I Run Sales Ops. I've Never Asked Where a Lead Came From. A Solo Dev Spent $220 and Found 60% Were Robots.

TL;DR (aka future GT, read this first next time): Two months into running sales ops, I realized I've never once asked where a lead actually came from. The CRM just trusts whatever's in the "Lead Source" field. This week a solo developer spent $220 on Google ads and found 60% of his billed installs were robots — and the industry's own survey says roughly half the cost of ad fraud doesn't stay in the ad account. It walks into the CRM and eats sales-team time. I already solved this exact problem on a side project, with a schema constraint that made an unsourced number impossible to write. So I'm going to make the lead prove it's real.

The confession

Two months ago I took a job running sales operations. I own the CRM, the forecast, the routing, the workflows that break at 11 PM and need me.

And I've never once asked where a lead came from.

I've asked how many we have. How many became opportunities. How many closed. I've built reports that slice the funnel by source, by campaign, by territory. But "source" is a dropdown someone forgot to fill in, and I've never challenged the number sitting behind it.

Here's the uncomfortable part: I'm not the exception. I'm the norm. The lead is the one object in the whole funnel that crosses from marketing to sales, and it crosses with no memory of where it was born. It just shows up, wearing whatever it claimed to be in the installer field.

This week I learned what that blind spot costs.

The $220 receipt

A solo developer — a guy building a puzzle game — spent $220 on Google ads with a $1.50 target cost-per-install. When Google couldn't find installs at that price, he ran a test: he removed the target. The account immediately spent double the daily budget and reported 21 installs.

His own admin panel said 1.

So he opened the raw analytics. The receipts:

20 of the 21 devices were running an old version of the app the Play Store had stopped serving days earlier. You can't get an old APK from the Play Store. Every single one still claimed "Google Play" was the installer.
Each device opened the app once, spent zero seconds on any screen, and never came back.
28 phone models across 19 states — a lot of variety for twenty phones that all did exactly the same thing.

Over two weeks: 56 installs billed — 33 followed that exact bot pattern, 7 came from countries the campaign was never targeting, and 13 were humans. The 13 humans finished 92 games between them.

Read that last line twice. The 13 real humans — the signal the entire $220 was spent trying to buy — were 23% of what the platform billed. The other three-quarters was a bot farm with sideloaded APKs and a lie in the installer field.

One guy, one afternoon, his own analytics, and a three-quarters lie rate. No enterprise fraud tool. Just a numbers guy who bothered to look.

The part that made it my problem

I almost dismissed that as a marketing problem. Ads are the marketing team's account, not mine. Then I found the industry survey.

Lunio's State of Click Fraud 2026 — 131 senior marketers — is saying the thing nobody in RevOps says out loud:

75.6% of marketers estimate they lose more than 5% of their monthly performance budget to invalid traffic.
Only 5.3% run a dedicated tool to stop it. The gap between alarm and action is the whole finding.
85.6% are worried about agentic AI specifically — bots that fill forms and fake conversions on their own.

And the damage split, which is the part that landed on my desk: 24.4% of the cost is wasted media, 22.9% is sales-team time lost to bot-generated lead forms, and 22.1% is corrupted CRM data.

Add the last two together and roughly half the cost of ad fraud is paid by the sales org and the CRM — not the ad account.

A bot clicks a paid ad, fills a lead form, lands in HubSpot, gets scored, gets routed, and a rep burns an afternoon on a "lead" that was never a person. The marketer sees a conversion. I see a fake lead eating quota-adjacent rep time and polluting every metric downstream of it — including the comp and quota numbers I'm supposed to trust.

At $5 million a year in media spend, the common loss band is $250K–$500K a year, and the top of the distribution hits $1.5M. Most of it is invisible to the people who own the bottom of the funnel.

I own the bottom of the funnel.

The thing I already knew

Here's the part that made me feel dumb, in the best way. I've already solved this exact problem. On coffee.

I built a site about Indian coffee, and its region pages need a number for how many hectares each coffee belt covers. Two government sources disagree on Coorg by 65% — the Coffee Board's 2014 data says roughly 82,000 hectares, the ISRO satellite atlas from 2024 says 135,796. Both are authorities. Neither is wrong. But rendering either one without attribution means I've silently picked a side I can't defend.

So I didn't fix it with a footnote. I fixed it in the database — a constraint that rejects any area figure written without a source and an as-of date. An unattributed number became impossible to write. I wrote the principle down back then:

A number you can't attribute isn't a fact. It's a liability.

Now apply it to the funnel: a lead you can't attribute isn't a lead. It's a liability.

A contact in my CRM that no one can trace back to a human click, a human install, or a human form-fill is the CRM's version of the 65%-apart area figure. Right now it's a silent row. The fix is the same discipline: make the origin a first-class, enforced field — not a "Lead Source" dropdown someone forgot to set, but a provenance chain. Click → install → form-fill → lead. A lead that can't produce the chain gets flagged, the same way an unsourced area figure now gets rejected.

The detail that matters structurally: the bot installs didn't hack anything. They filled in a field with a lie. "Google Play" in the installer column. So the fix isn't "ask nicer." It's "make the lie detectable."

The honest part (why this is harder than the coffee version)

There's a wrinkle I have to name, because it's the honest part.

The ad-fraud people use the phrase "ghost converter" for a bot that fakes a conversion and teaches the bidding engine to chase more bots. It's a feedback loop: fake conversions → the algorithm optimizes toward fake traffic → the budget follows the bots.

But the attribution people — Hyros, in their 2026 launch — use the same phrase for the opposite thing: a real user who converted but left no trackable click, because iOS killed the third-party cookie and Chrome is killing the pixel.

Same phrase, opposite polarity. And you cannot tell the fake converter from the untracked real one without provenance data. That's precisely the column nobody's schema enforces.

That's the uncomfortable truth sitting under the comfortable one. I can't just "delete the bots." Some of my best leads are real people with no click. The only way to separate them is to make every lead carry its chain — and to treat "no chain" as a question, not a disqualification.

A lead that can't prove where it came from isn't automatically fake. It's unverified. And "unverified" is a queue, not a verdict — route it to a human who can check, not straight into a rep's calendar.

The move

So here's what I'm actually doing, and it's embarrassingly cheap:

Run the audit. Pull the last ~100 leads, join each one to its acquisition source, and trace back as far as the data goes: which campaign, which click, which form, how much session depth, did anyone open an email. Count the leads that can't prove they're human. The output is a number I can say out loud: "X% of our leads can't prove they're a person." Zero new tooling. One afternoon. On the stack I already run.
Make provenance a field, not a dropdown. Add a lead_origin_chain (the sequence of verifiable events) and a lead_origin_verified flag that only a human-with-evidence can flip. Mirror the coffee trick: enforce it on every new write, grandfather the legacy rows, clean them up after. A lead that can't produce a chain is a flag. A lead whose chain includes a stale-APK install is a known bot signature.
Gate the handoff. A lead only routes to a rep if it carries a provenance stamp — or it goes to a "verify before routing" queue instead of a rep's calendar. This converts the ghost converter from an invisible tax into a visible, catchable one.

None of this requires buying a fraud platform. The fake lead is the cheapest lie in the funnel to catch, and right now it's invisible because nobody upstream asked the one question: is this real, and can you prove it?

The reflex I'm replacing

The bots are already in the CRM. The ghost converter is teaching the bidding engine to chase them. And the only person in the org positioned to see the whole lie is the one holding the reconciliation layer at the bottom of the funnel.

That's me.

So the next time someone says "we got 500 MQLs this month," my question is going to be — "great. How many of them can prove they're a person?"

I'd ask the same of anyone reading this. Go count. Pull your last hundred leads and ask where they came from.

I did. I didn't love the answer.