Signs that your ads are being clicked empty

A sign of click fraud is not “a lot of clicks”, and it is not a frightening row in Webvisor. It is a click that stayed in spend, brought no target action, and was not removed from the report by Yandex Direct. Until you separate a visit you already got for free from a visit you paid for, there is no list of signs. There is a mixture of two different events.

The boundary between “removed” and “paid” is set in what ad click fraud is. Below is the order in which the traces are worth reading. None of them, alone, proves who clicked.

First, separate the click you are no longer paying for

Open the same day in two places. In Direct’s report library, open “Invalid traffic”: impressions, clicks and, for pay-per-conversion strategies, conversions that antifraud removed. In the campaign report, open spend and the clicks that remained after the filter.

The antifraud guide says you are not charged for what was removed, and the spend goes back to the balance. The number can change later, when filtering catches up with the events. Growth in that column is the filter working, not your bill growing. Google says the same about its invalid clicks column: it is traffic already filtered, and a third-party report of addresses can count clicks that are no longer on the bill (Google Ads guide).

If the odd visits exist only among the removed ones, there is no sign of click fraud against the budget. You were not charged for them.

A spike in clicks happens without fraud

The Direct statistics guide says it directly: a sharp rise in clicks or impressions is not always invalid traffic. Before you call the day an attack, compare it with neighboring days of the same campaign and with the number of target actions. Spend rose and leads rose in roughly the same direction. That is demand, not click fraud. Spend rose and leads stood still. That is a reason to continue, and it is still not the name of a culprit.

Webvisor is easy to misread here. It shows every visit, including visits already filtered, and filtered visits are not charged. The guide’s order is: confirm the source is Direct, then compare repeated visits or visits that last seconds with the “Direct” report group in Metrica for the same day, broken down by the minute. The “Direct” group contains visits antifraud let through. A session that is missing there never entered spend. A session that is present, in a run, with no target action, remains a candidate.

CTR rose and leads did not move

Click-through rate is clicks divided by impressions. By itself it says the ad is being clicked, not that a buyer is clicking. Direct does not filter real people for whom the price was wrong, or who were comparing the market. A high CTR with empty leads is therefore a fork, not a piece of evidence.

How to avoid treating someone else’s CTR as a norm, and how not to celebrate a rise that brings no leads, is covered in what CTR is. How to walk the fork in order (a broken goal, a person who did not buy, a click that never reached the site, and only then an empty click) is in clicks without leads. Until that fork is walked, it is early to call the day click fraud.

Robotness of a source is a neighboring signal

The share of visits Metrica classed as robots is read by source, not as one number for the whole site. A search crawler raises the share and does not spend the ad budget. Metrica and Direct use different systems. How not to confuse the share with the bill is covered in robotness in Yandex Metrica.

It is worth comparing the share of the source that sent the suspicious paid clicks with the share of search or mail over the same period. A sharply higher share on one placement is a signal to look at that placement’s visits. It is not a share of money to be refunded, and it is not proof that a task was ordered.

The comparison takes an evening and sees only the past. On the site, a check meets the visit when the page opens: behavior, the browser environment, the network, how often similar requests arrive, and the ad-click parameters. By campaign you can see where suspicious visits bunch up, before you decide to refuse anyone. The check can be counted while the visitor is still let through. When a decision is turned on, it is one of three: let the visitor through, give the browser a short computational task, or refuse the visit. A run of two-second sessions in Webvisor does not become a surname because of that. If the check does not answer, the visit is let through. A sign from this article remains a reason to look, not a verdict.