Google Ads Tracking 'potential' payments opens you up to a huge vulnerability in Google Ads.

[roydan]

Fake order triggers Google Ads algorithm to overspend €32,000 budget

E-commerce specialist shares incident highlighting PPC vulnerability when fraudulent €100 million purchase skews campaign performance by 109,989% ROAS.

ppc.land

TL;DR:
The company tracked an invoice deal, and reported it to Google as if the conversion value was real.
This resulted in Google's conversion algorithm becoming 'over confident' and it overspent by a butt load of money.
This was obviously an attack on the company's Google Ads campaign, but an attack that could've easily be avoided.

The agency seem to put some precautions in place preventing it from happening again, but it seems like they completely ignored the one an only fix they need, and this is something I want you guys to know as well:

NEVER REPORT MONETARY CONVERSION VALUE UNLESS MONEY CHANGED HANDS.
NEVEEEERRRRRRRR!!!
At least not automatically.

If you make sure to do that, you'll save yourself from this sort of fake order attacks.

It's not that hard, but it requires an additional step that the agency should've made earlier. You can report the conversion, but do not report conversion value unless you really got paid or if the order was verified.

So stupid..