u/Dry_Donut_4275

Sharing this so others can check their accounts before losing money the same way.

Quick context: I'm a solo founder running paid search for a US-only B2B SaaS. Small budget, narrow geo, exact + phrase match keywords. Real customers are mid-market commercial real estate operators in the United States.

In late May, I made the mistake of taking ONE call from someone claiming to be a Google Ads rep offering to "optimize" my account. Standard playbook — they broadened my match types, loosened geo targeting, enabled Search Partners + Display Network. Within days, clicks 3x'd. Conversions stayed at zero.

I reverted the changes manually. The leak continued.

I spent over a week confused about why my reverts weren't sticking. Today I finally tracked it down: Google Ads → Recommendations → Auto-apply had 18 toggles ON in my account. Every time I tightened a setting, Google's auto-apply system silently re-broadened it. The worst offenders:

- Use optimized targeting — audience expansion that bypasses your keyword/geo targeting entirely

- Bid more efficiently with Maximize clicks — auto-switches your bid strategy to maximize click volume, not quality. In a bot-heavy environment, this is "buy as many bot clicks as possible at the lowest CPC"

- Remove non-serving keywords / Remove conflicting negative keywords — Google can silently delete your negative keywords without asking

- All 10 bidding strategy auto-applies — hand bid-strategy control to Google's algorithm, even though (in my case) the GA4↔Ads link was broken, making the conversion data garbage

- Upgrade your conversion tracking — silently rewrites your measurement config

The actual damage:

- $100/day budget × 6 days (May 26–May 31) = ~$600 spent

- 1 conversion total — an account registration with zero subsequent engagement (i.e., not a real user)

- GA4 28-day country breakdown:

- Singapore: 130 users (21.35% of all site traffic), 2.31% engagement rate, 0 seconds average engagement time

- China: 20 users, 8s avg

- Saudi Arabia: 31 users, 5s avg

- For comparison, real US traffic: 378 users at 30.6% engagement / 21s avg

The 0-second engagement from Singapore representing 21% of my traffic is mathematically impossible for legitimate human users. These are cloud datacenter bots. And Google's "automated invalid-click detection" never flagged it.

What to check in your account right now:

1. Google Ads → Recommendations → Auto-apply. If anything is on, turn it all off. Optimization suggestions should be reviewed manually, not silently applied.

2. Each campaign → Settings → Locations → "Location options." The buried radio button is probably set to "Presence or interest." Change it to "Presence: People in or regularly in your targeted locations." This alone closes a huge geo leak — Google treats anyone "interested in" the US as a valid match, including Singapore datacenter IPs.

3. Each campaign → Networks. Uncheck Search Partners and Display Network unless you specifically want them.

4. Check your GA4 by-country engagement. If you see significant traffic from cloud-hosting hubs (Singapore especially, also China/Saudi Arabia) with sub-10-second average engagement, that's bot traffic you've been paying for.

What I'm doing about the money:

Filed an invalid traffic refund request with Google support today. Stuck at queue position 1 in their chat for over an hour, which I guess is the customer service equivalent of "go away." We'll see.

If you've been bleeding budget and don't know why — go check that auto-apply page first. I wish I had a year ago.applied.

2. Each campaign → Settings → Locations → "Location options." The buried radio button is probably set to "Presence or interest." Change it to "Presence: People in or regularly in your targeted locations." This alone closes a huge geo leak — Google treats anyone "interested in" the US as a valid match, including Singapore datacenter IPs.

3. Each campaign → Networks. Uncheck Search Partners and Display Network unless you specifically want them.

4. Check your GA4 by-country engagement. If you see significant traffic from cloud-hosting hubs (Singapore especially, also China/Saudi Arabia) with sub-10-second average engagement, that's bot traffic you've been paying for.

What I'm doing about the money:

Filed an invalid traffic refund request with Google support today. Stuck at queue position 1 in their chat for over two hours, which I guess is the customer service equivalent of "go away." We'll see.

If you've been bleeding budget and don't know why — go check that auto-apply page first. I wish I had a year ago.