How to Report Click Fraud to Clients Without Losing Trust
To report click fraud to clients without losing trust, lead with a number they can open in their own Google Ads account, say plainly what you confirmed and what you only suspect, and include the fix in the same message. Do the review before you write anything. Clients rarely get upset that fraud exists. They get upset when the explanation is vague or late.
Run the review before you write a word
The worst click fraud email is the one sent on a hunch. The client asks how much money was lost, and you have no answer. So do the work first.
Pull the date range in question and look at clicks, cost and conversions by day. Add the Invalid clicks column to the Campaigns table through the columns menu, so you can see what Google already filtered. Then compare the ad data against what actually landed on the site: server logs, form submissions, call records. If you need to tie ad clicks to addresses, how to find IP addresses behind fraudulent clicks covers the basics.
By the end you should be able to answer three questions. What happened? How sure are you? What have you already done about it? A problem with a fix attached is a status update. A problem without one is a scare.
Open with the number the client can see in their own account
Start the report with something the client can check without you. The Invalid clicks figure for the period is a good choice. So is an "Invalid activity" adjustment on the Billing summary page, where Google lists credits for invalid traffic it found after billing. These numbers come from Google, not from you.
When the first number is one they can verify, everything after it gets read with less suspicion. When it comes from a tool they have never heard of, they wonder whether the tool exists to justify your fee. Then move to what Google did not catch.
Separate what you confirmed from what you only suspect
Most reports fail here. They lump every odd click into one alarming total. A client who later learns many of those clicks were real prospects will discount everything you say after that.
Use three plain labels and keep them the same every month:
- Clean: clicks that look like normal prospects. Most traffic should sit here, and saying so builds credibility.
- Suspect: clicks with something odd about them that you have not confirmed. You are watching these, not blocking them yet.
- Fraud: sources you are confident are not genuine, such as automated traffic or one source clicking again and again with no sign of intent. These get blocked.
Put a reason next to every suspect and fraud item. "Same address, repeated clicks over two days, no form fill, no call" is a reason. "Bad traffic" is not.
Bring the fix in the same message
Never send the problem in one email and the solution next week. In the same message, say what you blocked, where you blocked it, and when.
For Google Ads that usually means IP exclusions. Google allows up to 500 IP addresses per campaign, and an asterisk can replace the last digits to exclude a block, for example 123.45.67.*. Campaign-level IP exclusions are not available for video, hotel, app, Performance Max and Smart Display campaigns. Account-level IP exclusions apply to all campaigns in the account, including Performance Max. If the client runs Performance Max, say which level you used. The Google Ads IP exclusions guide covers both levels.
Also name anything else you changed, such as a tighter location setting or new negative keywords.
A one-page structure to report click fraud to clients
One page is enough. This layout works for the first report and every month after it.
| Section | What goes in it | Example line |
|---|---|---|
| Period and spend | Dates covered, total clicks, total cost | "1 to 30 September, clicks and cost from the account overview" |
| What we found | Clean, suspect and fraud counts, each with a reason | "Fraud: repeat clicks from one address range, no leads" |
| What we blocked | Addresses or ranges added, campaign or account level, date | "Added to account-level exclusions on 12 September" |
| What changed | Settings or targeting you adjusted | "Location option switched to Presence" |
| What we cannot fix | Known gaps, stated plainly | "The first click from a new source is still paid for" |
| What we need | Decisions or information from the client | "Please confirm whether these three leads were real" |
The last two rows are the ones agencies skip. They are also the ones that protect you later.
Put the limits in writing in the first report
No method stops every bad click. Blocking happens after a source has been seen, so the first click from a new address is usually paid for. Exclusions cover addresses, not people, and anyone who switches networks comes back with a new one.
Write these limits into the very first report, before anything goes wrong. A limit you disclosed in month one is a known trade-off. The same limit, explained only after the client spots a problem, sounds like a cover story.
Handle the refund question as a process, not a promise
The client will ask whether they can get their money back. The honest answer: sometimes, partly, and not on your schedule.
Google does not charge for invalid traffic its filters catch before billing. When it finds invalid activity after billing, it issues a credit in the next billing cycle where appropriate and possible, shown as an "Invalid activity" adjustment on the Billing summary. For anything Google missed, you can request an investigation with the Click Quality Form. It covers only the last 60 days, so do not sit on a problem. Include the customer ID, date range, campaign and ad group names, the keywords involved, and server log details such as IP addresses and GCLIDs. Google will not confirm which specific clicks it judged valid or invalid.
Tell the client what you will file, when, and that any credit is Google's decision. Never forecast an amount. The guide to Google invalid click refunds goes through the form step by step.
Make monthly reports boring, and hand over cleanly
After the first report, aim for dull consistency. Same structure, same labels, same order. When a client can scan the page in a minute and see mostly clean traffic and nothing new to fix, they relax. If fraud jumps one month, say so in the first line with the fix, then return to the usual format.
If a client leaves, hand over properly. Export the exclusion lists with dates and reasons, list any open Click Quality Form requests, and note which exclusions sit at account level and which at campaign level. The next manager should never have to guess why an address is blocked. For running this across many accounts at once, see click fraud protection for agencies.
If you want clean, suspect and fraud verdicts with reasons produced for every paid click, see how Block Click Fraud works.
Frequently Asked Questions
How soon should I tell a client about suspected click fraud?
As soon as you have reviewed the data and applied a first fix. Do not wait long, because the Click Quality Form only covers the last 60 days.
Should suspect clicks be counted in the fraud total?
No. Report them on their own line. Mixing unconfirmed clicks into the fraud figure inflates it, and the client stops trusting the report if some turn out to be real.
Can I promise the client a refund from Google?
No. You can promise to file a Click Quality Form with good evidence. Whether a credit follows is Google's decision, and Google does not disclose which specific clicks it judged invalid.
What if the client blames all their weak results on fraud?
Show them the clean share of their traffic. Fraud is usually only one cause among several. If spend is climbing while leads fall, why Google Ads spend rises with no leads covers the other usual suspects.
What should I hand over when a client leaves?
The full exclusion lists with dates and reasons, the level each list sits at, and any open investigation requests. Add a note on suspect sources you were still watching.
Sources
- Google Ads Help: IP exclusions
- Google Ads Help: invalid traffic and the Click Quality Form
- Google Ads Help: about invalid clicks