What is click fraud?
Click fraud is when clicks get generated with no real interest behind them. Instead of a person who might actually buy or sign up, you get a click that exists only to drain someone’s budget or inflate someone’s payout. It looks real in your reports, but there’s no human intent behind it, and no chance of a sale on the other side.
I build affiliate tracking and payout software (Rekomi) and run a program of my own, so I spend a lot of time in the exact spot where good traffic and fake traffic look identical in a dashboard. Here’s the good news up front: click fraud has a shape, it leaves fingerprints, and once you know where to look, most of it is very catchable before a cent moves.
If you’ve ever run a paid search campaign and watched the daily budget vanish with nothing to show for it, you’ve felt the shape of the problem even if you never named it. Click fraud shows up in two big places, and it’s worth separating them because the fix is different for each.
- Paid advertising. You pay per click (PPC, “pay-per-click,” the model behind Google Ads and most search and display). A fake click here costs you ad spend directly.
- Affiliate and partner programs. If you pay affiliates per click or per lead, a fake click is a fake payout. The person sending it gets paid for traffic that was never going to convert.
Same trick, two victims. In ads you’re the buyer; in an affiliate program you’re the one writing the check to a partner. This guide covers both, then gets specific about the affiliate case at the end, because that’s the one I work in every day.
How click fraud works
Most click fraud runs on one of three engines, and they scale from “one bored person” to “industrial operation.”
- Manual clicking. A person (or a small paid crowd) clicks a link over and over. Cheap, low volume, and easy to spot once you look at how concentrated the traffic is.
- Bots and scripts. Automated software fires clicks at scale, often from a data center or a rented server. This is where the volume comes from, and it’s the bulk of what real detection is built to catch.
- Botnets and click farms. The industrial version: thousands of hijacked devices or cheap phones, each on a different residential IP, each clicking a little. This is the hard case, because every click looks like it came from a different real person.
The tell that ties all three together is intent. A real visitor arrives, looks around, and sometimes converts. A fraudulent click arrives, does the one thing it was paid to do, and leaves. When you line up enough of them, the pattern gives itself away: the same IP again and again, a browser that never renders a page, a click at 3 a.m. from a data center in a country your product doesn’t ship to.
Who does it, and why
Click fraud isn’t one villain. The motive changes depending on who benefits from the click, and that’s the fastest way to reason about it.
- A competitor clicks your ads to burn your budget so your campaign runs dry and their ad shows instead. You pay, they win, nobody buys anything.
- A dishonest affiliate or publisher manufactures clicks or leads because they get paid per action. This is the one that catches program owners off guard: your own partner has a direct financial reason to fake traffic.
- An ad-network middleman inflates clicks on low-quality inventory to earn more from advertisers.
- Plain bot noise from scrapers and crawlers that isn’t even targeting you, but still lands in your numbers as clicks that never had a person behind them.
Here’s the part people miss, and it’s worth saying plainly: in a pay-per-click or pay-per-lead affiliate program, the incentive points at your own affiliates. Not because most of them are dishonest (the large majority are genuinely great partners), but because the model pays for an action, and the moment an action is worth money, someone will try to fake it. Good program design assumes that and checks the traffic, rather than trusting it and hoping.
The signals of click fraud, and how detection works
Detection comes down to asking, for every click, “does this look like a person who might convert, or like traffic that only exists to get counted?” No single signal proves fraud, but they stack up fast, and this is genuinely the fun part of the work: the fakes are confident right up until you line the signals up.
- IP reputation. Is the click coming from a data center, a known proxy, a VPN, or a Tor exit? Real customers mostly browse on residential and mobile connections. A server farm clicking your link is the single loudest signal there is.
- Bot fingerprints. Automated traffic behaves unlike a human: no page render, impossible timing, a user-agent that doesn’t match the device, thousands of clicks with zero scroll or mouse movement.
- Velocity and repetition. The same IP or device clicking many times, or a burst of clicks far above the normal rate, is either a bot or someone sitting on refresh.
- Recent abuse history. An IP or email that’s been flagged for fraud elsewhere on the web is a strong prior before this click even lands.
- Conversion mismatch. Hundreds of clicks and not one sale, signup, or even a few seconds on the page, is a pattern no honest traffic source produces.
The important design choice is when you check. Scoring a click the moment it happens, before it can ever become a charge or a payout, is worth far more than a nightly report that tells you where last night’s money went. One prevents the loss; the other just documents it. That timing is the difference between fraud protection and fraud accounting.
Is click fraud illegal?
In most places, yes, at least in its deliberate forms. Knowingly generating fake clicks to defraud an advertiser or a program can fall under fraud, computer-misuse, and contract law, and ad platforms and affiliate networks ban it outright in their terms. People have been sued and prosecuted over large operations.
That said, “it’s illegal” isn’t much of a defense on its own. Enforcement is slow, attribution is hard, and a lot of the traffic comes from overseas where a lawsuit isn’t realistic. So the honest posture is to treat the law as backup and prevention as the real protection. Your terms of service should forbid invalid traffic clearly (so you can withhold payment and remove a bad partner without a fight), and your tooling should stop the clicks from being paid in the first place.
How to protect against click fraud
You won’t get to zero, and any tool that promises a perfect score isn’t being straight with you. What you can do is catch the overwhelming majority automatically and make the rest expensive enough that most fraudsters go bother an easier target. Here’s the stack that actually works.
- Score every click in real time. Check IP reputation, proxy and VPN and data-center origin, and bot signals at the moment of the click, before it can turn into a charge or a payout.
- Fail closed. If a click can’t be scored, hold it rather than pay it. Money should never move on unverified traffic. This one rule quietly does a lot of the work.
- Cap and de-duplicate. Limit how many paid clicks a single IP or device can generate in a day, and collapse repeat clicks from the same visitor to one. A bot farm behind one address shouldn’t turn into a thousand payouts.
- Read a real, unspoofable IP. Capture the true visitor IP at the edge instead of trusting a header the client can fake, or every cap above is trivial to bypass.
- Watch conversion rates by source. Traffic that clicks a lot and converts never is the clearest tell you have. Let it flag the source for review.
- Quarantine, don’t auto-delete. Hold suspicious clicks for review instead of silently dropping them, so a real customer on a corporate VPN can be released rather than lost.
For paid ads specifically, add IP exclusion lists in Google Ads, keep an eye on the placement report, and use a click-fraud protection tool if you spend enough to justify it. For an affiliate or partner program, the checks live in your tracking platform, which is where the next section comes in.
Click fraud in affiliate programs specifically
Affiliate click fraud is the version I care about most, because here the click is the invoice. When you pay partners per click or per lead (the CPC and CPL models), every fake click is money out the door to someone who manufactured it. Cost-per-sale mostly sidesteps this (you only pay when a real sale closes), which is exactly why it’s the safe default. But CPC and CPL are genuinely useful for audience seeding and lead generation, so the answer isn’t to avoid them, it’s to run them with the traffic actually validated.
Concretely, a safe pay-per-click or pay-per-lead program does a few things every time:
- Scores each click and lead against live IP reputation (proxy, VPN, Tor, data center, bots, and a blended fraud score) the moment it’s recorded.
- Holds anything high-risk out of payment for review, and fails closed so an unscored click never pays.
- Caps paid clicks per IP and per affiliate per day, and de-duplicates repeat clicks from the same device.
- Keeps the models invite-only with a budget cap, so paying per action stays bounded by who you approve, not an open bounty anyone can claim.
This is the layer most affiliate tools skip, and it’s the reason I built it into Rekomi’s CPC and CPL directly rather than bolting it on later. If you want the full picture of how that validation runs before any payout, our fraud protection page walks through the whole stack, and the affiliate fraud guide covers the broader set of tricks beyond clicks.
Wrapping up
Click fraud is real, it’s common, and it’s mostly catchable. The clicks that only exist to get counted behave differently from the ones a real person makes, and once you score traffic in real time, cap it, fail closed, and watch which sources actually convert, the fake stuff stops being profitable to send. You won’t stop every last click, but you’ll stop paying for the traffic that was never going to buy.
Do this next: pull your last 30 days of clicks by source and sort by conversion rate. Any source with lots of clicks and near-zero conversions is where to start. If you’re paying partners per click or per lead, make sure your platform scores that traffic before it pays, not after.
