- Google and Microsoft both filter invalid clicks on their own and may credit some of what they catch later. That covers the ad-platform side only; it does not tell you what the click did on your page.
- Shopping and Performance Max hide the usual hunting grounds. There is no keyword report to scan, so you look for fraud in landing-page behavior by campaign and asset group.
- On Microsoft Advertising, compare engagement by network. Partner and syndicated inventory is where a weak segment is most likely to show up.
- Protection means filtering and documenting traffic, never changing what a visitor sees. Every visitor, human or crawler, should get the same landing page.
Why Shopping, PMax and Bing need their own approach
Most click fraud advice is written for text Search campaigns, where a keyword report, a search terms report and a placement list give you something concrete to audit. Shopping and Performance Max remove most of that. Shopping ads are driven by your product feed, and Performance Max assembles Search, Shopping, Display, YouTube and other surfaces into a single campaign. The result is fewer levers and less granular reporting, which makes quiet waste easier to miss.
Microsoft Advertising has a different shape: smaller volume, a mix of owned and syndicated inventory, and its own invalid click detection. The common thread is that the platform sees the ad side and you see the page side. Real protection starts by reading both. For the fundamentals behind these terms, see what click fraud is and fake, false and invalid clicks explained.
What the platforms already filter
Both Google and Microsoft run automated systems that identify invalid clicks, such as accidental double clicks and known bot traffic, and remove them from billing. Both also state that they may adjust charges after the fact when they find invalid activity. The details of what is covered are in invalid clicks in Google Ads and what Google Ads invalid click protection covers.
Treat the filters as a first layer, not a guarantee. They work from signals the platform can see, and they cannot judge whether a click that looks legitimate on the ad side led to a session that behaved like a person on your page.
Shopping and Performance Max: finding waste without a keyword report
Because the usual reports are thin, move the investigation to your own analytics and server logs. Segment sessions by campaign using your UTM or auto-tagging parameters, then compare each campaign against the others on a small set of behavior metrics:
- Session depth and time on page. A campaign whose sessions are nearly all one page and a second or two long is worth a closer look, particularly if neighboring campaigns on the same products look healthy.
- Product page reach. Shopping clicks land directly on product pages. If add-to-cart or scroll events are close to zero while clicks are steady, the traffic may not be people shopping.
- Network and device concentration. Sudden concentration in one hosting network, one outdated browser version or one device model is a pattern, not a coincidence. See bot traffic detection for the signals that matter.
- Conversion lag and feed mismatch. Check whether clicks cluster on a handful of low-priced or high-visibility products and whether the click-to-purchase pattern looks different from your normal baseline.
Compare against your own history first. A new campaign will always look different from a mature one, so the useful signal is a change in an established campaign, not a difference between old and new.
Microsoft Advertising: look at the network, not just the campaign
Microsoft Advertising lets you see performance by network and review partner network settings. If you run on syndicated inventory, break results out by network and compare engagement and conversion quality side by side. A segment that costs about the same per click but produces visits with almost no engagement is a candidate for a settings change or a platform review request.
Keep your expectations realistic. Bing volume is smaller, so a handful of bad clicks can move percentages sharply. Use a longer window before drawing conclusions, and avoid making large changes on a few days of data.
A quick comparison across the three surfaces
| Surface | Reporting you can lean on | Main blind spot | First thing to check |
|---|---|---|---|
| Google Shopping | Product and campaign performance | No keyword-level view | Product page engagement and add-to-cart |
| Performance Max | Asset group and channel summaries | Limited placement detail | Landing-page behavior by campaign |
| Microsoft Advertising | Performance by network | Uneven syndicated quality | Engagement and conversion quality by network |
Adding protection without touching the page
A protection layer should do three things: identify low-quality sessions, keep a record, and feed that record back into the platform. In practice that means scoring visits with signals like network reputation, headless-browser traces and abnormal request timing, tagging the sessions, and exporting dated evidence by campaign. Where the platform offers exclusions, such as IP exclusions in the campaign types that support them, use them for clear and persistent patterns.
What a protection layer must not do is show different content to different visitors. Every visitor, including ad-platform review crawlers, should receive the same landing page at the same URL. That line is covered in cloaking versus compliant personalization and in the Google Ads circumventing systems policy. Layered controls for the page side are in layered controls for website bot traffic.
Building a case before you ask for review
If you believe a campaign was affected, collect evidence before contacting support. Platforms evaluate requests against their own logs, so your file should be specific, time-bound and easy to cross-check.
- Export clicks and sessions by campaign for the affected dates, with the same time zone as your ad account.
- Record the pattern you saw: network ranges, user-agent strings, device models, session length distribution.
- Note the engagement and conversion outcome for the affected segment against a baseline period.
- Keep the landing page unchanged and identical for all visitors while the review is open.
- Submit through the platform's own invalid activity or billing support channel, and expect a decision based on its logs.
Common mistakes
- Pausing a whole campaign over a few days of weak data, then losing the learning period.
- Blocking an IP range that also contains ad review crawlers or real customers behind shared networks.
- Reading a low conversion rate as fraud when the cause is feed quality, price or stock.
- Assuming the platform's filter has already dealt with everything, and never looking at your own logs.
Frequently asked questions
Does Google Ads protect Shopping and Performance Max campaigns from invalid clicks?
Google states that it filters invalid clicks across its ad products and may issue credits for invalid activity it detects after the fact. No filter is perfect, and it only sees what happens on the ad platform side. Your own logs show what happens after the click, so the two views complement each other.
Why is click fraud harder to spot in Performance Max than in Search?
Performance Max serves across several surfaces and reports at the asset-group and channel level, so there is no keyword or placement list to scan for suspicious sources. You detect problems from landing-page behavior, such as session depth, time on page and conversion lag by campaign, rather than from a placement report.
Is click fraud on Bing and Microsoft Advertising a smaller problem?
Volume is lower, but the share of questionable traffic can be higher on syndicated partner inventory. Microsoft Advertising also filters invalid clicks and adjusts charges, and you can review partner network settings and compare engagement by network. Judge it with your own data rather than assumptions.
Can a third-party tool block fraudulent clicks on Shopping ads?
Tools can score visits after the click and feed exclusion lists or reports, but they cannot stop a click that already happened and was already billed. Use them to document patterns and request review, and keep every visitor on the same landing page.
What evidence should I collect before asking for a refund or credit?
Keep dated exports of clicks and sessions by campaign, IP or network patterns, user-agent and device patterns, landing-page engagement, and conversion outcomes. Platforms evaluate requests against their own logs, so clear time-bound evidence makes review easier but does not guarantee a credit.
One URL, the same page for every visitor
Same landing-page URL for every visitor — language and region adaptation in-page, in-page A/B testing, and invalid-traffic filtering. No cloaking, no sneaky redirects.