Fake leads are automated form submissions that look like shoppers: a name, a phone number, an email, a vehicle of interest, sometimes a trade-in. They arrive in bursts, often dozens in an hour, from rotating addresses and freshly created accounts. The damage is not the submission itself. It is what happens downstream: sales staff burn hours calling numbers that never answer, the CRM fills with junk that corrupts follow-up reporting, and real leads wait longer because the queue is full of ghosts. The tell is in the pattern, not in any single lead. Real shoppers submit one form, then answer the phone. Bots submit twenty, then vanish. A lead that arrives at 3 a.m. from a device that has never visited the site, with an email from a disposable domain and a phone number that fails a line-type check, is not a buyer having a late night.
The burst is the signature
One fake lead is indistinguishable from a real one. Fifty in an hour is not. Bots work in bursts because their economics demand it: the operator rents a block of residential proxies, runs the submission script, and moves on. The burst shows up in the logs as a spike in form submissions with no matching spike in page views, because the bot posts directly to the form endpoint and skips the browsing a human does first. Check the ratio. A store where form submissions jump 400 percent while sessions rise 5 percent is being farmed, not discovered.
The second signature is freshness. Bot leads come from accounts and devices with no history: an email created that day, a phone number with no carrier record, a browser fingerprint that has never been seen. Real buyers have a trail, even a short one: a vehicle details page viewed, a payment calculator used, a returning visit. A lead with no trail and no follow-through is a lead to quarantine, not to call.
Related reading on this site: Home and Inventory Hoarding Bots: How Stores Detect Hold-and-Release Abuse cover the neighbouring problems in more depth.
Validate the contact, not the form
The cheapest controls sit at the contact fields, not at the form. An email from a disposable domain should be flagged at submission, not discovered after three failed follow-ups. A phone number should pass a line-type and carrier check: a real buyer gives a mobile or landline that exists, a bot gives a number that fails validation or belongs to a VoIP range used for verification farming. A name field that fails basic validation, a string of consonants or a celebrity name, is a bot that did not bother to generate a plausible identity.
None of these checks should block a submission outright. A real buyer with a new email and a VoIP number exists, and blocking them costs a sale. Flag, score, and route: high-confidence fake leads go to a quarantine queue that a human reviews once a day, medium-confidence leads get a verification step, and clean leads go straight to sales. The goal is not a perfect filter. It is a CRM where the first ten leads a salesperson calls in the morning are people.
Stop feeding the bot its own success signal
Most dealer forms confirm receipt instantly with a thank-you page and a tracking event. That confirmation is the bot's success signal: it tells the operator the submission worked, so the script keeps running. A form that returns the same response whether the lead passed validation or not, and that silently drops high-confidence fakes without a visible error, removes the feedback the operator needs to tune the attack. It is a small change with an outsized effect, because bot operators optimise for confirmed deliveries and abandon endpoints that stop confirming.
The other fix is upstream: put the form behind the same bot management that protects the rest of the site. A form endpoint that accepts posts from any origin with no challenge is an open door. Rate limiting per session, a challenge on the second submission from the same fingerprint, and a block on datacenter IP ranges cut the volume before it reaches the CRM, and they do it without adding friction for the one real shopper in fifty who is filling out the form at 3 a.m.
Frequently asked questions
How can a dealer tell a fake lead from a real one?
Look for the pattern, not the single submission: bursts of submissions with no matching page views, fresh accounts and devices with no browsing history, disposable email domains, and phone numbers that fail line-type checks. One of these alone proves nothing, three together is a bot.
Should a dealer block suspicious leads outright?
No. Block the obvious automation at the endpoint, but flag and quarantine suspicious leads for human review instead of rejecting them. A real buyer with a new email and a VoIP number exists, and rejecting them costs a sale.
Why do fake leads arrive in bursts?
Because bot operators rent proxy blocks and run submission scripts in batches. The burst is the economics of the attack: dozens of submissions in an hour from rotating addresses, then nothing until the next run.
What is the cheapest first control for fake leads?
Validate the contact fields at submission: disposable email domain checks and phone line-type and carrier checks. They catch the lowest-effort fakes before they reach the CRM, and they cost nothing to run.