Google Ads Lead Form Spam: How to Stop Fake Leads

Why Do Google Ads Lead Form Assets Attract Spam?

Google Ads lead form assets attract spam because the default form takes few steps and opens inside the ad, so nothing on your site checks the person before the lead exists. Lead form assets, formerly called lead form extensions, let someone submit their details without ever loading your landing page.

That is the product's point. Google offers lead forms on Search and Performance Max campaigns (About lead form assets, Google Ads Help), and the default form type has fewer steps. That helps real buyers and junk submitters alike.

Google is clear that its filtering does not catch everything. Its invalid traffic page defines invalid traffic as "traffic that doesn't represent genuine interest in your business" and warns that "this traffic can still reach your website and lead forms" (About invalid traffic, Google Ads Help). The same page's FAQ says Google's protections "can't prevent all invalid leads".

So Google Ads spam leads come down to two gaps. The form is easy to submit, and you can only inspect a submission after it is delivered. Google's settings close the first gap, your webhook or CRM the second.

Switch the Form Type to "More Qualified"

Start here, because it is one setting and it changes who gets through. Google offers two lead form types, and More volume is the default.

Google's "Use lead forms in campaigns" page describes them like this (Google Ads Help):

• More volume: "This option uses a lead form design with fewer steps to submit." Google adds that it "may result in more leads" but that "they may include people who are less interested in your product or service."
• More qualified: "This option uses a lead form design that contains more steps." Google says this "may result in fewer leads, but those leads generally have a greater interest in your business, product or service."

The trade is plain: less friction means more submissions, including weak ones. More friction means fewer submissions from people who meant it. Google also says "You can change your lead form type between 'More volume' and 'More qualified' at any time during the campaign."

Our view: keep More volume only when your webhook and CRM checks are strong and sales can absorb a high lead count. Switch to More qualified as soon as junk shows up in sales follow-up.

Change one setting at a time and note the date, so you can tell which change moved lead quality.

Turn On SMS Phone Verification for Search Campaigns

Google Ads SMS phone number verification adds a one-time password step to Search lead forms, and an unverified number is never submitted as a lead. It is not available on Performance Max. On Search, turn it on: it checks that the person can receive a text message on the number they typed.

Google's "Create lead form assets" page says you can "ensure your sales team only spends time on valid, high-intent prospects by requiring SMS phone number verification", and that this "adds a one-time password (OTP) step to your form, filtering out invalid numbers, automated spam, and bots" (Google Ads Help). The same page says it is "currently supported for Search campaigns only."

The mechanics are on Google's phone number verification page (About phone number verification, Google Ads Help). The code arrives by SMS, it "typically expires after 15 minutes", and Google states: "If a user doesn't successfully verify their phone number, the system won't submit the lead."

That line is what makes the friction worth it: a fake number never becomes a lead. The limit is scope. Performance Max lead forms cannot use this check today, so they rely on your own validation at the point of delivery.

Add a Qualifying Question That Junk Leads Fail

Add one question that a real buyer can answer and a bot or careless tapper cannot. Google's best practices page advises you to "select predefined questions that align with your campaign goals to gather essential information" (Best practices for lead form assets, Google Ads Help).

Google's qualifying responses feature goes further (About qualifying responses in lead forms, Google Ads Help). It is available for Search campaigns only. You pick a multiple-choice question from Google's list or suggest your own custom question, then mark one or more answers as qualifying. The question is required, so nobody can skip it.

Google then tags any submission with a qualifying answer as a qualified lead. Each lead carries a lead stage in the data sent to CSV downloads, the webhook and the API. That gives your webhook a field it can check without guessing.

Our design rules for the question:

• Ask something only a buyer knows. Service area, budget band or project timeline all work.
• Avoid answers anyone can guess. A yes or no question about interest qualifies everyone.
• Keep the form short. One sharp question beats five soft ones, because long forms push real people away too.

On Performance Max lead forms, where qualifying responses are not available, use a predefined question anyway and check its answer at the webhook.

Validate Leads Where They Land: Webhook and CRM Checks

Every lead should pass your own checks before sales sees it or bidding counts it. Google's "Prevent invalid leads" page recommends server-side validation for web forms. For a lead form asset, the closest equivalent is checking the lead where it is delivered. That is our inference, not something Google says about lead form assets.

Google's setup page lists three delivery options: download, a webhook that sends data to your CRM, and email notifications (Create lead form assets, Google Ads Help). The About page adds the Google Ads API. The webhook uses a URL and a key. Google says "the webhook URL is the delivery path that sends lead data directly to your CRM through an 'HTTP POST' request" and "the webhook key is used for validating the leads sent" (Google Ads Help). Use the "Send test data" option before you go live.

Downloads have a clock on them. Google says "You can only download leads from the last 30 days. Google Ads stores leads for 60 days, so download your data often" (About lead form assets, Google Ads Help). Webhook delivery, a CRM integration or the Google Ads API, which exports up to 60 days of leads, is the better route.

Here is the order we recommend:

• Check 1: Hold. Send every lead by webhook into a hold state, not straight into the sales queue. Check the webhook key first.
• Check 2: Email. Check syntax and that the domain can receive mail. Compare the domain against a list of disposable email domains.
• Check 3: Phone. Check format and length for the target country, and that the number belongs to an area you serve.
• Check 4: Qualifying answer. Confirm the answer matches a real option and your service area, and read the lead stage Google sends.
• Check 5: Duplicates. Flag the same email or phone already received within your chosen window.
• Check 6: Patterns. Flag repeated names, keyboard-mash text, and identical submissions arriving in a burst.
• Check 7: Route. Pass the lead to sales only if it clears checks 2 to 6. Otherwise tag it 'unqualified: spam' and record the reason.
• Check 8: Sales acceptance. A person confirms the lead is reachable before it counts as qualified.
• Check 9: Keep the trail. Store the click ID if your payload carries one, plus the spam tag and reason, for conversion imports and any investigation request.

Here is how one junk lead fails the checks. This is an illustration, not real data. A submission arrives with a name made of random letters, an email on a throwaway domain, a phone number from a country you don't serve, and a qualifying answer outside your service area.

Check 1 holds it. Check 2 flags the email domain. Check 3 flags the country code. Check 4 confirms the answer does not qualify. Check 7 tags it "unqualified, spam: disposable email, out-of-area phone", and it never reaches a salesperson or your primary conversion.

Any one check could misfire on a real person. That is why the lead is tagged with reasons rather than deleted, and why check 8 keeps a human in the loop.

Does reCAPTCHA Work on Google Ads Lead Form Assets?

You cannot add reCAPTCHA to a Google Ads lead form asset, because Google renders the form inside the ad and you cannot add your own scripts, CAPTCHA or hidden fields to it.

Google's "Prevent invalid leads" page, first reported by PPC News Feed on 17 September 2026, says "Google Ads filters out invalid traffic to protect your ad budget. However, these filters don't prevent invalid leads on their own" (Google Ads Help). It calls "high lead quality" "a shared responsibility" and tells advertisers to "use reCAPTCHA on your web forms". Its other advice, double opt-in and server-side checks on email domains and phone formats, is also written for forms on your own site. The page does not mention lead form assets.

For the in-ad form, the replacements are the four controls above: the form type, phone verification, a qualifying question and webhook validation. If you capture leads on your own site, we walk through Google's web-form checks in click fraud protection for B2B SaaS and high-CPC ads.

Feed Only Qualified Leads Back to Smart Bidding

If your primary conversion is every raw submission, bidding learns to find more people who submit, junk included. That is how junk lead form submissions turn into a bidding problem rather than just a sales annoyance.

Make a qualified-lead goal primary. If you use qualifying responses, Google says an active qualifying question adds the "Lead form - Response qualified (Google-hosted)" conversion action to the Qualified lead goal (About qualifying responses in lead forms, Google Ads Help).

Then mark junk as unqualified in your CRM and import qualified or converted outcomes, not raw submissions. Google lists "Use Enhanced Conversions for Leads" among its lead form asset best practices (Google Ads Help), so the feedback loop is a supported path. The setup itself is covered in our guides to enhanced conversions for leads and sending lead quality back through Google Ads Data Manager. The same rule applies to newer in-ad lead formats, covered in AI Mode ads and lead quality.

Lead Form Asset vs Website Form: Which Should You Use?

Use the lead form asset when the offer is simple and your delivery checks are strong. Use a website form when leads are high value or the spam will not stop. This table is our own comparison, built from the help pages cited above.

Our switch rule: if junk keeps reaching sales after More qualified, phone verification, a qualifying question and webhook checks, move lead capture to a website form. Test it on one campaign first and compare sales-accepted leads, not raw counts.

We are not claiming either option converts better. There is no reliable public data on that, or on how common lead form spam is, so this post gives none.

Run This Google Ads Lead Form Spam Checklist

Use this list to stop spam leads from Google Ads lead forms in one pass.

• Form type: More qualified, or More volume kept on purpose with strong checks behind it.
• Phone verification: on for every Search campaign with a lead form.
• Qualifying question: at least one, marked with qualifying answers where Search allows it.
• Delivery: webhook into a hold state, tested with test data, key checked.
• Checks: email, phone, qualifying answer, duplicates and patterns, in that order.
• Tagging: spam tagged unqualified, with a reason.
• Bidding: import qualified or converted outcomes. Raw submissions are not the primary goal.
• Review: weekly look at the share of junk by campaign.
• Downloads: scheduled inside 30 days, if you use them at all.
• Switch rule: written down, with a named owner.

What ClickFortify Can and Can't See

ClickFortify can't see Google Ads lead form asset submissions. They happen inside the ad and never load your site, so the steps above are the defence for that form.

On the landing-page path, it scores every click against 200+ signals in real time. It excludes invalid IPs automatically through your Google Ads IP exclusion lists and keeps an evidence trail for each block. It also keeps conversions from flagged fraud out of bidding, so website-form junk does not train your campaigns.

If you move lead capture to a website form, that traffic comes under protection. See Google Ads click fraud protection for Search campaigns for how it works, and the Performance Max protection page for the landing-page side of those campaigns.