Fake leads and lead fraud: the types, how to detect them and what to do

A fake lead is a lead record that did not come from a real person’s genuine request to be contacted. Lead fraud is selling or passing on such records as real leads. The main types are bots, form stuffing, incentivized traffic, recycled data, consent fraud and identity misuse. Each leaves different signs, so detection combines several checks.

What are fake leads?

Fake leads are lead records sold or delivered as real requests for contact when they are not. The record may contain made-up details, a real person’s details entered without their knowledge, or the details of a person who did fill in a form but had no interest in the service. A fake lead wastes the buyer’s money and calling time, and calling a person who never asked to be contacted creates consent risk.

Not every bad lead is fake. A real person can mistype a number, change their mind, or turn out not to qualify. Those are quality problems, handled by validation and returns. A lead is fake when the request itself was not genuine.

What is a lead in fraud?

In lead generation, "lead" in a fraud context means a fraudulent or fake lead: a record presented as a consumer’s request to be contacted that did not come from a genuine request. Lead fraud is the practice of creating, altering or reselling such records for payment. It can happen at any point between the click and the buyer: in the traffic, on the form, in the data, or in the consent record.

The word "lead" is also used outside lead generation, for example to mean a tip in a fraud investigation. This page uses the lead generation meaning.

The six main types of lead fraud

How each type of lead fraud is detected

Detection looks for combinations of signals and for patterns across many leads from the same source. One odd lead proves little; a pattern from one source is what matters.

Bots

Behavior on the form gives most bots away: no scrolling, instant typing, the same time on page every session. Network and device checks show visits from data centers or browser details that do not fit together. Ad platforms filter some of this too; Google describes its approach in its help page on invalid clicks.

Form stuffing

Data checks catch made-up details: invalid phone formats, disconnected lines, email domains that do not accept mail, addresses that do not exist. Duplicate checks catch the same phone or device across many leads. Stolen or scraped details pass format checks, so identity consistency checks and post-sale results matter here.

Incentivized traffic

These leads pass data checks because the people are real. They show up in results: high contact rates but very low appointment rates, and people who say they wanted the reward, not the service. Reporting by source and sub ID is the main way to find them.

Recycled data

Duplicate checks against earlier submissions catch some recycled data. Consent records help too: a real-time lead should have a consent record created minutes before delivery. People who say they asked long ago, or who report many prior calls, point to recycled records.

Consent fraud

Checking the consent record against the lead catches most of it: the phone number, time, page and consent text should match the submission and name the right buyer. Records of the form session can show whether a real visit took place. The FCC’s rules on consent are at 47 CFR 64.1200.

Identity misuse

This is the hardest to catch before the sale, because the details are real and consistent. Checks that the phone number belongs to the name entered, and that the visit location fits the address, help. After the sale, complaints that the person never asked are the clearest sign. People whose identity is misused can report it at IdentityTheft.gov.

For the checks themselves and when each runs, see lead validation. For how networks look at clicks, sessions and traffic patterns, see how networks detect bot and fraud traffic.

What buyers can do about fake leads

1. Write down what a valid lead is: required fields, criteria, geography and consent format.
2. Require a consent record with every lead, and spot-check records against the lead details.
3. Run your own phone, email and duplicate checks on delivery, and reject leads that fail.
4. Track contact rate, appointment rate and complaints by vendor and by source, not only in total.
5. Agree return terms that cover fake and unreachable leads, and request returns with the reason.
6. Ask vendors how traffic sources are reviewed and how they remove a source that sends fake leads.
7. Pause a source when its numbers change suddenly, and ask the vendor before resuming.

See lead quality standards for the fields to require and how lead returns work for return terms.

What sellers and publishers can do about lead fraud

1. Know where every click comes from, and split traffic with sub IDs so one source can be judged on its own.
2. Use the ad platform’s own invalid traffic controls and review placement reports.
3. Add format checks to forms and keep the consent text exactly as provided.
4. Never send test leads or made-up details; ask the buyer or network how to test instead.
5. Watch the ratio of clicks to leads and leads to sold leads by sub ID, and look into sudden changes.
6. Do not buy clicks from a reseller who cannot show where they came from, and do not reward people for filling in forms.
7. Pause a source first when something looks wrong, then ask your network.

Fake leads hurt honest sellers: they are rejected or returned, and they can cause a whole source to be judged as low quality. See why leads get returned and duplicate leads.

At Summit Leads, every publisher is reviewed before going live, TCPA consent is captured on every lead, and leads carry consent certificates. Returns are deducted under return terms agreed during onboarding, and unsold leads are not paid. See the publisher traffic guidelines.

Lead fraud and the law

Fake leads can create legal risk beyond the wasted money. Calling or texting a person who never gave consent can breach the TCPA (47 U.S.C. 227), and the FTC has examined practices in the lead generation industry, including at its Follow the Lead workshop. See TCPA basics for lead gen affiliates and TCPA consent record-keeping. This is general information, not legal advice.

Common mistakes

• Judging fraud from one lead. Look for patterns by source before acting.
• Relying on data checks alone. Incentivized traffic and identity misuse pass them.
• Reporting in total only. Fraud from one source hides inside good results from others.
• Not checking consent records until there is a complaint. Spot-check from the start.
• Confusing bad quality with fraud. A real person who changed their mind is a return reason, not fraud.

Frequently asked questions

Related guides

• Lead validation: The checks and when each runs.
• Bot and fraud traffic: How networks look at clicks and sessions.
• Lead quality standards: Fields and records buyers should require.
• Publisher traffic guidelines: What Summit expects from publisher traffic.
• Sell your leads: For lead generators with their own forms.

Already generating leads on your own forms? Sell your leads instead.