Bots submit dealership lead forms with valid-looking names, emails, and phone numbers, often using stolen data from breaches, and the submissions pass every check a hosted form ships with. A honeypot field and a submit-speed timer stop scripts, not sentences: gibberish typed into every field, test data like a@a.com, and link spam all clear both defenses and land in the CRM as people. Industry estimates put 10 to 30 percent of inbound leads as bot-generated or invalid, and real-time detection vendors report automated submissions making up 30 to 60 percent of captured leads on heavily targeted forms. The cost is not the junk row. It is the agent time, the skewed conversion data, and the real buyer who gets refused at the form while a bot sails through.
Your bot gate is a metal detector, not a reader
Nearly every hosted capture form ships with the same two defenses. A honeypot is a hidden input a person never sees and never fills; a script that fills every field on the page fills that one too and convicts itself. A render-to-submit timer throws out anything returned faster than a human could plausibly type. Both work against the bots they were built for, and neither reads the submission.
That is the gap. A bot that waits 5 to 60 seconds before submitting, imitates typing delays, and fills fields in a human order passes the timer. A bot that leaves the honeypot alone passes the honeypot. What arrives then is a well-formed lead with a name like Asdf Lkjh, an email at a disposable domain, and a phone number that bounces on the first call. On a typical setup each of those becomes a person in the CRM, routed to whoever is up next, and pushed to a phone at the urgency reserved for a live buyer.
The forms bots want most are the ones with money attached. Credit applications, trade-in valuations, and check-availability forms attract bot submissions that look like leads in the platform and fail the first phone call. Some bots are testing stolen data, submitting real names and numbers from breaches to see which ones are still active. Others are link spam, a backlink pitch pasted into the message box. Either way the form accepted both, and the CRM cannot tell which is which.
What the junk actually costs
Start with the agent. Every junk lead costs a call, a text, or at least a minute of triage, and it arrives with the same speed-to-lead alert as a real buyer, so it steals the fastest response from the person who actually wants a car. Multiply that by a form that is 30 percent junk and a BDC team working a hundred leads a day, and the team is spending a third of its morning on people who do not exist.
Then the data. Fake submissions pollute the CRM, skew conversion metrics, and make it hard to tell which campaigns produce buyers and which produce form fills. A campaign that looks like it converts at 12 percent may convert at 8 percent once the bots come out, and the budget follows the wrong number for a quarter before anyone notices. Google's own invalid traffic filters, more than 200 of them, catch much of the click fraud before billing, but a bot that fills a form is past the click and into the CRM, where Google's filters do not reach.
There is also a legal edge. Under TCPA rules, fines for contacting leads submitted by bots using stolen data can reach $1,500 per violation. A text to a number a bot pasted into a form is a text to a real person who never asked for it, and the dealership is the one that sent it.
Filter on what the submission says, not who sent it
The fix starts with reading the text. A honeypot conviction should discard the submission while the visitor still sees an ordinary success screen, so the bot gets no signal. But the submissions that clear the honeypot need a content check: gibberish, test patterns, and link spam are detectable in the words themselves, and a lead that fails the content check should be held, not blocked, with a queue and a one-click release. A held junk row costs somebody a minute. A dropped buyer costs the whole sale, and the store never finds out.
Real-time validation at the point of submission is the durable layer: check the email domain against known disposable providers, check the phone number against a reputation feed, and watch velocity, several submissions from one IP or device in a short window. None of these signals proves fraud on its own. A disposable email alone does not prove fraud, and a new device alone does not prove abuse. Clusters of weak signals do, and that is the rule to build on.
Never judge a name or an email domain as a person. Hold the submission, not the shopper, and give every held lead a human review path. The goal is a CRM where every row is a person who asked to be contacted, and a form that a real buyer can complete without ever noticing the machinery behind it.
Frequently asked questions
What percentage of dealership leads are fake?
Industry estimates put 10 to 30 percent of inbound leads as bot-generated or invalid, and real-time detection vendors report automated submissions making up 30 to 60 percent of captured leads on heavily targeted forms. If the share exceeds 30 percent, it usually reflects a problem with campaign targeting or form security.
Why do honeypots and CAPTCHAs not stop lead form spam?
A honeypot only catches scripts that fill every field, and a submit-speed timer only catches instant submissions. Modern bots wait 5 to 60 seconds, imitate typing patterns, and leave the honeypot alone. Gibberish, test data, and link spam all clear both defenses because neither one reads what the submission says.
Can fake leads create legal risk for a dealership?
Yes. Bots often submit stolen names and phone numbers from data breaches, and under TCPA rules fines for contacting those leads can reach $1,500 per violation. The dealership sent the text, even though a bot supplied the number.
Should bad leads be blocked or held for review?
Held, not blocked. A held junk row costs a minute of review, while a real buyer refused at the form is gone silently. Give every held lead a queue and a one-click release so a human can rescue the real ones.