The expensive form of form spam is not the junk you delete from an inbox. It is the fake lead that looked real enough to get assigned, worked, and counted.
Obvious spam is cheap: someone deletes it. The costly case is the submission that passes your filters, creates a record, triggers your automations, gets routed to a rep, and enters your reporting as a lead. Nobody flags it, because nothing about it looks wrong.
Judge how a record arrived, not what it contains. Plausible contents are precisely what commercial form-filling tools produce — see why bots fill in your forms.
| Signal | What it suggests | Reliability |
|---|---|---|
| Form completed in under a second or two | Scripted fill | Strong |
| Several records within the same second | Batch run | Strong |
| No interaction events before submit | No human present | Strong |
| IP geography contradicts stated location | Proxy or automation | Moderate |
| Disposable or newly-registered email domain | Throwaway identity | Moderate |
| Message text reads like a template | Possibly automated | Weak |
| Unusual name or company | Almost nothing | Weak |
The bottom two rows are where most manual "spam cleanup" effort goes, and they are the least reliable evidence available. Real prospects have unusual names.
Rep time, which is the visible cost and usually the smallest.
Automations that already fired. Anything triggered on record creation — sequences, SMS, task assignment, notifications, enrichment credits — ran before a human looked. On platforms billing per message or per enrichment, fake leads spend real money at the moment of arrival.
Distorted reporting. If a meaningful share of leads are automated, cost per lead, channel comparison and conversion forecasts are all measuring a mixture. Worse, the distortion is not evenly distributed: whichever channel attracts the most bots will look like the most efficient channel.
Optimiser poisoning. Fake submissions counted as conversions are fed back to ad platforms as training signal. An optimiser told these are good outcomes goes and finds more traffic like it. Left long enough, you are paying to acquire bots.
Of these, optimiser poisoning is the only one that gets worse on its own. Everything else is a fixed tax; this one is a feedback loop that pushes budget toward the sources producing fake conversions.
Start with the hygiene in stop contact form spam: server-side validation, rate limiting, a signed timing check and a properly hidden honeypot. That removes opportunistic traffic and costs your visitors nothing.
For the full comparison of what each method catches, see how to stop form spam without a CAPTCHA.
What it will not remove is the category that produces convincing CRM records. Commercial form-fillers render the page, execute your JavaScript, skip obvious traps and pace themselves under rate limits. They are built to look like a lead, and they succeed at it — which is precisely why content-based judgement fails and composition-based judgement does not.
SpamKill decides before the record exists, scoring how the form was filled in rather than what it says, at 99.9% accuracy across more than 100M+ submissions screened for 1,500+ businesses. Nothing reaches your CRM to be cleaned up, no automation fires on a fake, and no fake conversion is reported back to an ad platform. Flagged submissions are held and reviewable, never silently deleted — so a false positive is a delay you can see, not a lost prospect. See also SpamKill for growth teams. From $29/month with a 30-day free trial, no credit card.
Look at how it arrived rather than what it says. Sub-second form completion, arrival in bursts, perfect field order with no corrections, a referrer that does not match the landing page, and mismatched geography between IP and stated location are all signals. The record contents are the least reliable evidence, because plausible contents are exactly what commercial form-fillers produce.
A rep contacting it, the automations it fired on arrival, and the distortion it adds to every per-lead number you report on. The third is the expensive one: if a meaningful share of your leads are automated, your cost per lead, channel comparisons and conversion forecasts are all measuring a mixture, and the channel that looks cheapest may just be attracting the most bots.
Mark them, with a reason, and keep them out of your working views. Deleting destroys the evidence you need to tell whether your filtering is improving, and if you later discover a false positive there is nothing to recover. Anything blocked should be reviewable.
Partly, and late. Validation catches malformed records, and enrichment can flag addresses that do not resolve. Neither sees how the form was filled in, which is the signal that separates a commercial form-filler from a real prospect — by the time the record exists, the evidence has been discarded.
Yes, and usually invisibly. Fake submissions that pass are counted as conversions, so an ad platform optimising toward conversions learns to buy more of whatever traffic produces them. Left alone, the optimiser gets steadily better at finding bots.
Paste your form HTML into the Form Transformer and get the protected version back — no signup, no card, nothing to install.
Open the Form Transformer