One of the most interesting findings from a recent Google Ads review was the number of fake leads coming through from a Performance Max campaign.
Location targeting was correct, the client had been sending clicks to a specific landing page, and the craziest part is that the vast majority of the lead details looked "real" (client is based in NZ, with leads coming through with NZ phone numbers, NZ email addresses etc).
However, about 90% of the leads were fake, consisting of either total ghost leads (you'd call the number and get no response or email the address and get a bounce) and in a number of cases the contact details were real BUT the person on the other end of the line had no recollection of ever filling out the form, or was simply not qualified to buy what is ultimately a fairly niche B2B solution.
In other words, real people were somehow having their details inputted into this form, but these real people didn't recall how that happened (the implication being somehow their details have been scraped/otherwise used).
Google, of course, was more than happy to report high levels of conversion activity in this account - and many advertisers would just look at the headline lead/conversion rate/cost per conversion data and be pleased (and chalk up the fake leads to spam coming from somewhere else).
You really need to be "on the ball" with this sort of thing ... or hire me to help you out!