05/08/2026
One Google Click ID: 188 unique devices, 203 unique IP addresses, 214 total visits.
That's an example of click recycling, and it's one of the more damaging fraud patterns we found in our analysis of over 200 million clicks.
The GCLID is supposed to be a unique, and a 1-to-1 link between one ad click and one website visit. We found evidence of seemingly legitimate click IDs that were used across thousands of automated visits. The result is bot traffic that looks, to your reporting tools, like high-quality paid conversions.
This is a serious problem for any advertiser running performance-based campaigns, because:
- It inflates conversion metrics without producing real revenue
- It trains your AI bidding models on false signals
- It makes fraud look like success, which causes you to scale spend into the exact channels fraudsters control
This was just one of four major fraud patterns we identified in our analysis across 4,500+ domains. The others we found (location hopping, fingerprint spoofing, and one device generating 5 million visits in 3 days) paints a consistent picture on the scale and scope of invalid activity.
Click fraud in 2026 is automated, industrialized, and becoming easier than ever.
Platform-reported metrics and standard invalid traffic filters aren't catching the patterns described above. Defending your budget requires analysis above standard: and sits at the hardware and behavior level, not just the IP level.
We'll continue sharing our research on what detection at this layer looks like in practice. Feel free to reach out or read the full findings below.
