How Fraudsters Use Bots to Attack Your Google Search Campaigns

Almost half of all web traffic is made of bots. But while some are good bots, others have been made with the wrong intentions.

Good click bots help perform and automate useful tasks, content enrichment, and site monitoring. Many marketers make use of good click bots to automate and speed up several repetitive processes. 

Then there are bad click bots, designed to execute clicks on paid ads and drain budgets. 

Did you know that bots can be created within Google itself -- using Google’s own tools – to then fraudulently click on ads? 

Here, we take a look at how fraudsters are using bots to attack your Google Search campaigns and the steps you can take to prevent them from damaging them. 

How do fraudsters use bots to attack your Google Search campaigns?

Nowadays, headless browsers and browser automation are widely used as efficient tools for integration testing, status pages, and automation tests to check submission forms, mouse clicks, keyboard inputs, etc. 

These tools are essential for companies to help them track and monitor the health of their websites. Unfortunately, these same tools are also used by bad actors to produce ad fraud and impersonate real users.

Most bot product tools, like Puppeteer -- a Node library that provides a high-level API to control Chrome and is directly supported and maintained by the Google Chrome team -- can also be tweaked to write software that executes automated actions as if they were made by real users. 

These bots can then be used for several illegitimate purposes, such as wasting the PPC budgets of competitors and collecting payouts by clicking on banners and ads on your own pages.

In fact, fraudsters have already created packages to facilitate this type of ad fraud, including the infamous stealth plugin. By using a combination of Google’s bot product, Puppeteer, and a plugin called “Puppeteer Extra Plugin Stealth”, fraudsters were able to produce fake clicks on paid ads. They were also able to route the bots’ traffic through proxies to circumvent fraud detection rules and perform these clicks disguised as real users.

How easy is it to create bots to attack Google Search campaigns?

It has become very easy for fraudsters to use these well-known tools to commit malicious acts such as ad fraud. 

In a surprisingly short time, a semi-experienced developer can create a simple software that can search Google for a keyword and click on all related ads. To demonstrate this, we tasked a junior developer with creating a bot in less than two hours and making it click on ads with specific keywords.

Here’s where the problem gets worse: While these bots are created with bad intentions, they are not always detected or flagged by Google as “bad” since they are created inside of Google architecture itself -- which means that Google considers them as their “own” bots. What’s worse is that when these bots are paired with other ad fraud techniques such as proxies, they become even harder to detect.

How can you protect yourself against these bots?

Bots like these need to be prevented before they can act. When a bot manipulates your Google Search campaigns, your data becomes polluted and your budget gets stolen. Every single fake click wastes your ad budget. 

Once these bots have attacked your campaigns, you can try to claim a Google Ads refund. However, it can take a long time to process on account of the required information you need to submit and that Google needs to process. Plus, it’s never guaranteed that you’ll retrieve your lost ad spend.

Ad fraud prevention is the only way you can be sure to stop bots from attacking your Google Search campaigns. Holistic end-to-end anti-ad fraud solutions like Opticks are the robust solution you need to safeguard your Google Search campaigns -- and all other campaigns across all channels -- from the threat of fraudsters and bad bots. 

To learn more about how our expert team can help you prevent bots before they drain your budgets, schedule a free demo today.