is no automation framework involved.
The deeper problem is that as bot detection improves, the economics shift in favor of click farms. A bot that fails a fingerprint check is worth zero to the fraud operator. A human worker on a real phone is worth the same fraction of a cent regardless of how good the buyer’s detection is. So the more aggressively the industry hardens against bots, the more profitable click farms become. That is why farm traffic is rising as a share of total ad fraud, even as overall detection improves.
Citation capsule
HUMAN Security’s 2024 research indicates fingerprint-based bot detection catches under 40 percent of sophisticated invalid traffic, and click farms account for a growing share of the uncaught majority. Because farm workers operate real devices on real networks, every technical signal a fingerprint tool inspects passes legitimately, the detection signal must shift from device authenticity to behavioral intent.
How do click farms target Google Ads specifically?
Click farms target Google Ads more aggressively than any other channel because the CPCs are highest, the refund cycle is slowest, and the platform’s SIVT filtering runs after the auction. A Statista 2024 analysis put average legal-services Google Ads CPCs at over $9, with personal-injury and insurance categories regularly clearing $50 per click. (Statista, 2024) That economic gradient is what makes farm operators concentrate budget on Google Ads.
Heaviest impact on local-service ads
Local-service ads (lawyers, dentists, plumbers, locksmiths, addiction treatment) carry the highest CPCs and the smallest geographic competitor pool. A click farm hired to drain a competitor’s daily budget in a single metro can do so for a fraction of the budget being drained. We have seen Adsafee customers in legal verticals lose 12 to 18 percent of their daily spend to coordinated farm activity that exhausts the budget by mid-morning.
Targeted hatred, competitors hiring farms
The most common motive for explicit click-farm hiring against Google Ads is competitor sabotage. A small-business owner who pays a farm $200 to burn through a rival’s $5,000 daily budget gets a 25x return on the sabotage spend, before considering the competitive ranking benefits when the rival’s ads exhaust early. This is the click-farm-in-PPC dynamic that survey work and reporting have documented across legal, dental, and home-services markets.
Affiliate-side, low-tier networks bury farm traffic
In affiliate and CPA networks, low-tier traffic sources mix farm clicks into a larger pool of organic-looking traffic. The conversion patterns survive in aggregate because the farm fraction is calibrated to stay under the threshold most networks audit at. Advertisers running Google Ads as part of an affiliate funnel see farm traffic enter through the affiliate side, get attributed to the Google Ads click that came earlier in the chain, and pollute the Performance Max optimization signal.
Citation capsule
Google Ads attracts disproportionate click-farm activity because CPCs in local-service verticals routinely exceed $30, and Google’s IVT filtering runs post-hoc on aggregated data rather than at click time. According to Statista 2024, legal-services CPCs average over $9, with personal-injury categories clearing $50, the economic gradient that funnels farm operators toward Google Ads as the highest-value target.
How to detect click farm traffic in your Google Ads account
Five signals, viewed together, catch click farms with high reliability. Single-signal detection produces false positives, multi-signal detection produces refund-grade evidence. The Spider AF 2024 dataset showed that combinations of three or more behavioral signals achieved over 92 percent precision in flagging farm traffic. (Spider AF, 2024)
Conversion-rate gap
The cleanest signal. Click-through rate looks normal, conversion rate is near zero. Farm workers click, scroll briefly, then bounce because they have no intent to purchase. If a campaign segment shows CTR within normal range but CR under 0.3 percent of your account average, it is the strongest single tell.
Device coherence
Real-world Android and iOS distributions follow predictable patterns: a long tail of device models, mixed OS versions, mixed Chrome and Safari versions. Farm traffic shows the opposite, narrow concentration on one or two device models (often whatever phone the farm bought in bulk), identical OS versions, identical browser versions. If 60 percent of a segment is one Samsung model, that is not a customer base.
Geo clustering in farm hubs
Genuine customer geo follows your targeting. Farm geo concentrates in Bangladesh, Indonesia, the Philippines, Vietnam, parts of India, and sometimes Ukraine and Belarus. If your campaign targets the United States and 4 percent of clicks resolve to mobile-network IPs in Dhaka, the click is a farm click regardless of how clean the device looks. Cross-reference IP geolocation with the device locale and language settings.
Time-on-page clustering at 8 to 15 seconds
Real users produce a wide distribution of session durations. Farm workers operate on quotas, click, wait the minimum required time, leave. The result is a tight cluster of session durations between 8 and 15 seconds with extremely low variance. A histogram with a 4-second-wide spike at this range is a click-farm signature.
Multi-account same-IP correlation
When farms are used to generate fake conversions (form submissions, demo requests), multiple submissions resolve to the same residential IP within the same hour, with subtly different names and emails. This is the strongest evidence layer for refund disputes because the per-click logs show the IP collision directly.
Citation capsule
According to Spider AF’s 2024 dataset, combining three or more of the five behavioral signals, conversion-rate collapse, time-on-page clustering at 8-15 seconds, geo concentration in known farm hubs, narrow device-model distribution, and multi-account same-IP correlation, achieves over 92 percent precision in flagging click-farm traffic in Google Ads. Single-signal detection produces too many false positives to be actionable.
What do standard tools miss about click farm traffic?
The honest answer is that most click-fraud tools sold to Google Ads advertisers were built to catch bots, and they catch bots well. They were not built to catch real humans on real phones, and they catch click farms poorly.
Here is what falls through:
- IP blocklist tools miss farms entirely because residential and mobile IPs are not on bot lists.
- Fingerprint-only tools miss farms entirely because the fingerprints are genuine.
- CAPTCHA gates miss farms because workers solve CAPTCHAs as part of the quota.
- Honeypot fields miss farms because workers fill forms manually and skip invisible inputs the way humans do.
- Device-velocity rules miss farms because each device is one device, not one device rotating through many sessions.
In Adsafee’s internal benchmark across customer accounts in 2025, tools relying primarily on IP blocklists and fingerprinting flagged under 11 percent of click-farm traffic that behavioral funnel analysis subsequently caught. The gap is not subtle, it is the difference between catching bots and catching humans-who-are-paid-to-click.
click fraud protection Google Ads
Citation capsule
Adsafee 2025 internal benchmark data shows that detection tools relying primarily on IP blocklists and device fingerprinting flag under 11 percent of click-farm traffic subsequently caught by behavioral funnel analysis. The gap reflects a structural mismatch, bot-detection methodology cannot identify real humans on real devices, regardless of how sophisticated the fingerprinting layer is.
Which behavioral signals catch click farms?
Because technical detection fails, the catch layer is behavioral and funnel-shaped. Three patterns reliably identify farm traffic where fingerprinting cannot.
Conversion-funnel divergence
Real users who click an ad and land on a page either bounce immediately or proceed through the funnel, view product, add to cart, start checkout, complete purchase. Farm workers click, scroll briefly to satisfy a time threshold, and leave. They never advance past step one. The detection signal is the shape of the funnel: normal funnels narrow gradually, farm funnels are a cliff at step two.
Affiliate-side, payout pattern correlation
When farms are run by an affiliate to inflate conversions, the payout patterns reveal them. Same affiliate ID generating conversions clustered at specific times, conversions from the same /24 IP range, conversions where the lead never replies to outreach. Cross-referencing affiliate payout data against funnel depth catches farm activity that looks clean at the click layer.
LTV correlation, farms never become customers
The longest-cycle signal, but the most definitive. Farm-attributed users never produce revenue at any point in the lifetime. Compute 90-day or 180-day LTV by traffic segment, the farm segments resolve to zero. This signal is too slow for real-time blocking, but it is the gold-standard evidence for refund disputes and for retroactively flagging entire campaign segments as poisoned.
Citation capsule
Behavioral detection catches click farms by measuring funnel divergence and lifetime-value correlation rather than device authenticity. Real users advance through funnel steps and produce revenue over time, farm-attributed users cliff at step one and produce zero LTV. The combination of funnel shape and 90-day LTV by traffic segment is the most definitive evidence-grade signal for Google Ads refund disputes.
Recovery and refund options
Google Ads honors invalid-traffic refunds when the documentation meets evidence standards. Vague complaints get rejected, specific timestamped per-click logs get paid. The Media Rating Council’s IVT framework defines what counts as Sophisticated Invalid Traffic, and click-farm activity falls cleanly inside that definition. (Media Rating Council, 2020)
The dispute workflow that succeeds:
- Export per-click event logs with timestamp, IP, ASN, device fingerprint, geolocation, session duration, and funnel depth.
- Flag clicks matching three or more signals from the detection matrix above.
- Submit through Google’s Invalid Clicks dispute form with the per-click log attached, not in aggregate. Per-click evidence is the contractual unlock.
- Follow up at 14 and 30 days, the first response is often a templated denial, the second response is where adjudication actually happens.
In our field data, advertisers running multi-signal detection recover 8 to 22 percent of paid budget within the first 60 days, with affiliate-heavy and local-service-heavy mixes seeing the larger swings.
Where Adsafee fits
Adsafee scores every click in your Google Ads funnel on technical, behavioral, and network signals, with explicit behavioral-funnel detection layered to catch click farms that fingerprinting misses. Verdicts return in under 100 milliseconds via JavaScript tag, S2S postback, or REST API, and refund-grade reports are formatted for the Google Ads dispute process.
If you want to know whether your current Google Ads traffic contains farm clicks, start a free trial, the first audit takes about 10 minutes to set up and surfaces the five behavioral signals against your live account.
Sources
- Juniper Research, “Future Digital Advertising: AI, Ad Fraud and Ad Spend 2023-2028”, $84B in 2023, $172B projected by 2028. juniperresearch.com
- HUMAN Security, “Quadrillion Report 2024”, sophisticated invalid traffic, fingerprint-only detection catches under 40 percent. humansecurity.com
- Spider AF, “Ad Fraud Report 2024”, click-farm operations scale, geographic concentration, and behavioral-signal precision data. spideraf.com
- Media Rating Council, “Invalid Traffic Detection and Filtration Guidelines Addendum”, definitions of GIVT vs SIVT. mediaratingcouncil.org
- Statista, “Average Google Ads CPC by Industry 2024”, legal and personal-injury CPC benchmarks. statista.com
- BBC News and Vice News investigative reporting on click-farm operations in South and Southeast Asia, 2018-2022.
Frequently asked questions
What is a click farm in PPC?
A click farm is a physical or virtual operation where real humans, paid per task, click on paid ads from real consumer devices on real residential or mobile connections. In Google Ads, click farms are hired to drain competitor budgets, inflate affiliate conversions, or game ranking and engagement signals. Because the clicks come from genuine devices and biometric inputs, standard bot detection misses them entirely, only behavioral and funnel-depth analysis surfaces the pattern.
How do click farms differ from bot traffic?
Bots are software, click farms are people. Bots run on emulators, headless browsers, or data-center IPs, and they fail technical fingerprinting and TLS checks. Click-farm workers operate real Android and iOS phones with real touch inputs and residential IPs, so they pass every technical test. The detection signal shifts from 'is this a real device?' to 'does this user behave like a real customer?' That gap is why most click fraud tools that lean on fingerprinting miss farm traffic.
Where are most click farms located?
Investigations by HUMAN Security, Spider AF, and reporters at the BBC and Vice have documented click farms operating at scale in Bangladesh, Indonesia, the Philippines, Vietnam, parts of India, and increasingly Eastern Europe. Workers are typically paid between 0.5 cents and 5 cents per click or task. A single warehouse-scale operation can ship over 100,000 clicks per day across thousands of physical phones connected to mobile or residential networks.
Can Google Ads detect click farms on its own?
Google's Invalid Traffic (IVT) filter catches General Invalid Traffic well, declared bots, data-center IPs, repeat user-agents, but it under-detects Sophisticated Invalid Traffic, which is the category click farms fall into. Because farm clicks come from real residential IPs and real device fingerprints, they pass Google's network-layer checks. Advertisers consistently report that farm traffic shows up as normal clicks in Google Ads, with the only tell being a flat conversion rate.
What does click farm traffic cost an advertiser?
Juniper Research projects global ad-fraud losses will reach $172 billion by 2028, with click farms a growing share as AI-driven bots get filtered more aggressively. In our field experience, advertisers running local-service Google Ads campaigns at $30 to $80 CPC lose 6 to 18 percent of budget to farm and competitor click activity before any detection is in place. Recovery via documented refund disputes typically returns 30 to 60 percent of flagged spend.
How do I detect click farms in my Google Ads reports?
Five signals work together. First, a conversion-rate collapse on segments with normal click-through rates. Second, time-on-page clustering, sessions ending at 8 to 15 seconds with low variance. Third, geo concentration in known farm hubs that does not match your customer base. Fourth, device coherence that is too clean, identical Android model strings repeating. Fifth, multi-account same-IP correlation on form submissions. Any single signal can be coincidence, three together is a farm.
Can I get a refund for click farm traffic from Google?
Yes, but only with evidence-grade documentation. Google rejects vague complaints. The dispute process honors timestamped per-click logs that show IP, ASN, device fingerprint, behavioral signal scores, and funnel depth. Advertisers using third-party detection with refund-ready reports typically recover a measurable share of flagged spend within 30 to 60 days. Documented click-farm refund rates run higher than refund rates for ambiguous bot disputes, because the behavioral evidence is harder to argue with.
Is hiring a click farm against your competitor illegal?
Yes, in most jurisdictions. Click fraud committed deliberately is prosecutable under the US Computer Fraud and Abuse Act, EU computer-fraud statutes, and equivalent national laws, plus Google Ads Terms of Service explicitly prohibit it. Civil suits between competitors have been successful when one side produced timestamped invalid-traffic logs. Enforcement is rare against diffuse farms in foreign jurisdictions, but the documented evidence from detection tools has supported account-level action and contract terminations.