Bot Form Submissions: How to Stop Fake Leads From Bots (2026)

A bot filling out your lead form in 2026 does not look like a bot. It loads your page in a real browser engine, renders your CSS and JavaScript, moves a cursor, arrives from an ordinary residential IP address in the city you targeted, clears your reCAPTCHA with a purchased token, types a valid name, address, email and phone number, and submits. Then your analytics records a conversion. The short answer to how you stop it is that you cannot win this on the form itself, because every check you can put on a form inspects the browser, and every browser signal is now something an attacker can rent by the hour. What still works is moving the test off the browser and onto the phone: require the person to receive a code on the number they just entered and type it back, in real time, before you accept the lead. This is a spoke off our ad fraud in lead generation pillar; here we go deep on the automated-submission slice alone.

Quick answers:

• What is a bot form submission?
• Why does reCAPTCHA not stop bot form submissions?
• How do I tell if my leads are coming from bots?
• Should I block bot traffic at the firewall instead?
• What is lead poisoning in Google Ads?
• How do I stop bot submissions without hurting conversions?

A word on sourcing, because this is a category where vendors sell fear by the percentage point. Definitional and platform facts below are confirmed primaries: the Media Rating Council’s invalid-traffic standard and Google’s own documentation. Botnet scale figures are attributed and labeled reported, since the primary write-ups block automated access and we corroborated them through secondary coverage. Where a number comes from a company that sells fraud detection, we name the company and treat it as that vendor’s own measurement. We write this as an operator. We are the ones eating the cost when a batch of form fills turns out to be automated, so the only question we care about here is whether the thing that submitted the form was a person.

How a bot actually fills out your lead form

Start with what the automated layer is made of, because the picture most marketers carry around is about a decade out of date.

The bot is a real browser. Headless automation frameworks drive an actual rendering engine, which means the page executes your JavaScript, applies your CSS, fires your events and produces the mouse movement, scrolling and typing rhythm a human would produce. It is not parsing your HTML and posting a payload at your endpoint. It is using your site.

The bot’s identity is disposable and rented. Residential proxy networks sell access to real consumer broadband connections, so a submission that originated in a data center arrives at your form from an ordinary home IP address in the right metro. This supply is not clean. Bitsight has published research finding that roughly one in five residential proxy exit nodes it studied communicate with malware sinkholes, which is to say a meaningful share of that residential IP inventory rides on compromised consumer devices rather than willing participants. The scale of the underlying device pools is the part that surprises people. HUMAN Security’s threat intelligence team reported uncovering a connected-TV device botnet, BADBOX 2.0, spanning more than a million compromised devices, with related activity that included residential-proxy capability. Separately, security reporting on the Kimwolf botnet describes an operation estimated to have infected more than two million consumer devices worldwide, turning ordinary household hardware into gateways by riding on commercial residential proxy services. Both figures are reported rather than independently audited, but the direction is not in dispute: the supply of real-looking residential addresses is enormous and cheap.

The bot’s fingerprint is rotated. Canvas, WebGL, screen dimensions, installed fonts, timezone and TLS handshake characteristics are all randomized per session, so a thousand submissions look like a thousand different visitors on a thousand different machines.

The bot’s challenge-solving is outsourced. CAPTCHA-solving services complete challenges at scale using a mix of human workers and machine-learning solvers, then return a valid token that the automated session submits with the form.

And the data is synthetic but well formed. Names, street addresses, emails and phone numbers are generated to pass every validity check you have, sometimes assembled from breached data so they belong to a real person who has never heard of you. Practitioners call the deliberate version of this lead poisoning, and we will get to why that name is the right one.

The Media Rating Council’s invalid-traffic standard draws the line that matters here. General invalid traffic, or GIVT, is what routine list-based filtration catches: known crawlers, declared bots, data-center ranges. Sophisticated invalid traffic, or SIVT, is the tier the MRC defines as requiring advanced analytics and multi-point corroboration to detect, including bots that mimic human behavior and traffic from hijacked devices. Bot form submissions live in the second tier by design. If your defense is a list, you are playing in the wrong tier.

Every browser-side defense is now for rent

Here is the structural problem, and it is worth stating plainly because it explains why adding one more widget never fixes this.

Every defense you can attach to a lead form asks a question about the browser. Where did this request come from? What does this device look like? Did this visitor behave like a human? Did they fill the field a human cannot see? Is this data shaped correctly? All reasonable questions. All questions about the one part of the transaction the attacker owns completely and can reconfigure at will. Residential proxies answer the first question. Fingerprint rotation answers the second. Solving farms answer the third. A rendering engine answers the fourth, since a bot that applies your CSS can see perfectly well that a field is hidden. A data generator answers the fifth.

None of this makes those checks worthless. Keep them. A honeypot and a rate limiter cost you almost nothing and they do thin the crude end of the volume. The mistake is treating them as the defense rather than as a noise filter. The pillar covers why the easy defenses fail across every fraud type, human ones included; the bot-specific version has a sharper edge to it, which is the pricing.

Because that is the part operators underrate. This is not a story about clever attackers. It is a story about a supply market. A residential IP address, a fresh browser fingerprint, a solved CAPTCHA and a well-formed synthetic identity are all line items you can buy, in volume, at a per-unit cost low enough that a fraud operator can afford to lose most of their attempts. You are not being outsmarted. You are being outspent on inputs that cost you a development sprint each and cost them fractions of a cent. Any defense whose answer is “add another browser-side check” is a defense that just raises the attacker’s shopping bill slightly, and their bill is the small one.

How to tell if bots are filling your forms

Before the fix, get honest about whether this is happening to you, because most operators discover it late and by accident. You will not get a flag from your ad platform. Google’s own invalid-traffic documentation is explicit that its filtering answers whether a click was valid, and states that in rare cases a click may be deemed invalid and removed while the conversion occurring from that click is not necessarily removed with it. Nothing in that system is scoped to whether the lead was a person.

So you have to read your own data. The signature is a gap between how good the records look and how reachable they are.

Your conversion count rises while your answer rate falls. This is the single strongest tell, and it is directional rather than forensic. If the campaign is reporting more conversions at a lower cost and your team is having fewer live conversations than last month, the extra volume is not people.

The data is too clean. Real humans typo their email, abbreviate their street, enter a number with inconsistent formatting. Batches that are uniformly well formed, correctly capitalized and complete in every optional field are batches assembled by something that does not make mistakes.

Timing clusters. Human submissions spread across the day in a shape that follows your traffic. Automated ones arrive in tight bursts, often at hours when your market is asleep, and often at suspiciously regular intervals.

Repetition with small variations. Names and street addresses that rhyme with each other across records, the same email pattern with rotating digits, many different people at implausibly similar addresses.

Reachability collapses at the first touch. Numbers that ring out every time, emails that never open anything, no bounces and no complaints either, because nobody is there to bounce or complain.

Two cautions on diagnosis. A single one of these signals proves nothing on its own; a promotion, a new geo or a broken form can produce any of them. And do not try to reverse-engineer which specific records were automated. You will burn a week and be wrong, because the whole point of the sophisticated tier is that the records look right. The useful conclusion is not “this row is a bot,” it is “this source is producing unreachable volume,” which is a decision you can act on.

Lead poisoning: when the bot trains your bidding

Now the part that actually costs money, which is not the junk row in your CRM.

Smart Bidding buys more of whatever you tell it worked. If your conversion action is “form submitted,” a bot fill and a genuine buyer produce an identical signal, so the algorithm moves budget toward whatever produces the most of them. Automated submissions are cheaper to manufacture than real interest, so they win that competition, and the campaign reports a falling cost per conversion while your pipeline quietly empties. The pillar covers the verified-lead to bidding loop in full, and we documented the campaign-level version in the Performance Max spam leads guide.

What is specific to bots is the speed and the direction of the spiral. Human fraud has a floor on its cost, because somebody has to be paid to sit there. Automated fraud does not, so once your bidding starts rewarding it, the supply can expand to meet whatever budget you point at it. That is why this problem tends to present as a sudden cliff rather than a slow drift, and why the fix has to change the signal rather than filter the output. Verify at capture, then send only verified leads back through offline conversion imports or enhanced conversions for leads, and if you are assigning value rather than just counting, the Google Ads bid strategies guide covers that discipline. To be precise about the claim: the import mechanics are documented by Google, and the argument that better signal produces better buying follows from those mechanics. It is a sound mechanism, not a published outcome study, and we will not dress it up as one.

Why possession is the one thing you cannot rent

The pillar lays out how verification defeats each fraud vector, so we will not repeat the taxonomy here. The bot-specific question is narrower and worth answering directly: why does this one check hold when everything else on the list got commoditized?

Go back to the supply market. Every input in the attacker’s kit is rentable because it can be produced once and resold many times, at scale, by someone who never has to know anything about your specific lead. An IP address is a routing arrangement. A fingerprint is a configuration file. A CAPTCHA solve is a piece of piecework. All three are fungible and none of them is tied to a particular human being.

Possession of a phone is not fungible. To pass the check, someone has to be holding the specific handset attached to the specific number that was typed into your specific form, within the short window after it was submitted, and be willing to read a code off it. There is no warehouse of that. It cannot be produced in advance, stockpiled, or resold, because it only exists in the moment and only for one number. That is the whole reason the economics break: the attacker’s entire model depends on inputs that get cheaper with volume, and this is an input that does not get cheaper with volume at all.

Two things this is not. It is not call tracking. A passcode at capture verifies the lead at the conversion event; it tells you nothing about what happens on a call afterward, and conflating the two is how operators end up buying the wrong tool. And it is not a product we are pitching. Elevarus is an operator. We run this inside our own funnels because we are the ones eating the cost when a batch turns out to be automated, not because we license a widget. The solar lead fraud spoke shows what it looks like when a vertical forces you to prove a second thing on top of possession. The U65 private-health lead fraud spoke shows the same fight in a vertical where the fake lead is usually a real person pulled in by a free-coverage offer.

The honest limits

Possession-based verification is a floor, not a guarantee. The pillar sets out exactly what it does and does not prove across every fraud type. The bot-specific limit is narrower and worth stating on its own: SIM-swap and social engineering against one-time passcodes are a documented failure mode. That matters enormously if you are securing a bank account and much less here, because a SIM swap is a targeted, expensive operation against one person and bulk fake-lead generation only works at fractions of a cent per submission. The claim is not that possession cannot be beaten. It is that it cannot be beaten cheaply at volume, and cheap volume is the entire business model. The pillar is candid about the honest limits of verification across every fraud type.

One more limit, on the numbers in this space. DoubleVerify, which sells verification services and is therefore reporting on its own book, has published that in connected-TV campaigns protected by its measurement fraud rates ran under one percent, against nearly nine percent on unprotected ones, alongside a sharp year-over-year rise in connected-TV fraud schemes. That is a connected-TV finding, not a lead-form one, which is exactly the point. We cite it as DoubleVerify’s own measurement, not an industry constant, and we would not build a budget on any single vendor’s percentage carried over from a different channel. Let the mechanics drive your decisions, not the scariest number in a press release.

The operator’s checklist

If you buy leads or run your own funnels, here is the order of operations that actually pays off.

The part people get wrong is sequencing. They add a verification step, watch reported conversions drop, get nervous, and never change the conversion definition they send back to the platform. So the algorithm keeps chasing the traffic that produces raw fills, and the verification step just quietly deletes the results at the end. Verification and your conversion definition have to move together. Otherwise you spend the next month buying more of exactly what you just tried to block.

The operator’s bottom line

Bot form submissions are not a widget problem, and they are not going to be solved by the next challenge plugin. The automated layer has industrialized every signal a form can inspect: the IP address, the fingerprint, the challenge, the data format. All of it is for rent, which means the arms race on the browser was lost by construction. The only test that still holds is the one that asks for something the attacker cannot rent, and in a lead funnel that thing is possession of the phone at the moment of capture.

Do that, then change what you count so your bidding learns from verified people instead of from bots, and your bidding starts pulling toward real people instead of away from them. That is how we run it: verify at the conversion event, feed the honest outcomes back, and only work reachable, in-market people. If you want to see it applied to a specific vertical, solar lead generation and HVAC lead generation show the vertical version, and how our lead generation model works covers the whole approach. Or just book a free call and we will look at your current lead flow with you.

Frequently Asked Questions

What is a bot form submission?

It is a lead form completed by software rather than a person. The modern version is not a crude script posting garbage into your database. It is an automated browser session that loads your page, renders your CSS and JavaScript, moves a cursor, fills every field with a plausible name, address, email and phone number, clears whatever challenge widget you put in front of it, and submits. On your end it looks like a conversion, because every signal you collect says a browser did an ordinary thing. In the Media Rating Council’s terms this is sophisticated invalid traffic, not the general invalid traffic a known-bot list catches, which is exactly why list-based filtering misses it. The pillar breaks down that distinction in full.

Why does reCAPTCHA not stop bot form submissions?

Because a challenge widget tests whether the visitor behaves like a human, and that test has a market price. Commercial CAPTCHA-solving services complete challenges at scale using a mix of human workers and machine-learning solvers, then hand the resulting token back to the automated session, which submits the form as if it had solved the challenge itself. The same logic applies to every other browser-side check. Blocking data-center IP addresses is defeated by routing through residential proxy networks. Device fingerprinting is defeated by rotating fingerprints each session. Honeypot fields are defeated by any bot that renders CSS and can therefore see that the field is hidden. None of these defenses are worthless, and they are cheap enough to keep, but they all test the browser, and the browser is the part the attacker controls. The pillar goes through why the easy defenses fail across every fraud type, not just bots.

How do I tell if my leads are coming from bots?

Look for the gap between how good the data looks and how reachable it is. The signature of automated submissions is a batch that is perfectly formatted and almost entirely unreachable: valid phone numbers that never connect, valid emails that never open anything, names and addresses that repeat with small variations, submissions clustered into tight bursts at odd hours, and traffic arriving from a spread of ordinary-looking residential IP addresses that never come back. The strongest single tell is directional rather than forensic: your conversion count climbs while your answer rate falls. That combination means you are buying more of something that is not picking up the phone. Do not wait for your ad platform to flag it, because as Google’s own invalid-traffic documentation makes clear, its filtering is scoped to the validity of the click, not the authenticity of the lead.

Should I block bot traffic at the firewall instead?

A web application firewall or bot-management layer is worth having, but it solves a different problem than the one costing you money. Those tools are built to protect infrastructure from abuse: scraping, credential stuffing, denial of service, traffic that is expensive or dangerous by volume. A lead-form bot is not trying to overwhelm you. It is trying to look like your best customer, and it arrives one polite session at a time from a residential IP address that has never hit your site before. That is a profile most edge rules are deliberately tuned not to block, because blocking it aggressively means blocking real buyers on shared or mobile connections. So you end up choosing between false positives on real leads and letting the automated layer through, and most operators quite reasonably choose the second. Keep the firewall for what it is good at, and put the decisive test at the conversion event instead, where a wrong answer costs you a passcode retry rather than a customer. If you are not running paid campaigns and just want the noise down, the honest answer is that a honeypot plus a rate limiter plus a challenge widget will thin the crude end, and that is most of what is available to you on the form itself. The decisive test still costs you a verification step. Which of those you want depends on whether a fake submission costs you an inbox or a media budget.

What is lead poisoning in Google Ads?

Lead poisoning is the practitioner term for automated submissions filled with synthetic or stolen personal information that exist specifically to be counted as conversions. The damage is not the wasted form entry, it is that your bidding cannot tell a bot fill from a buyer, so it goes and buys more of whatever produced the bot fill. What makes the automated version worse than the human version is that it has no cost floor. Paying people to fill forms gets expensive as you scale; running software does not, so once your bidding starts rewarding automated fills the supply can expand to meet whatever budget you point at it. That is why this usually shows up as a sudden cliff rather than a slow drift. Google’s own invalid-traffic documentation is explicit that a click can be judged invalid and removed while the conversion recorded from that click is not necessarily removed with it. The fix is to change what you count: verify at capture, and feed only verified leads back through offline conversion imports or enhanced conversions for leads.

How do I stop bot submissions without hurting conversions?

Accept that a verification step costs you some raw volume and that the volume it costs you is mostly volume you did not want. A one-time-passcode step at capture adds friction for everyone, including real buyers, so keep it fast and obvious: one code, one field, immediate, with a clear reason on screen. Real in-market people generally complete it, because they want the call back. There is no audited public completion figure for this, so treat it as a mechanism rather than a measured rate and watch your own numbers. What drops away is the automated layer, the dead and recycled numbers, and the incentivized clicker who was chasing someone else’s reward and has no motive to finish a step for your offer. Your reported conversion count will fall. Your reachable-lead count is the one to watch, because that is the number that was actually paying you. Then change your bidding signal to match, so the platform stops optimizing toward the volume you just removed. Verification raises the floor; it does not replace intent qualification, and the pillar is candid about that limit.

Sources

• Media Rating Council: Invalid Traffic Detection and Filtration Guidelines Addendum (Confirmed, primary; the industry standard definitions of general invalid traffic, catchable through routine list-based filtration, versus sophisticated invalid traffic, which the MRC defines as requiring advanced analytics and multi-point corroboration and which includes bots mimicking human behavior and hijacked-device traffic.)
• Google Ads Help: About invalid traffic (Confirmed, primary; Google’s description of its continuous click and impression validity evaluation and credits, and its explicit statement that in rare cases a click may be deemed invalid and removed while the conversion occurring from that click may not necessarily be removed.)
• Google Ads Help: Offline conversion imports and Enhanced conversions for leads (Confirmed, primary; the documented mechanics for sending verified downstream outcomes back into Google Ads so bidding optimizes against them rather than against raw form fills.)
• Bitsight: residential proxy services and malware ecosystems (Vendor-measured, attributed; Bitsight’s own research finding that roughly one in five residential proxy exit nodes it studied communicate with malware sinkholes, indicating that much residential proxy supply runs on compromised consumer devices.)
• HUMAN Security: Satori threat intelligence disruption of BADBOX 2.0 (Reported; HUMAN’s threat intelligence team reported uncovering a connected-TV device botnet spanning more than one million compromised devices, with related activity including residential-proxy capability. HUMAN’s page returned 403 on automated fetch; corroborated via secondary security coverage.)
• eSecurity Planet: the Kimwolf botnet abusing residential proxy networks (Reported; secondary security coverage of a botnet researchers estimate has infected more than two million consumer devices worldwide, and which abuses commercial residential proxy services to turn everyday consumer hardware into gateways.)
• DoubleVerify: global study on connected-TV fraud schemes (Vendor-measured, attributed; DoubleVerify reports that in DV-protected connected-TV campaigns fraud rates were less than one percent compared with nearly nine percent in unprotected campaigns, alongside a sharp year-over-year rise in connected-TV fraud schemes. These are connected-TV figures, not lead-form figures, and DoubleVerify sells verification services, so they are its own measurements rather than an audited industry benchmark.)
• Elevarus: Ad fraud in lead generation and OTP verification (pillar) (Internal; the full fraud-actor taxonomy, the GIVT and SIVT breakdown, why the easy defenses fail, the complete OTP mechanics and the honest limits this spoke links up to rather than re-deriving.)