The symptom: cost per lead looks fine in Ads Manager, and sales can't reach anyone. Numbers ring out, emails bounce, and names read like keyboard tests.
How we checked this: we did not test these settings in an ad account. Everything about Meta's behavior here comes from Meta for Developers pages (Graph API v27.0, undated), read on 11 November 2026.
Why do fake leads come from Facebook ads?
Instant Forms remove almost all friction, so lead form spam gets through as easily as real interest. Meta describes the form as one that "is mobile-friendly and uses information people already shared with Facebook" (Lead ads, Meta for Developers). Prefill also hides the problem: a prefilled lead looks valid even when there is zero intent behind it. Three kinds of bad lead come through:
- Mistaken taps. Someone scrolling taps the ad, sees a filled form and submits without meaning to.
- Low-intent people. Real details, no plan to buy.
- Scripted or paid fills. Automation or paid workers, with invented or real details.
The settings below hit them unevenly. Our Advantage+ lead quality guide covers how to tell the first two apart from the third.
Switch the form to the higher-intent form type
Turn on the higher-intent form type for any lead that costs sales time, because Meta's default is built for volume. Meta's create page says it plainly: "By default, lead ads are optimized for the volume of leads, however, you can create forms that result in higher intent leads" (Create lead ads, Meta for Developers). Meta's developer pages don't name the Ads Manager option, so look for the higher-intent form type in your form editor.
The same page explains what it changes: "This form setting adds a step to the form submission flow where a person reviews and confirms their answers before the person submits the form." Meta's form reference lists it as "Flag to indicate whether the form will be optimized for quality" (Page leadgen forms reference, Meta for Developers). In the API the field defaults to false, so a form created without it is optimized for volume.
What it stops: mistaken taps and careless prefill submits. What it doesn't stop: anyone who means to submit. A paid worker or a script confirms the review screen as easily as the form, and low-intent people still confirm.
Add custom and conditional questions prefill can't answer
Add at least one question Meta can't fill in, so every lead has to type or choose something about their need. Meta's create page shows two custom question types: "a custom question using the label parameter", and "a custom question using the options parameter with a dropdown menu of answers" (Create lead ads, Meta for Developers). The form reference also lists a field for dependent conditional questions, without describing how they behave (Page leadgen forms reference, Meta for Developers). Check your form editor for how they work.
Ask something a real buyer knows and a junk fill doesn't care about:
- Home services: "What needs doing?" as a dropdown with your real job types and an Other option. "When do you need the work done?" with This week, This month and Just researching.
- B2B: "How many people would use this?" with ranges that match your pricing tiers. "Which tool do you use for this today?" as a short free-text answer.
Don't put the best answer first in the dropdown. In our experience, careless fills tend to pick the first option, and that pattern becomes a CRM check later.
What it stops: fills that rely on prefill only. What it doesn't stop: anyone who reads and answers. The answers still give your CRM something to check.
Turn on SMS verification and work email enforcement
Use SMS verification when a callable phone matters most, and work email enforcement only for B2B sold to companies. Both appear in Meta's form reference as form fields (Page leadgen forms reference, Meta for Developers):
- The phone field reads: "Whether the form requires phone sms verification when user submits". The reference also lists a phone OTP question type.
- The work email field reads: "Whether to enable work email enforcement." The reference also lists a work email question type.
Meta's developer pages don't say what these are called in Ads Manager or where they are available, so check that your form editor shows them. Where each one breaks, in our reading:
- SMS verification proves the phone receives a code, not that the person wants to buy. It stops invented and mistyped numbers. A paid worker with a real phone passes.
- Work email enforcement blocks free webmail, which is right for B2B and wrong for small businesses. Sole traders and many small owners use a personal address, so it blocks them. A throwaway company domain still passes.
Filter out organic leads
Turn on the organic filter when your form can be reached outside your ads. Meta's instruction: "To filter out organic leads, add the block_display_for_non_targeted_viewer parameter to true when you create the form" (Create lead ads, Meta for Developers).
Organic leads come from people who reached the form outside your ad targeting, for example through a shared Page post, in our reading. In exports, Meta marks them: "In this case, is_organic in the TSV displays 1; otherwise, the value is 0" (Retrieving leads, Meta for Developers).
Some organic leads are real referrals, so filter only when organic reach brings junk.
Which Instant Form settings filter fake leads?
Here is every form setting in one place, with the fields as Meta documents them.
| Setting | Meta field | Meta's words (checked 11 Nov 2026) | Stops | Doesn't stop |
|---|---|---|---|---|
| Higher-intent form type | is_optimized_for_quality (default false) | "a person reviews and confirms their answers before the person submits the form" | Mistaken taps, careless prefill submits | Paid workers, scripts, determined fakers |
| Phone SMS verification | is_phone_sms_verify_enabled | "Whether the form requires phone sms verification when user submits" | Numbers that can't receive a code | Real phones with no intent |
| Work email | should_enforce_work_email | "Whether to enable work email enforcement." | Free webmail on B2B forms | Fake company domains; also blocks real sole traders |
| Custom questions | label, options, dependent_conditional_questions | A custom question "using the label parameter", a dropdown "using the options parameter" | Fills that rely on prefill only | Paid workers who read and answer |
| Organic filter | block_display_for_non_targeted_viewer | "Whether to make the organic post invisible to viewers in non-Ad context" | Leads from people who found the form outside your ads | Junk inside your targeting |
Sources: Create lead ads and the Page leadgen forms reference, Meta for Developers.
Get leads out of Meta fast
Sync every lead to your CRM as it arrives, so checks and calls happen while the ad is fresh. Meta's retrieving page says "You can retrieve leads with Webhooks or Bulk Read" (Retrieving leads, Meta for Developers). Webhooks notify your endpoint "Every time a new lead is submitted", and Leads Center lets you "Manage and download your leads in Meta Business Suite" (Lead ads, Meta for Developers). The retrieving page shows lead fields including ad ID, form ID and created time, which the checklist below uses.
Meta's developer pages don't state how long leads stay downloadable, so sync them to your CRM rather than relying on the export.
Our advice, not a measured benchmark: call within minutes. A real person expects contact, and a mistaken tap forgets the ad by tomorrow.
Check every lead in your CRM: a lead triage checklist
Run the same seven checks on every lead before it reaches the sales queue, and tag what fails instead of deleting it. This is our working procedure. The 30-day and 24-hour windows are our suggestions.
- 1. Email domain. Catches disposable, mistyped and (on B2B forms) free webmail domains. Set up a CRM rule against a disposable-domain list you maintain. When it fires, tag and hold from the sales queue.
- 2. Phone format and country code. Catches malformed and out-of-area numbers. Set up CRM validation on the phone field. When it fires, tag it unreachable format.
- 3. Duplicate phone or email in the last 30 days. Catches repeat fills and scripted bursts. Use a CRM duplicate rule. When it fires, merge, keep the first record and note the source ad.
- 4. Missing ad ID, or organic flag set to 1. Catches organic and preview leads. Read it from the export or webhook fields and route these separately. Not automatically fake.
- 5. Custom question answer pattern. Catches identical answers, nonsense text and the first dropdown option every time. Use a saved CRM view by answer value. Tag with the reason.
- 6. Burst timing. Catches many leads from one ad in a short window. Use a CRM report by created time and ad ID. When it fires, check that ad's placement breakdown.
- 7. Contact result within 24 hours. Catches everything the rules miss. Record it in a sales disposition field and feed the stage back to Meta.
For item 4, Meta's retrieving page lists three reasons a lead can lack ad IDs: the lead came from organic reach, it "may be submitted from an Ad Preview", or the person requesting leads lacks advertiser privileges on the ad account (Retrieving leads, Meta for Developers).
Which placements send the junk?
Break lead results down by placement and look for one placement producing leads sales can't reach. Ads Manager's placement breakdown shows which placement each lead came from, so a run of junk concentrated in one placement is visible there. If junk concentrates there and the placement is Audience Network, follow our steps to exclude Audience Network for the current controls.
A traced lead
This is illustrative, not a real lead. A home services lead arrives with a prefilled name and phone and the first dropdown option, 40 seconds after another lead from the same ad with the same phone. Email and phone format pass, because prefill gives a valid format. The duplicate rule fires and merges the record, and the matching first-option answers point to a careless or scripted fill. Only the sales call settles intent.
What should you do when a run of junk leads arrives?
Pause the ad that produced the run, then tighten its form before it spends again. Switch that form to the higher-intent form type, and turn on SMS verification if a callable phone matters to sales. Stop sending lead stages for that burst back to Meta until sales has worked through the records, so junk is never reported as a good lead. If the same ad keeps producing junk with every setting on, test a website form for that offer. Meta won't refund a lead you judge fake after the fact. Our guide on whether Meta refunds invalid clicks explains what its invalid-activity handling does cover.
Instant Form or website form: which should you use?
Start with an Instant Form and the higher-intent form type, and move to a website form when triage keeps finding junk after every form setting is on.
| Factor | Instant Form | Website form |
|---|---|---|
| Friction | Lowest; Meta says it uses information people already shared with Facebook | Higher; the person types details on your page |
| What you see about the visit | Lead fields, ad and form IDs, created time | The full visit: page, timing, device and any bot check you run |
| Bot checks you can add | Only Meta's form settings | Your own: CAPTCHA, honeypot field, server-side validation, timing checks, as in the website-form checks in fake leads in Google Ads |
| CRM sync | Webhooks, Bulk Read, Leads Center download, CRM integrations | Your form tool to your CRM |
| ClickFortify coverage | None; it can't see submissions | Scores the visit behind each lead; with the Conversions API (CAPI) proxy on, flagged conversions are dropped or tagged before Meta receives them |
| Pick it when | Volume matters and sales can triage fast | Each lead costs sales real time, or you need evidence before a lead counts |
Our verdict: Instant Forms are the right default for most lead campaigns, and the form settings above cost nothing to try. A website form earns its friction when your CRM keeps finding junk, when each lead costs a sales call, or when you need to see the visit before the lead counts.
Who this is wrong for: offers where lead volume is already too low to tolerate more friction. A website form there can cost more real leads than it removes fakes, so tighten the Instant Form and lean on CRM triage.
Send lead quality back to Meta
Tell Meta which leads were real by sending your CRM stages back. Otherwise Meta has only the submit to optimize toward, which can steer delivery toward more people like your junk. CRM stages travel to Meta through the Conversions API. The setup and thresholds are covered in our guide on how Advantage+ audience affects lead quality.
What ClickFortify can and can't see on lead ads
ClickFortify cannot see Instant Form submissions, so for Instant Forms the filters are Meta's form settings and your CRM. Those submissions happen inside Facebook and Instagram and never load your site. ClickFortify also does not check a lead's email address or phone number.
On the landing-page path, ClickFortify scores the visit behind a website lead on 100+ device, network and behavior data points and flags suspicious conversions, which is how it detects fake leads submitted through your own forms. When the CAPI proxy is enabled, conversions are checked against the visitor's fraud score, and flagged events are dropped or tagged before Meta receives them. It does not block IP addresses on Meta. See how this works for Meta lead ads.
Our verdict: fix the form settings and CRM triage first, because they cost nothing and cover the Instant Form path no click protection can see. Add protection when your ads send people to your own site, and keep the CRM checks either way.
