# How click fraud detection works

ClickGuard detects click fraud by analyzing what each visitor does after the click, not just their IP address. Its tracking code measures mouse movement, scrolling, typing and time on site, its AI weighs behavior, device and network signals together, and it catches bots that mimic human behavior and blocks them on your ad platforms.

Source: https://www.clickguard.com/help/getting-started/how-click-fraud-detection-works
Published: 2026-10-16
Updated: 2026-10-16
Author: Nikola Pejic

ClickGuard protects your ad budget by looking at who is behind each click and what they do on your website, not only at the IP address the click came from. It collects data on every ad click and analyzes how each visitor behaves. When it finds a bad visitor, it blocks them directly on your ad platforms with **IP exclusions** and **exclusion audiences**, so they can't see your ads again.

## Beyond IP-based detection

Many click fraud tools judge a click mostly by its IP address. They block clicks from data centers, known VPNs and IPs with a bad history. That catches simple bots running on servers, but today's bots are built to get past it: they switch to a new, clean IP for every click and appear to browse from ordinary connections in your target area.

To an IP check, those clicks look like regular visitors. Here's where each IP check falls short:

| IP check | What it looks for | Why modern bots get past it |
| --- | --- | --- |
| **Data centers** | Traffic from servers and hosting providers | Bots don't have to run from a data center to click your ads |
| **VPN and proxy lists** | Known VPN, proxy and Tor addresses | New IPs aren't on the lists yet |
| **IP reputation** | IPs with a history of abuse | A fresh IP has no bad history |
| **Location** | Clicks from unexpected countries | Bots pick IPs in your target area, so they look local |
| **IP blocklists** | IPs that clicked before | Each click can come from a new IP, so the list is always a step behind |

IPs are also shared and reassigned, so the IP a bot used today may belong to a real customer next week. See [What are ISPs and ASNs](https://www.clickguard.com/help/glossary/what-are-isps-and-asns) for why blocking large consumer networks can backfire.

## General vs sophisticated invalid traffic

The ad industry splits invalid traffic into two kinds:

-   **General invalid traffic (GIVT)**: crude bots, crawlers and known data center traffic. It's easy to spot, and basic IP filters catch most of it.
-   **Sophisticated invalid traffic (SIVT)**: bots and fraud built to mimic real users closely enough to pass IP-based checks. Spotting it takes behavioral analysis.

IP checks deal with the first kind. ClickGuard's behavioral analysis is built for the second.

## What bot traffic does to your campaigns

-   **Wasted budget**: you pay for clicks that never had a chance to convert.
-   **Misleading reports**: clicks and click-through rate go up while your conversion rate drops and your cost per acquisition climbs.
-   **Worse bidding**: Google's Smart Bidding and Meta's algorithm learn from the fake engagement and look for more of it.
-   **Polluted audiences**: bots end up in your remarketing and lookalike audiences.

## How ClickGuard detects click fraud

ClickGuard looks at the whole visit, from the ad click to the last page view, in four steps.

### 1\. It gets data from every ad click

When you connect an ad account, ClickGuard sets up its tracking on it: a tracking template and final URL suffix on Google Ads and Microsoft Ads, and the campaign ID in your ad URLs on Meta Ads. This tells ClickGuard where each click came from: the campaign, ad group, keyword, placement and more. See [Protecting your first website](https://www.clickguard.com/help/getting-started/protecting-your-first-website) for how it's set up.

### 2\. It analyzes how each visitor behaves

ClickGuard's [tracking code](https://www.clickguard.com/help/glossary/what-is-clickguards-tracking-code) on your website doesn't just record that a visitor moved, scrolled or typed. It studies the patterns behind each action, the kind a script can't easily fake:

-   **Mouse movement patterns**: how the cursor travels across the page, its speed and its pauses.
-   **Scrolling patterns**: how fast and how evenly a visitor moves through your content.
-   **Typing patterns**: the rhythm of typing and how forms get filled in, which looks different when a bot does it.
-   **Click patterns on the page**: which elements a visitor clicks, in what order and how quickly.
-   **Reading patterns**: selecting and copying text, time on site and the number of pages viewed.

ClickGuard combines these signals into interaction patterns and compares them with the patterns it expects for that campaign and device type, because people interact very differently on a phone than on a laptop. Patterns that look non-human stand out, even when each action on its own looks normal. From that, it gives every paid click an [interaction level](https://www.clickguard.com/help/faq/how-does-clickguard-track-website-interactions) and a [bot probability](https://www.clickguard.com/help/faq/how-does-clickguard-determine-bot-probability) of low, medium or high.

This is what catches bots built to look human. A bot can fake a scroll or a mouse movement, but keeping it up across a whole session is much harder: the timing, the order and the amount of interaction rarely match how real visitors use your pages. And it works whichever IP the bot came from.

### 3\. It recognizes repeat devices

The tracking code gives each browser an anonymous [device ID](https://www.clickguard.com/help/glossary/what-is-device-id-in-clickguard). It links repeat clicks from the same device across campaigns and keywords, even when the IP address changes with every click.

### 4\. Its AI weighs every signal together

ClickGuard's proprietary AI evaluates every ad click in real time, weighing behavior, device, click and network signals together, so no single check decides on its own:

-   **Behavior**: interaction level, bot probability, time on site and page views.
-   **Device**: repeat clicks from the same device, or no device at all.
-   **Click patterns**: repeated clicks from the same source, unusual timing and location mismatches.
-   **Network and IP**: IP reputation, [IP usage](https://www.clickguard.com/help/glossary/what-is-ip-usage) (home, business or hosting), data centers, VPNs, proxies and Tor.

IP data still matters: it catches the cheap bots that run from data centers. Behavior catches the ones that don't.

## Bad sources stop seeing your ads

When ClickGuard finds a malicious or wasteful source, it blocks it directly on your ad platform with **IP exclusions** and **exclusion audiences**, so it stops seeing your ads. You can also add your own custom rules on visitor behavior, for example to block visitors who spend almost no time on your site or have a high bot probability.

Your budget goes to real prospects instead, and you can see every flagged click and every exclusion in your ClickGuard dashboard.

## Frequently asked questions

### What is the difference between general and sophisticated invalid traffic?

General invalid traffic (GIVT) is crude bots and known data center sources that basic filters catch. Sophisticated invalid traffic (SIVT) is human-like activity that mimics real users closely enough to pass IP-based detection. It takes behavioral analysis to identify, which is what ClickGuard does.

### Does ClickGuard still use IP data?

Yes, as one of many signals. IP data catches traffic from data centers, VPNs, proxies and Tor, and IP exclusions are one of the ways ClickGuard blocks bad sources on your ad platforms. It just isn't the only thing ClickGuard looks at.

### Do I need the tracking code for behavioral analysis?

Yes. Without the tracking code, ClickGuard still logs and processes your ad clicks, but it can't see what visitors do on your website, so device tracking, time on site, interaction level and bot probability aren't available. See [Can ClickGuard work without the website tracking code](https://www.clickguard.com/help/faq/can-clickguard-work-without-tracking-code).

### Don't Google Ads and Meta already filter invalid clicks?

They filter part of it. But bots built to pass as ordinary users get through. ClickGuard adds a second layer that looks at what each visitor does on your website after the click.

## Related articles

- [What are ISPs and ASNs](https://www.clickguard.com/help/glossary/what-are-isps-and-asns.md)
- [Protecting your first website](https://www.clickguard.com/help/getting-started/protecting-your-first-website.md)
- [What is ClickGuard's tracking code](https://www.clickguard.com/help/glossary/what-is-clickguards-tracking-code.md)
- [How does ClickGuard track website interactions](https://www.clickguard.com/help/faq/how-does-clickguard-track-website-interactions.md)
- [How does ClickGuard determine bot probability](https://www.clickguard.com/help/faq/how-does-clickguard-determine-bot-probability.md)
- [What is device ID in ClickGuard](https://www.clickguard.com/help/glossary/what-is-device-id-in-clickguard.md)
- [What is IP usage](https://www.clickguard.com/help/glossary/what-is-ip-usage.md)