The history of click fraud, from the first paid click to AI agents
Click fraud began when a click got a price. This timeline follows it from the first pay-per-click ads in 1998 through the first court cases, the botnet years and the industry standards that followed, to the AI agent traffic advertisers face today. Every event links to its source.
Last updated November 2026
When did click fraud start?
Click fraud is as old as paying per click. GoTo.com launched the first search engine where advertisers paid per click in February 1998, and Merriam-Webster dates the term “click fraud” to 2001. No reliable record names the first fake click, but the first cases are well documented. Which one counts as first depends on the kind of case.
First criminal charge, 2004
Michael Bradley was charged with trying to extort Google with a fake-click tool. The charges were dropped in 2006.
First platform lawsuit, 2004
Google sued an AdSense publisher for clicking ads on its own site. A $75,000 judgment was reported in 2005.
First class action settlement, 2006
Google settled Lane’s Gifts v. Google for up to $90 million, mostly paid as advertiser credits.
Microsoft’s first click fraud lawsuit, 2009
Microsoft sued over clicks on competitors’ search ads and refunded about $1.5 million to advertisers.
A click gets a price: 1998 to 2003
Search ads moved from paying for views to paying for clicks. Once a click cost money, a fake click had a price too.
February 1998
GoTo.com sells the first pay-per-click search ads
Idealab launched GoTo.com, a search engine that ranked paid listings by bid and charged advertisers for each click. It later became Overture, which Yahoo bought in 2003.
Source: internetnews.com, February 1998
2001
The term “click fraud” appears
Merriam-Webster dates the first known use of “click fraud” to 2001, three years after paid clicks began.
Source: Merriam-Webster
February 2002
Google AdWords moves to cost per click
AdWords launched in 2000 with prices per thousand impressions. In February 2002 AdWords Select added cost-per-click pricing, ranked by bid and click-through rate.
The first cases: 2004 to 2006
Advertisers started asking what they had paid for, and the first disputes reached prosecutors and courts.
March 2004
A criminal charge over a fake-click tool
Federal prosecutors charged Michael Bradley with trying to extort $100,000 from Google with software he said generated fake clicks. Prosecutors dropped the charges in November 2006, so there was no conviction.
November 2004
Google sues a publisher for click fraud
Google sued Auction Experts International, an AdSense publisher accused of paying up to 50 people to click ads on its site to earn ad revenue. A $75,000 judgment for Google was reported in May 2005.
Source: ClickZ, November 2004
2005
Advertisers file class actions
Advertisers sued Google in Lane’s Gifts v. Google in Arkansas, and Yahoo in Checkmate v. Yahoo in California, saying they had paid for fraudulent clicks.
Source: Technology & Marketing Law Blog
March 2006
Google settles Lane’s Gifts for up to $90 million
Google agreed to settle for up to $90 million: about $60 million in advertiser credits and about $30 million in legal fees. The court approved the settlement in July 2006.
Source: CSO Online, July 2006
June 2006
Yahoo settles its click fraud class action
Yahoo’s settlement offered credits for fraudulent clicks back to January 2004, about $4.95 million in legal fees and a new traffic quality role. It received final approval in 2007.
Source: Technology & Marketing Law Blog
July 2006
The Tuzhilin report
A court-appointed expert concluded that Google’s efforts against invalid clicks were reasonable and its filters worked reasonably well, though he said the evidence fell short of scientific proof. The same month, Google began showing advertisers invalid click statistics.
Source: Tuzhilin report (PDF)
Botnets take over: 2006 to 2013
Fake clicks moved from people at keyboards to networks of infected computers that clicked quietly in the background.
2006
Clickbot.A is taken apart
Google analysed Clickbot.A, a botnet of more than 100,000 machines that clicked ads on syndicated search sites at a low rate to avoid detection. It was one of the first click fraud botnets documented in detail.
June 2009
Microsoft files its first click fraud lawsuit
Microsoft sued people it said clicked competitors’ search ads, calling it the first case it had filed over click fraud, and refunded about $1.5 million to the advertisers affected.
Source: The Register, June 2009
November 2011
Operation Ghost Click
The FBI took down DNSChanger, malware on about 4 million computers that hijacked clicks and swapped in other ads. The ring made about $14 million.
Source: Dark Reading, November 2011
February 2013
Bamital is taken down
Microsoft and Symantec took down Bamital, a botnet that hijacked search results and generated fraudulent ad clicks.
Source: Microsoft, February 2013
March 2013
Chameleon hits display ads
Researchers reported Chameleon, a botnet of more than 120,000 computers aimed at display ads. Their estimate was about $6 million a month in ad spend.
Source: Threatpost, March 2013
December 2013
ZeroAccess is disrupted
Microsoft, the FBI and Europol disrupted ZeroAccess. Microsoft estimated it cost advertisers about $2.7 million a month.
Source: Microsoft, December 2013
The industry sets standards: 2009 to 2019
Trade bodies started defining what counts as a valid click and who is allowed to sell an ad.
May 2009
Click measurement guidelines
The IAB and the Media Rating Council published the first click measurement guidelines. Google said its AdWords click measurement was accredited by the MRC the following month.
September 2014
TAG is founded
The ANA, the 4A’s and the IAB announced the Trustworthy Accountability Group to fight ad fraud across the industry.
Source: IAB, November 2014
October 2015
GIVT and SIVT
The MRC’s invalid traffic guidelines split invalid traffic into general (GIVT), caught by routine filters, and sophisticated (SIVT), which needs deeper analysis. They were updated in 2020.
Source: IAB, October 2015
June 2017
ads.txt
IAB Tech Lab released ads.txt 1.0, a public file where websites list who is authorised to sell their ad space.
Source: IAB Tech Lab
2019
sellers.json
IAB Tech Lab released sellers.json and the SupplyChain object so buyers can trace each party that resells an ad.
Source: MarTech, 2019
Industrial ad fraud: 2014 to 2021
Fraud rings faked browsers, websites and app installs at data-center scale, and prosecutors and platforms followed.
2017
A click fraud case goes to a jury
Fabio Gasperini was tried over a botnet of more than 155,000 computers used for automated clicking, in what his lawyers called the first US click fraud trial. The jury acquitted him of the felony charges, and he was convicted only of a misdemeanor, a result upheld on appeal.
September 2017
Fraud reaches mobile app installs
Uber sued its media agency Fetch, alleging it had paid for fake clicks and app installs attributed to its ads.
Source: Campaign, September 2017
November 2018
Methbot and 3ve are charged
US prosecutors charged eight people over Methbot (September 2014 to December 2016) and 3ve (December 2015 to October 2018). Methbot faked ad views from data-center servers and 3ve used about 1.7 million infected computers. Together they were paid more than $36 million: over $7 million for Methbot and over $29 million for 3ve.
August 2019
Facebook sues over click injection
Facebook sued two app developers over click injection on its Audience Network, where malware fakes clicks on ads to claim credit for app installs. Both cases were later settled.
Source: Meta, August 2019
November 2021
Methbot’s operator is sentenced
Aleksandr Zhukov, convicted in May 2021, was sentenced to 10 years in prison and ordered to forfeit about $3.8 million.
Click fraud today: 2023 to 2026
Invalid traffic now looks more like a real visitor: residential connections, real devices and AI agents that browse and click. Not all of it is fraud, but all of it is paid for.
June 2023
Where video ads really run
A research report questioned whether Google video ads ran on partner sites that met Google’s standards. Google disputed it, and some advertisers received credits. The question moved from fake clicks to where ads actually appear.
Source: Search Engine Land, August 2023
May 2025
AI agents click ads
In a preprint study on a test hotel-booking site, AI agents that browse on a person’s behalf clicked banner ads on the pages they visited.
Source: The Register, May 2025
August 2025
Google uses LLMs against invalid traffic
Google said content review improved with large language models cut invalid traffic from deceptive or disruptive ad serving by 40%.
Source: Google, August 2025
2026
Invalid activity credit report
Google Ads documents an Invalid activity credit report that breaks credits down by campaign and network for Search and Performance Max. Credits still arrive after the spend.
Source: Google Ads Help
Myths and the record
Some claims about click fraud history get repeated without a source. Here is what the record supports.
- Claim
The first click fraud happened in 1998.
RecordNo record names a first fake click. Paid clicks start in 1998, the term in 2001 and the first court cases in 2004.
- Claim
Google paid advertisers $90 million.
Record$90 million was the cap. About $30 million went to legal fees and the rest to advertiser credits, not cash.
- Claim
Michael Bradley was the first person convicted of click fraud.
RecordHe was arrested in 2004, but the charges were dropped in 2006.
- Claim
Clickbot.A was the first click fraud botnet.
RecordIt was one of the first documented in detail, not proof of the first.
- Claim
Methbot made $3 million to $5 million a day.
RecordThose were early estimates. Prosecutors described more than $36 million across Methbot and 3ve.
- Claim
Ad fraud loss figures are measured losses.
RecordMost headline figures are estimates from private datasets, with methods that are not public.
What has not changed since 1998
The incentive
A paid click is worth money to whoever can fake it, from a publisher earning ad revenue to a rival draining a budget.
The proof problem
Advertisers see a click, not who made it. Many of the cases above turned on proving who clicked and what it cost.
The seller is also the judge
The network that sells the click also decides which clicks were invalid and what to credit. Independent records give advertisers their own view.
Where click fraud is going
Our view, based on the timeline above.
More clicks with no person behind them
AI agents browse, compare and click. Not all of it is fraud, but advertisers still pay for clicks with no buyer behind them.
Fraud that looks more human
Residential connections and real devices make IP checks alone weaker, so detection relies more on device and behavior signals.
Proof for every click
Credits and totals arrive after the spend. Advertisers want a record of each click and the reason it was judged invalid.
That is why ClickFortify protects every paid click on Google Ads and Meta Ads and records the reason behind each decision.
See how ClickFortify works
Further reading
Sourced guides and methods. Where a reliable public figure does not exist, we say so.
Click fraud statistics 2026
Ad fraud cost, invalid traffic by channel and platform enforcement data, each figure with its source and caveats.
Is click fraud illegal?
The lawsuits and criminal cases in detail, and what advertisers can realistically do.
AI agents and invalid clicks in Google Ads
How AI agent traffic reaches your ads and how to tell it apart from real visitors.
How to check invalid clicks
Add the Invalid clicks column in Google Ads, segment it and baseline your own rate.
Google Ads invalid-click credits
How Google’s credits work, the Click Quality Form and the credit report.
What is click fraud?
The definition, the main types and how click fraud works today.
Questions about this research? app@clickfortify.com
Book a call