6 Years of Click Fraud Protection on a Small Business Account

The Account

Client A is a service company that has been running Google Ads since 2014 to reach customers within a 250-mile radius of Houston, TX. They operate on a modest daily budget of approximately $48/day (~$1,460/month) using manual CPC campaigns - a typical setup for a small, regional business that relies on paid search to generate local leads.

By 2019, Client A had been running Google Ads for five years with no click fraud protection of any kind. Like most small advertisers, they trusted that Google's built-in invalid click detection was handling the problem.

The Incident

In mid-2019, a Google Ads representative contacted Client A and offered to restructure their campaign. The rep was given access to the account, paused Client A's existing manual CPC campaign, and launched a new automated campaign in its place.

The results were immediate and alarming. Traffic to the site spiked to roughly 25 times its normal volume. Server-side request tracking showed a flood of paid clicks arriving from unusual sources - blog sites and referrers that had nothing to do with Client A's service area or industry. The ad budget was being consumed at an accelerated rate, and most of the traffic had zero conversion potential.

The automated campaign was suspended. When it was restarted days later as a test, the same pattern of suspicious traffic resumed immediately.

The Response

In early July 2019, with the account in crisis, a different approach was taken: work directly with the server-side request data to understand and control the traffic reaching the site.

What followed was a period of experimentation. From July through September, campaigns were paused, restarted, and tested with various early filter ideas. Spending during this period was erratic - as low as $51 in September - as different approaches were tried and evaluated against the incoming traffic.

By the first week of October, an effective combination of filters was in place. They operated at the gateway level, analyzing visitors before the page loaded and blocking those that matched suspicious patterns.

The results were immediate. Invalid click credits dropped from a monthly occurrence to virtually zero by November - and stayed there. Over the following years, the filter system would grow to over 25 protection layers, but even in those early months, basic gateway-level filtering was enough to eliminate the problem.

The Data: Before and After

The most compelling evidence comes from Google's own billing records. Every month, Google reports whether it detected "invalid clicks" and issued credits back to the advertiser. Here is Client A's complete 2019 billing data:

From January through October 2019, Google issued an invalid click credit every single month - 10 out of 10 months. The amounts ranged from $0.29 to $77.31, totaling $118.85 for the year.

In November 2019 - the first full month with JunkShun's gateway filtering active - the invalid click credits dropped to zero. December: zero.

And they essentially stayed at zero.

Six Years of Protection: 2020-2026

From January 2020 through January 2026 - over six full years - Google issued exactly two invalid click credits on Client A's account:

Compare that to $118.85 in credits during the 10 months before JunkShun was active in 2019. The implication is straightforward: JunkShun is catching the fraudulent traffic before it reaches Google's tracking, so Google has nothing to flag as invalid.

But there's a more important question: if Google was only crediting $118.85 in a year when fraud was clearly present, how much fraud was Google missing entirely?

The 3-Year Deep Dive: What the Data Actually Shows

From April 2023 to February 2026, JunkShun maintained detailed click-level data for Client A's account. This period provides the cleanest dataset for analysis, with all current filters in place.

There are three numbers worth examining here.

The 2,824 Blocked Clicks

JunkShun blocked 2,824 paid clicks over this period - a 21.1% rejection rate on paid traffic. These were visitors that matched one or more fraud or quality filters: bot signatures, traffic from outside the service area, anonymized sources, repeat visitors exceeding rate limits, and other suspicious patterns.

Because these visitors were filtered at the gateway before the page loaded, the ad platform's tracking pixel never fired. The click was never confirmed. No charge was generated.

The Gap: 10,554 vs 9,997

JunkShun passed 10,554 clicks through to the site, but Google only counted 9,997. That 557-click difference suggests that some clicks JunkShun allowed through were still caught by Google's own invalid click detection on their end. This is expected - JunkShun and Google's detection systems work as complementary layers, not replacements for each other.

The Savings Math

Google billed Client A $49,376.51 for 9,997 clicks over this period, resulting in an average cost-per-click of approximately $4.94.

Applying that CPC to the 2,824 blocked clicks: 2,824 x $4.94 = approximately $13,950 in fraudulent charges prevented.

What About Google's Built-In Protection?

A common assumption among advertisers is that Google's invalid click detection handles the problem. Client A's billing data tells a different story.

In 2019, before JunkShun, Google detected and credited an average of $11.89 per month in invalid clicks. During that same period, the account was clearly under attack - the mid-year traffic spike was overwhelmingly bot traffic from irrelevant sources. Yet Google's credits covered a fraction of the actual fraud.

After JunkShun went live, Google's credits dropped to essentially zero - not because the fraud stopped, but because JunkShun was catching it before it reached Google's systems. Over the last 3 years alone, JunkShun blocked an estimated $13,950 in fraudulent charges. Google's total invalid click credits over the same period: $2.22.

Google's invalid click detection is not a substitute for gateway-level protection. The billing data makes that clear.

The Takeaway

Client A is not unusual. They are a small business with a modest ad budget, operating in a regional market. They are exactly the kind of advertiser who assumes their budget is too small to attract fraud.

The data shows otherwise. Over 21% of their paid clicks were fraudulent or low-quality. Google's built-in detection caught almost none of it. And without gateway-level protection, every one of those clicks would have been billed.

JunkShun has protected Client A's account for over six years. The filters have grown from a handful of early checks to a comprehensive system with over 25 protection layers. The account remains protected today.

Client A has operated continuously with the same Google Ads campaign and JunkShun protection since 2019. Google Ads is their only advertising channel. Today, they are the dominant provider in their service category within a 250-mile radius of Houston - a position they did not hold before 2019.