Looks like interest — until you open the door. AI spam is flooding lead forms with noise that only looks genuine.
Looks like interest — until you open the door. AI spam is flooding lead forms with noise that only looks genuine.

5 minutes to read

TL;DR

AI-driven bots are faking real-looking lead form submissions in Google Ads, especially in Performance Max campaigns. On paper, conversions rise — but sales teams find most “leads” never existed. We tackled this by shifting spend to tighter search campaigns, verifying all leads before feeding data back into Google, and strengthening bot defences. The takeaway? Don’t trust the numbers blindly — focus on verified, quality leads, not inflated metrics.

When “More Leads” Isn’t a Win: How AI-Age Spam Is Breaking Google Ads (and What We Did About It)

So! Over the past few months, I’ve started to notice a trend. Especially in one Performance Max (Pmax) campaign…

…What is this trend, you ask? In short, a large boom in lead form submissions. At first, I thought “great!” I checked the content of the leads. They looked like genuine submissions, with unique names, emails, phone numbers, post codes, etc. So, on paper, it looked perfect.

Then we had contact from the client’s sales team.

Their feedback on this rise in leads was as follows: 1 in 10 were genuine. Around 2 in 10 admitted some kind of user error. The other 7 in 10 said they hadn’t submitted a lead form and had no clue where the sales team gained their data. From the client’s business perspective, unknowingly cold calling a supposed “warm” lead isn’t a good look. Also, from our side, it creates potential lack in confidence of Google Ads as a reliable platform to build quality leads.

Back in the day (not so long ago, but feels like a lifetime ago now), old spam was obvious. You’d see junk data, odd strings and a flood of irrelevant forms submitting in one big burst. The solution? Slap a CAPTCHA and a honeypot on there. Job’s a good’un. Pretty much.

This new wave of “spam” is unique. Gone are the old obvious traits. It’s now starting to look… human. Realistic details, submissions spaced out across days and different times. It blends in with your genuine queries.

What is this new wave and how has it come about?

In short, AI. AI-influenced bots, programmed to scrape user data and fill in any forms that appear for certain search terms.

Why? What’s the point?

The why can be speculated, but it’s easier to think back to why our good old, close-to-retirement-age spam bots were originally created for the business environment. To disrupt or manipulate markets, inflate false interest and to cause havoc on competitors. And, quoting Alfred from The Dark Knight…

Alfred from The Dark Knight saying "Some men just want to watch the world burn."

How does this affect Google Ads?

So, how does this new AI-powered bot affect Google Ads? If you are using PMax, the attack opportunity is wider because it runs across Search, Display, YouTube, Gmail, Discover and more. That market accessibility is brilliant when quality is high. It is painful when the signal is dirtied and skewed.

Lead form assets make it easier for a signed-in user to submit with very little issues. That is fantastic for real users. It is also great for anything that can imitate real users. Modern bots can now act in ways that look human. They can rotate IPs, vary timing and beat simple challenges.

So, what did we do?

We dialled PMax down and moved budget into Search where intent and targeting are tighter. Then we changed our optimisation loop so only verified leads can train the bidding. The aim is simple: stop the algorithm from chasing volume that sales cannot convert.

Here is the playbook that helped: 

  1. Count only what you can stand behind. Switch your primary conversion to “qualified” or “verified” and import only those back to Google. If your CRM can push outcomes back, use it.
  2. Harden the form flow without wrecking user experience. Add a hidden honeypot. Validate on the server. Watch for velocity and anomaly patterns. Use a follow-up check for higher-risk cases, for example email or phone confirmation.
  3. Use the controls you now have. Account-level negatives and brand exclusions help tidy up PMax’s search and shopping inventory. Campaign-level negatives exist now too. Use them.
  4. Watch channel performance. If you keep PMax on, review where your conversions come from and cut the assets that are feeding poor-quality surfaces.
  5. Add a proper bot defence at the edge if you are drowning. Think of it like a bouncer at the door rather than a clipboard inside.

There is also a bigger question here…

Could someone target a competitor with this kind of behaviour on purpose?

The legal side is not a blank cheque! In the UK, GDPR and PECR still apply, and the Computer Misuse Act exists for a reason. The harder bit is proof and enforcement. The rules were not written with AI-native lead stuffing in mind, and that is where platforms and regulators need to move faster.

What I would like to see from Google:

  • Form-level risk scoring that lets advertisers accept, hold or discard based on signals Google can see but we cannot.
  • Built-in verification hooks for lead form assets that do not punish genuine users.
  • A conversion type that privileges verified leads in Smart Bidding, so the loop does not optimise to noise.

This is not a “dump on automation” post. Automation is powerful. It also breaks in edge cases, and lead gen is where cracks show first. When seven out of ten people say, “that was not me”, we cannot wave it away as healthy spend.

Less convenience. More conscience. That is where I am drawing the line for now!

But also, be very wary of your lead generation performance in Google Ads, do not take it at face value!