Open your Google Ads account, set the date range to the last 90 days, and look at the Conversions column. Now answer honestly: how many of those people did you actually speak to? For most contractors we meet, the two numbers are not close, and the gap is not a tracking bug. It is spam being counted as customers.
This week we sat in a client meeting with a contractor's 90-day conversion report on the screen. The general "Contact Us" form: 106 conversions. A second, stricter quote form on the same site, the one that asks which service you need and for a phone number: 2. Direction requests: 4. Click-to-call: 2. The owner had read the 106. Most of them, he said, were other marketing companies pitching him. The same account still carried a "Purchase" conversion action that had fired 9,032 times in the same 90 days. Nobody bought anything. It was firing on page load.
This post is the audit we ran next, written so you can run it on your own account in about 15 minutes, followed by the fixes in the order we would apply them, cheapest first, with the actual prices. If you only read one section, read the one on why spam compounds, because that is the part that costs money every day it goes unfixed.
The Conversions Column Counts Tag Fires, Not Customers
A conversion in Google Ads is a tag firing on an event you defined: a thank-you page loading, a submit button being pressed, a phone number being tapped. The tag has no idea who did it. A bot that posts "Hi, I noticed your website could rank higher" fires exactly the same tag as a homeowner with water coming through the ceiling. Google is unusually direct about this on its invalid traffic page: "Because you capture leads on your site and customer relationship management (CRM) system, Google systems cannot track or control visitor actions after they click your ad." In the same place it calls lead quality "a shared effort", which is a polite way of saying the form is your problem.
The 9,032 "Purchase" conversions are the extreme version of the same thing. Somebody, at some point, set a conversion action to fire when a page loaded, and every visit since has been recorded as a sale. If an action like that is marked Primary, the bidding system is being told that a page view is a purchase, and it will happily buy page views. Check yours. Most accounts we open have at least one conversion action nobody can explain.
We wrote earlier this summer about why cost per lead is the wrong number to manage by. This is the other half of that argument: even the lead count itself is often wrong, and wrong in the direction that flatters the report.
Why Spam Compounds: Smart Bidding Buys More of Whatever You Count
Here is the part that turns a reporting annoyance into a budget leak. Google Ads sorts conversion actions into two kinds. Google's own definition: primary actions are "reported in the 'Conversions' column in your reports and used for bidding", while secondary actions are "for observation only" and sit in the "All conversions" column "but not for bidding". Target CPA and Maximize Conversions optimise toward the primary ones. That is the entire mechanism.
So if your raw contact-form submission is a primary conversion, every bot post and every agency pitch is a training example labelled "good result". The system studies what produced them: which search terms, which hours, which placements, which kinds of visitor. Then it goes looking for more of the same. Automated outreach and bot traffic cluster in predictable places, so the account drifts toward those places. Your reported cost per conversion falls. Your cost per real lead rises. The dashboard shows improvement while the phone gets quieter.
This is why the problem gets worse quietly. Nothing breaks. No alert fires. The report improves as the leads deteriorate, and the better the automation gets at its job, the faster it happens. When contractors tell us their cost per lead doubled and they cannot see why, this is one of the first three things we check.
Where the Junk Comes From: Four Sources
1. Bots that crawl for forms. They find every form field on the web and submit to all of them: to plant links, to probe whether your form accepts unexpected input, or just because it is cheap. They do not read your site. They fill every field with something, and the something is often a link.
2. Automated agency outreach. This was the largest bucket in the account above. Marketing companies run tools that search for contractors in a city, open the site, and submit a pitch through the contact form: page-one rankings, a free website audit, "are you hiring". One detail worth sitting with: Google Ads only counts a conversion it can tie to an ad click. Those pitches did not arrive for free. Someone clicked an ad first, on the contractor's budget, then used his form to sell him marketing.
3. Search Partners. When you create a Search campaign, search partner sites are included by default, and you can opt out in the campaign settings at any time. Not all partner traffic is junk, but in our experience it is where the worst lead quality lives, and it is the first switch we test when submissions look wrong.
4. Performance Max and broad match drift. Performance Max places your ads across Display, YouTube and Gmail as well as Search, and lead forms shown to people who were not searching for you attract low intent. Broad match on "roofing" pulls "roofing jobs", "roofing marketing" and "roofing courses" unless the negatives are in place. We covered the Performance Max side in what Google won't tell you about PMax; the short version is that it needs cleaner conversion data than most contractor accounts feed it.
The 15-Minute Spam Audit
You need two things open: wherever your form submissions land (your CRM, your form plugin's entries, or the inbox they email to) and your Google Ads account. Then:
- Export the last 90 days of submissions. Every one, including the ones you deleted on sight if you can get them back.
- Sort each into one of five buckets. Be strict. "Real" means a person, a job you do, an address you serve and a phone number that rings.
- Count. Real-lead share is real divided by total. Real cost per lead is your 90-day spend divided by real leads only.
- Open Google Ads, go to Goals, then Conversions, then Summary. For every action marked Primary, read the 90-day count and what fires it. Write down any action you cannot explain.
- Put three numbers side by side: conversions reported, real leads, real cost per lead. That is the audit.
| Bucket | What it looks like | Count it as a lead? |
|---|---|---|
| Agency pitch | "I noticed your website", "we can get you on page one", "are you hiring", a company name in the name field, a .com in the message | No |
| Bot | Gibberish, links, a foreign language, a phone number with the wrong digit count, the same message twice within a minute | No |
| Out of area | A real person, a real job, an address you do not serve | No, but fix your geo targeting |
| Wrong service | A real person asking for something you do not do, or a job seeker | No, but add the negative keyword |
| Real | A person, a job you do, an address you serve, a phone number that rings | Yes |
In the account above, the reported figure was 114 conversions across four actions. The owner's count of real inquiries from the 106 was "a handful". We do not have the exact number yet, and that is itself the finding: nobody had counted. If your audit ends the same way, you are not behind. You are ahead of most accounts, because now you know.
Want Us to Read Your Last 90 Days With You?
Book a free strategy call and bring the export. We will sort it into the five buckets with you, show you which conversion actions are set to Primary, and give you a real cost per lead before you change a single bid.
→ Book Free Strategy CallThe Fix Ladder, Cheapest First
Five rungs. Each one is cheap or free, and each one catches something the rung below it misses. Most contractors need the first three and the fifth. Almost nobody needs to buy anything.
| Rung | What it is | Cost | What it stops |
|---|---|---|---|
| 1 | Form hygiene: honeypot field, minimum time to submit, server-side phone and email checks, no links in the message, rate limit | Free, about 30 minutes of a developer's time or a setting in most form plugins | The dumbest bots, which is most of them |
| 2 | An invisible challenge: Cloudflare Turnstile, or reCAPTCHA | Turnstile is free; reCAPTCHA is free to 10,000 assessments a month with a billing account on file | Scripted submissions that pass rung 1 |
| 3 | One qualifying question, a phone field, a postal code | Free | Most agency outreach and most wrong-service submissions |
| 4 | Ads-side: Search Partners off, negative keywords, geo and placement review | Free | The clicks that produce junk in the first place |
| 5 | Make "qualified lead" the Primary conversion and feed it from your CRM | Free in Google Ads; an hour of setup | Smart Bidding learning from spam |
Rung 1: Form hygiene, free
A honeypot is a hidden field a human never sees and a bot fills in; any submission with it filled is discarded. A minimum time to submit rejects anything completed in under a few seconds. Server-side checks reject a phone number with the wrong number of digits and an email with no valid domain. Blocking links in the message field removes most link-planting bots outright, and a rate limit stops the same address submitting fifty times. Most form plugins have these as checkboxes; a developer can add the rest in half an hour. If your website was built without any of this, that is a conversation to have with whoever built it.
Rung 2: An invisible challenge, free
Cloudflare Turnstile is our default. The free plan covers "Up to 20 widgets" with "10 hostnames per widget" and no cap on challenges, it can be embedded on any site without routing your traffic through Cloudflare, and its invisible mode shows the visitor nothing at all. Google's reCAPTCHA works too: it is free up to 10,000 assessments per calendar month, with a "$8.00 flat fee" from 10,001 to 100,000, but every tier requires a Google Cloud billing instrument on file, which is one more account for a contractor to own and forget about. Google's best-practice page for lead generation says it plainly: "Consider tools like ReCAPTCHA, double opt-in, or server-side validation to ensure lead authenticity." One honest caveat: paid solving services exist, so a challenge is a filter, not a wall. It removes the cheap junk, which is most of the junk.
Rung 3: One qualifying question, free
Add a short dropdown for the service needed, make the phone field required, and ask for a postal code. Three fields, a few seconds for a homeowner, and it ends most agency outreach, because outreach tools do not know which of your services to pick. It also gives you the data you need for rung 5. If you run Google's own lead form assets in your ads, the same idea is built in: a qualifying response tags the submission as a qualified lead automatically.
Rung 4: Turn off the taps in Google Ads, free
Search Partners off, at least as a test. A negative keyword list with the words that bring the wrong people: seo, marketing, agency, web design, jobs, careers, hiring, resume, salary, free, course. Tighten the geo targeting to where you actually work rather than the whole province, and check the Performance Max placement and audience reports for surfaces that produce submissions but never produce jobs. None of this costs anything and it reduces the volume every later rung has to deal with.
Rung 5: Fix what bidding learns from, free
This is the rung that changes the economics. Demote the raw form submission to a secondary conversion so it is still reported but no longer bid on. Create a "qualified lead" action and make it primary. Then feed it from your CRM through enhanced conversions for leads or a plain offline conversion import, so that only the submissions a human confirmed as real are sent back as the thing to optimise for. Google recommends uploading "ideally daily", and notes that choosing a goal like qualified lead or converted lead will "automatically trigger invalid traffic protections built specifically for lead generation campaigns", which is a protection you do not get while bidding on raw form fills.
Two warnings before you do it. The reported conversion count will drop and the reported cost per conversion will rise, sometimes sharply, because you are replacing an inflated number with a real one. Anyone who manages your Google Ads should tell you this before it happens, not explain it afterwards. And bidding will go through a learning period on the new signal, so judge the change over weeks on real leads, not over days on the dashboard.
What Google Will and Will Not Refund
On Search and Performance Max, Google filters invalid clicks on its side. Its invalid traffic page says traffic "detected before the end of the month is automatically removed from your billing and campaign reports", and if it is "detected after you were billed for it, you'll receive credits in the form of a billing adjustment". What is not refunded is a spam form fill after a legitimate-looking click, for the reason quoted earlier: Google cannot see what happens on your site. The form is yours to defend.
Local Services Ads work differently, because there you pay per lead rather than per click. Google's automated lead credits page states that "Leads determined to be invalid or low quality are not charged", that charged leads "get reassessed by our models over time, and may be issued credits automatically if later determined to be low quality", and that "In most cases, credits will be applied to your account balance within 30 days." You can also open the Leads inbox and choose "Rate this lead" to give feedback on any of them. The page adds that lead credits are not available for health care, tax specialists, or advertisers in EMEA. If your LSA leads look wrong for a different reason, we covered how Google ranks and routes LSA leads separately.
Three Questions to Ask Whoever Runs Your Ads
- Which conversion actions are set to Primary right now, and what fires each one? The answer should be short and every item should be explainable. A "Purchase" that fires 9,032 times on a contractor site is not explainable.
- When did you last read the submissions, rather than the count? Reading them is the only way to know the real-lead share. If the answer is "the report shows conversions", you have your answer.
- What is my cost per real lead, and how far is it from the cost per conversion in the report? A good manager has both numbers and a plan to close the gap. A great one has already moved bidding onto qualified leads and warned you the dashboard would look worse for a while.
Ask any agency these three questions, ours included. None of them requires a login or a spreadsheet. They require someone to have read the leads. If your website brings traffic that never turns into work, the reasons are often in the form itself, and we wrote about the other things that go wrong between the click and the call.
Run the audit this week. Fifteen minutes, three numbers, and you will know more about your advertising than the report has been telling you.