Black Friday Click Fraud Checklist for Google Ads and Meta

When Should You Start Black Friday Click Fraud Prep?

Start in October. Google says a new bid strategy, a changed bid strategy setting, or adding and removing campaigns, ad groups or keywords can put automated bidding into a learning period (Google Ads Help). Changes like that in November also blur the baseline you need for triage on the sale days.

The peak is riskier for three mechanical reasons. Bigger budgets and higher CPCs make each invalid click cost more. More of the spend runs through automated campaign types such as Performance Max and Advantage+, which can show less placement detail. And real traffic swings so much between 27 and 30 November that an anomaly is easy to miss.

Here is the calendar for the 2026 season.

The January dates are calendar arithmetic: 60 days after 27 November and 30 November. Google says you can request an investigation "for activity within the last 60 days" (About invalid traffic, Google Ads Help).

What to Check in Google Ads Before Black Friday

Do these items before 1 November. Each one is a single action and the reason for it.

• Export a baseline. Pull four to eight weeks of clicks, CTR, CPC, conversion rate, the invalid clicks columns, placements and user locations. The sale days get compared against this.
• Set location targeting to Presence. Switch from the default "Presence or interest" to people in or regularly in your locations, and add excluded locations. Here is why Google Ads shows clicks from other countries in the first place.
• Clean the IP exclusion list. Google allows "up to 500 IP addresses per campaign" (Google Ads Help), so remove stale entries now. See how Google Ads IP exclusions work, and if you are already near the cap, what to do when you hit the 500 IP exclusion limit.
• Cover Performance Max at account level. Campaign-level IP exclusions are not available for Performance Max, but account-level IP exclusions apply "across all campaigns in your account including Performance Max" (Google Ads Help). More on protecting Performance Max from click fraud.
• Audit placement exclusions. Review exclusions for Display, Demand Gen and YouTube. Google says account-level placement exclusions "apply to all campaigns in the account, including Performance Max", and since March 2024 they also apply on the Search partner network, which affects Search and Shopping campaigns that serve there (Google Ads Help). For why this matters so much to stores, read how click fraud distorts ecommerce ROAS and Smart Bidding.
• Tidy conversion tracking. Keep primary actions only, remove duplicate tags, and stop counting unvalidated form fills as primary conversions. Smart Bidding learns from whatever you count, and in Q4 it learns fast.
• Lead generation: add form checks. Google's "Prevent invalid leads" page recommends reCAPTCHA on web forms, double opt-in confirmation, and server-side checks that "email addresses have valid domains and that phone numbers match legitimate regional formats" (Google Ads Help).
• Assign the sale-day checks. Name who opens each account on 27, 28, 29 and 30 November, and which baseline they compare against.

The Performance Max and placement items are the ones most often left until it is too late. Both take effect at account level, so set them once and leave them alone through the sale.

How to Protect Meta Ads Before Black Friday

Meta gives you fewer levers than Google, so use every one before the season starts.

• Turn on account-level Placement Controls. Exclude placements you never want, such as Audience Network, at the ad account. Trade press reported in August 2026 that some Sales and Leads ad sets lost placement exclusions (Social Media Today, 20 Aug 2026), and we found no official Meta statement as of 15 October 2026. Account level does not depend on each ad set, and Meta's account_controls reference still documents it. The Ads Manager steps are in our Audience Network guide below.
• Make sure limited spend on excluded placements is turned off. Since 8 October 2025 Meta can allocate "up to 5% of your spend" for each excluded placement in Sales and Leads campaigns (Meta for Developers). The step-by-step is in how to exclude Audience Network in Meta Ads.
• Add a publisher block list. Block the apps and sites you have already seen junk clicks from.
• Build audience exclusions. Exclude visitors you have flagged on your own site, so the same bad actors are not retargeted on Black Friday.
• Send only validated conversions. Pass real purchases and leads through the Conversions API so sale-day optimization learns from real buyers. See fraud-filtered conversions through Meta CAPI.
• Accept that there is no IP exclusion. Meta does not offer one, so the controls above are the toolkit. Here is why IP blocking is not an option on Meta and what to do instead.

ClickFortify's Meta Ads protection works on the landing-page path: it validates the traffic that reaches your site, flags fake leads submitted there, builds audience exclusions from flagged visitors, and sends fraud-filtered conversions to Meta through CAPI.

Freeze Changes in the Week Before Black Friday

From about 20 November, stop adding keywords, placements and audiences, and avoid large budget jumps unless they are planned and logged. Every unlogged change becomes a false fraud signal on 27 November.

Google's own list of normal spike causes makes the point. Its invalid traffic page says spikes can come from campaign changes, "If you increase your budget, add keywords, or modify your audience and location settings", and from "Seasonal trends or news events" (Google Ads Help, linked above). In the sale week you will have seasonal demand whether you like it or not. Do not add your own changes on top and then try to read the result.

Keep a one-line change log: date, account, what changed, why. Planned sale budget increases are fine. Log them, so whoever does the daily check on Black Friday knows a doubled budget is not an attack.

What to Check Every Day From 27 to 30 November

A short daily check per account, against the baseline, catches problems while they are still cheap. Cyber Monday click fraud is easier to stop on Monday morning than to explain on Tuesday.

• Compare the day with the baseline. Use the same metrics as your October export. If you want to know where Black Friday bot traffic tends to show up, see how bot traffic shows up in Google Ads campaigns.
• Read the invalid clicks columns. Check invalid clicks and invalid click rate per campaign. Here is how to check invalid clicks in Google Ads if the columns are not set up yet.
• Scan placements and user locations. Look for entries that were not in the baseline.
• Meta: compare link clicks with landing page views. Break both down by placement. A gap that opens on one placement is the signal.
• Lead generation: spot-check lead quality the same day. Open the CRM or lead sheet daily, not after the sale ends.
• Act on the source, not the campaign. Exclude the placement, location, IP or audience. Pausing a peak campaign stops genuine sales along with the bad clicks.

Is a Black Friday Spike Demand or Click Fraud?

Compare against the baseline first. Demand spreads across campaigns and still converts; fraud concentrates in one source and does not.

The table helps you decide; it does not prove fraud. Native controls and any tool can also block real shoppers on shared mobile networks and VPNs, and no checklist removes all holiday ad fraud. Google's own review and its credit report are the record of what was invalid. Lead quality is also partly the advertiser's job: Google's invalid leads page calls it "a shared responsibility".

When the evidence does point to an attack and needs a full investigation, follow the signs, evidence package and response plan in our complete guide to Google Ads click fraud.

After Cyber Monday: Credits, Deadlines and Cleanup

Q4 click fraud does not end with the sale. The credit window and the data cleanup run into January.

• Expect credits on later invoices. Google says "You aren't charged for invalid traffic detected before billing", and credits invalid traffic detected after billing as a billing adjustment. Some November credits will appear in December or later.
• Open the Invalid Activity Credit Report. In Report Editor, go to the Template gallery and choose "Invalid Activity Credit Report: Search & PMax". It covers Search and Performance Max campaigns and shows credited clicks and credited amount, and you can add adjusted cost as a column (Google Ads Help).
• Request a review before the window closes. If you see invalid clicks Google did not credit, ask for a review through the Click Quality Form (account admins only) by about 26 January 2027 for Black Friday clicks and about 29 January 2027 for Cyber Monday clicks. Google issues credits, not refunds. Here is how to claim Google Ads invalid click credits.
• Meta: check the billing route. Meta handles invalid activity differently; read whether Meta refunds invalid clicks before you open a ticket.
• Remove temporary exclusions. Lift sale-day location or placement blocks you added as a precaution, so January traffic is not throttled.
• Clean junk conversions. Remove or adjust conversions you now know were junk, so bidding does not keep learning from them.
• Save the evidence. Keep the baseline export, change log and triage notes. They make next year's checklist and any credit request faster.

The Whole Checklist on One Page

• By 1 Nov: baseline exported, Presence targeting set, IP and placement exclusions cleaned, Performance Max covered at account level, conversions tidied, form checks live.
• By 1 Nov (Meta): account-level Placement Controls on, limited spend turned off, block list and audience exclusions added, CAPI sending validated conversions.
• From about 20 Nov: change freeze and change log.
• 27 to 30 Nov: daily baseline check, invalid clicks columns, placements, locations, link clicks vs landing page views, lead quality.
• December: credit report, remove temporary exclusions, clean conversions.
• By about 26 and 29 Jan 2027: review requests for Black Friday and Cyber Monday clicks.

How ClickFortify Covers the Holiday Season

Manual checks catch what you look at. Holiday click fraud often arrives at hours when nobody is looking.

On Google Ads, ClickFortify scores every click against 200+ signals and adds invalid IPs to your Google Ads IP exclusion lists automatically, in real time. Sale-day sources get blocked without anyone editing lists at midnight on Black Friday. See ClickFortify's Google Ads click fraud protection for how it works.