Please enter a keyword
Use Ad Fraud Protection
Block fraudulent IPs in Google Ads automatically or by approval and toggle fraudulent lead exclusions on 8 platforms. View invalid click costs and allowlists.
Author: Cascade
Ad Fraud Protection automatically detects fraudulent clicks and fake inquiries from bots and other sources (fraudulent leads). The following 2 features handle them differently.
Fraudulent clicks are handled by blocking the source IP addresses. Confirmed fraudulent IPs are blocked automatically. Suspicious IPs appear as candidates, and only those you approve are blocked. Blocks apply to the entire Google Ads account (all campaigns, including P-MAX, video, and Shopping).
Fraudulent lead exclusions are enabled when you sign up. A single toggle next to the heading excludes leads identified as fraudulent from retargeting delivery across the 8 supported ad platforms and from ROAS and cost per lead calculations in Attribution. You do not need to configure each ad platform separately.
Open Ad Settings > Ad Fraud Protection in the left menu.
What you can do
Feature | Description |
|---|---|
Automatic blocking of fraudulent IPs (protection) | Excludes confirmed fraudulent IPs from Google Ads delivery without waiting for approval (on by default). |
IP block approvals | Displays suspicious IPs as candidates and excludes only the IPs you approve. |
Invalid clicks | Aggregates invalid clicks excluded by ad platforms before billing and fraudulent clicks detected by the Cascade measurement tag by ad platform, and displays their estimated monetary value. |
Exclude fraudulent leads | Detects fake inquiries from bots and other sources, and continuously excludes them automatically using exclusion lists on the 8 supported ad platforms and from ROAS and cost per lead calculations in Attribution (enabled when you sign up). |
Never-block IPs (allowlist) | Register IPs you do not want to block, such as your company VPN or office IPs. |
Prerequisites
Available on the Business plan.
You must install the Cascade measurement tag and register allowed domains (see Track inquiries, bookings, and purchases (install the tag)). Until setup is complete, setup instructions appear on this screen.
Only Owners and Admins can approve blocks or change settings.
Editors and Viewers can also view this screen.
Steps
1. Open Ad Fraud Protection
Open Ad Settings > Ad Fraud Protection in the left menu. The following 3 figures appear at the top of the IP block approvals card.
Item | Description |
|---|---|
Detected sources | The number of sources (internet connections used to click) identified as potentially generating fraudulent clicks in the recent period. |
Blocks awaiting approval | The number of detected sources you have not yet approved for blocking. |
Sources approved for blocking | The number of detected sources you have approved for blocking. |
The card shows how blocking works in 3 stages under Example. An ad receives dozens of clicks in 1 day from a connection that ordinary users do not use, such as a server, with no conversions → Cascade detects suspected click fraud and lists the source → Once you approve it, Google Ads stops showing ads to that source starting the day after it visits your site again.
2. Check automatic blocking of fraudulent IPs
Automatic blocking of fraudulent IPs (protection) at the top right of IP block approvals is on by default. While it is on, IPs confirmed as fraudulent based on multiple signals are excluded without approval. IPs that previously generated conversions and IPs on the allowlist are not included. Turn it off if you want all blocks to require approval. Turning it off also removes all existing automatic blocks during the next daily processing run.
3. Approve and block suspicious IPs
The IP block approvals table lists the following information for each suspicious IP.
Column | Description |
|---|---|
Verdict | Either Suspicious or Fraud. |
Score | A fraud score from 0–100. |
Clicks | The number of clicks during the detection period. |
Evidence | Examples include High click volume, Zero conversion, Datacenter, Tor, Automated browser, and Confirmed fraud elsewhere. |
Ad platform | The ad platform where the clicks were detected. |
Behavior (ref.) | Browser interaction characteristics observed by the measurement tag (such as whether mouse activity was recorded, how straight the mouse paths were, and variation in event intervals). |
Detected | The date of detection. |
The Datacenter and Tor signals indicate traffic from sources unlikely to be ordinary visitors. Confirmed fraud elsewhere identifies sources confirmed as fraudulent in another product. Because Behavior (ref.) contains values reported by the visitor's browser, consider it alongside other evidence rather than using it as the sole basis for approval.
Select the rows you want to block, then click Approve selected. When the message "Approved the selected IPs for blocking." appears, you are done. If there are no candidates, "No block candidates detected right now." appears. Automatically blocked rows are labeled Approved (auto). You can unblock any blocked row at any time by clicking Remove. If the exclusion has already been applied to the ad platform, it is removed during the next sync.
When you approve an IP whose ad platform column includes Google Ads, it is excluded across the entire Google Ads account. Other ad platforms do not support IP exclusions, so approving rows that do not include Google Ads does not apply exclusions to those platforms. Google Ads sync results appear below the table, including counts of excluded IPs, IPs over the limit, and failures, along with the date and time of the last sync.
4. Review invalid clicks
In Invalid clicks, you can see how much of your ad spend went to invalid clicks by ad platform. Use the date range selector at the top right to change the reporting period (the default is the last 30 days).
Column | Description |
|---|---|
Platform | The ad platform. Hover over ⓘ to see the counts for each data source. |
Invalid clicks | The number of clicks identified as invalid. |
Valid clicks | The number of clicks excluding invalid clicks. |
Invalid rate | Invalid clicks ÷ (valid clicks + invalid clicks). |
Est. amount | Invalid clicks × the ad platform's average cost per click during the period. |
Values come from 2 sources. You can view the breakdown using ⓘ.
Clicks excluded by the ad platform before billing: clicks the ad platform identified as fraudulent, such as bot or duplicate clicks, and excluded before billing. You are not charged for these clicks. For ad platforms that publish official figures, those figures are displayed.
Clicks detected by the Cascade measurement tag: clicks from sources Cascade identified as fraudulent. You may have been charged for these clicks. For ad platforms that do not publish official figures, these counts are displayed.
These are 2 separate measurements, so they are not added together. Interpret the estimated amount from official ad platform figures as "an estimate of the amount excluded before billing" and the amount detected by Cascade as "an estimate of the amount that may have been charged."
Data for the previous day is imported once per day. Reporting starts the day after you connect the ad platform and install the measurement tag.
5. Check fraudulent lead exclusions
The Exclude fraudulent leads toggle is ON when you sign up. While it is ON, the following 2 actions happen automatically.
Exclusion from ad delivery: email addresses of leads identified as fraudulent are hashed using each ad platform's required method and added to its exclusion list to remove them from retargeting delivery. The original email addresses are never sent to the ad platforms.
Exclusion from calculations: leads identified as fraudulent are excluded from ROAS and cost per lead calculations in Attribution (they remain included in the lead count for the period).
Leads marked Needs review are not excluded because they may be false positives.
An exclusion list is created on each ad platform when the first fraudulent lead is detected, then synced automatically every day. Until at least 1 fraudulent lead is detected, the message "An exclusion list will be created and applied on the ad platform once there is at least 1 fraudulent lead." appears.
Click Data sent and target platforms to see Data Sent and the current application status for each ad platform, including the date and time of the last sync, the number of registered entries, the number of targets, and reasons for errors or holds. For ad platforms with active exclusions, click Change targets in the same row to reselect the ad sets, ad groups, or campaigns to exclude leads from. When enabled, all active ones are selected as targets.
If an ad platform needs attention, Action Required - ... appears next to the heading (Terms acceptance required / Reconnection required / Connection could not be verified / Feature disabled on the platform).
Turning the toggle OFF removes active exclusions from the ad platforms and includes fraudulent leads in calculations again. Existing exclusion lists are retained, so turning it back ON restores the previous targets.
6. Set up never-block IPs (allowlist)
Click Register to register IPs you do not want to block. Registered IPs do not appear as candidates even if detected, and they are not automatically blocked. Any exclusions already registered on ad platforms are removed during the next daily sync. There is a limit on the number of IPs you can register.
IP addresses are not stored directly. They are converted to an irreversible format for matching. Do not include the IP address in the label. Use a name that identifies the location or purpose, such as "Head office."
How exclusions work on each ad platform
The following 8 ad platforms support fraudulent lead exclusions. Each ad platform uses a different location for exclusion lists and a different level at which exclusions apply. Yahoo! Search Ads is not supported because the ad platform does not support customer data lists.
Ad platform | Where exclusions are registered | Level at which exclusions apply | Ad platform requirements |
|---|---|---|---|
Meta Ads | Custom Audience for exclusions | Ad set | You must accept the Custom Audience Terms. |
Google Ads | Customer Match customer list | Campaign (including Search, Display, and P-MAX) | Exclusions may not apply to ad delivery while there are fewer than 100 matches. Demand Gen campaigns are not supported. |
Yahoo! Display Ads | Audience List for exclusions (customer data) | Ad group | — |
TikTok Ads | Custom Audience (customer file) | Ad group | You must accept the Custom Audience Terms. Exclusions do not apply to ad delivery until there are at least 1,000 matches. Ad groups that use saved audiences or Smart Targeting are not supported. |
Microsoft Ads | Customer Match customer list | Campaign (Search, Audience, and Shopping) | You must accept the Customer Match Terms. Performance Max campaigns are not supported. |
X Ads | Custom Audience (customer list) | Ad group | Exclusions do not apply to ad delivery until the ad platform finishes processing and the required number of matches is reached (the ad platform does not publish the minimum). Exclusions cannot apply to ad groups that include the same list in their targeting. |
Pinterest Ads | Customer list | Ad group | Exclusions do not apply to ad delivery until there are at least 100 matches. Ad groups that use targeting templates are not supported. |
OpenAI Ads | Custom Audience | Campaign | The Custom Audience feature must be enabled for the ad account. |
For all ad platforms, you must have obtained users' consent to use their customer data for advertising under the terms of service and privacy policy. Entries continue to be added to the lists even while ad delivery requirements are unmet. Exclusions automatically apply to ad delivery once the requirements are met.
How it works and things to know
Detection runs automatically every day. It uses click frequency, whether conversions occurred, the type of source, and behavior captured by the measurement tag (such as characteristics of automated browsers).
Only confirmed fraudulent IPs are automatically blocked. Suspicious IPs are blocked only after you approve them.
Approvals expire after a certain period. Expired IPs appear as candidates again, so approve them again if needed.
IP blocks apply to Google Ads across the entire account. Applied changes are recorded as IP Exclusion in the change history in Campaign Management.
Fraudulent lead exclusion lists sync automatically every day.
If you select Restrict to click IDs only in the data usage policy, you cannot use fraudulent lead exclusions that rely on email addresses. Check this setting in the Conversion feedback tab under Ad Settings > Audience Management.
Troubleshooting
Issue | Cause | What to do |
|---|---|---|
Setup instructions appear | Allowed domains for the measurement tag are not registered. | Install the tag and register allowed domains under Customer Management > Measurement Tag. |
No block candidates appear | The measurement tag is not installed, or no qualifying fraudulent clicks have been detected yet. | Check whether the measurement tag is installed. |
Approved IPs are not excluded from ads | The exclusions are taking time to apply, or the Google Ads connection has been lost. | Check again in a few hours and check the connection status in Integrations. If "The most recent sync has not completed" appears below the table, it will be retried during the next daily sync. |
An IP you previously approved appears as a block candidate again | The approval has expired. | Review the details and approve it again. |
Traffic from your company is blocked | Your company VPN or office IP was identified as fraudulent. | Register it in Never-block IPs (allowlist). If blocking has already been approved, click Remove. |
Action Required - Terms acceptance required appears | You have not accepted the ad platform's Custom Audience Terms. | Open Data sent and target platforms. For Meta Ads and Microsoft Ads, use the displayed links to accept the terms. |
Action Required - Reconnection required or Connection could not be verified appears | The ad account connection has been lost. | Reconnect the ad platform under Settings > Integrations. |
Action Required - Feature disabled on the platform appears | The customer list feature is not enabled for the ad account. | Enable the feature in the ad platform's management interface. |
On hold appears in the ad platform's row | The number of matches has not reached the ad platform's minimum, or the ad platform is still processing the exclusion list. | Exclusions apply automatically once the requirements are met. No action is needed. |
Off (this platform only) appears in the ad platform's row | This ad platform is still paused under the previous settings for individual ad platforms. | Turn Exclude fraudulent leads OFF, then back ON to resume. |
A message says there are no invalid clicks to report for this period | The ad platform was connected or the measurement tag was installed only recently. | Reporting starts the day after connection and installation. Expand the date range and check again. |
