Real Inquiry or Bot? Spotting Lead Form Spam

Short answer: judge the batch, not the single message. Automated pitches give themselves away in groups: they arrive in bursts, ask to sell you something instead of asking for help, and read like one template with the names swapped. A real customer names a property, a problem and a phone number. Label suspected spam and keep it rather than deleting it, and call back anything that describes damage at an address, whatever a spam score says.

What arrived on our own form

Restoration Advertising runs a free directory of restoration companies and the trades a flood, fire or storm job needs, and businesses ask to be listed through our contact form. One night in early October 2026 the form filled up. Twenty of the 23 submissions it received in 30 days turned out to be automated. Twenty-one of the 23 arrived on the same day, 15 of them inside about an hour that night, and nine of those were 40 to 60 seconds apart. The other three were our own test messages.

Every one of the twenty followed the same pattern:

A business name built from one city and one trade, with its own matching web address.
Between 1,000 and 1,600 characters of near-identical text.
A request to be added to the directory, not a request for any service.

The earliest opened by asking us to add the company to the directory "for review", then gave a business name, an address and a website as labeled fields.

Twenty of the 23 also came from a browser reporting Linux, which is common for automated browsers running on servers and uncommon for a homeowner on a phone. Those twenty shared one identical browser string and came from twenty different network sources. Our checks did not stop them: reCAPTCHA v3 was on and every one passed, and neither the hidden field nor the minimum time on the page ever tripped.

Here is the part worth taking away: read one at a time, many of them looked legitimate. That was our own first impression. Read side by side, with the arrival times next to them, they could not have been anything else. If our system had counted them, the lead inbox would have shown twenty new prospects.

We confirmed it with a single read-only check of the form's records that looked only at timing, a scrambled version of each sender's network address, the browser type, the page and the message length. Nobody's name, email or message was read to reach the answer, and none of them appear here.

Why this costs a restoration company money

Your website form is a lead source, so whatever fills it shows up in your numbers. The OWASP Automated Threats to Web Applications project catalogs this as a named threat: its entry on Spamming (OAT-017) lists form spam and AI-generated content among its examples, and its entry on Skewing (OAT-016) covers automated use that distorts metrics.

That distortion lands in three places:

Where	What spam does there
The office	Someone spends a callback, or an email, on a sender who was never a customer
Your lead numbers	Leads received goes up and your booking rate goes down, so a good lead source looks worse than it is. See are lead services worth it for the four numbers to track
Your ad account	If a form submission counts as a conversion, a bot submission counts too

The ad account is the one most owners miss. Google Ads Smart Bidding uses Google AI to bid for conversions in every auction. If spam is being counted as conversions, the bidding is being trained on traffic that was never going to book a job. We have not measured how often this happens in restoration accounts; check whether your form is a conversion action, and whether the conversions match the calls you actually got.

The tells: bot pitch or real customer

No single signal proves anything. Several together usually do.

Signal	Automated pitch	Real customer
Timing	Several in a burst, seconds or a minute apart	One at a time, even at 2 a.m.
What it asks for	To list you, rank you, sell you leads, or be listed	Help with damage at a property
Wording	Long, polished, the same structure every time	Short, specific, sometimes rushed or misspelled
Names	A company name made of a city and a trade, with a matching web address	A person's name, often a tenant, owner or manager
Contact details	A web link and an email, often no phone	A phone number to call back, and an address
Details	General claims that would fit any business	Which room, what kind of water, when it started
Browser	Many from the same server-type browser	Whatever device they had to hand

The browser row is the weakest. Plenty of real people use unusual browsers, and an automated sender can claim to be anything. Treat it as a tiebreaker, never as the reason to ignore someone.

Filtering without losing real customers

The aim is to sort, not to throw away. When we found the twenty, the plan was to file every one of them, mark the automated ones as spam and our tests as ignored, and count none of them as leads. Both marks can be undone, so a mistake costs a click, not a customer.

Score instead of block

Google reCAPTCHA runs in the background without a puzzle for the visitor. Its version 3 returns a score for each submission, where Google's reCAPTCHA v3 documentation says 1.0 is very likely a good interaction and 0.0 is very likely a bot, and suggests starting at a threshold of 0.5 and adjusting it to your own traffic. That is a dial for your web developer, not a verdict on any one person. It was not enough for us on its own. A score catches the crude bots, and these passed it. Cloudflare Turnstile is an alternative that also works without showing visitors a challenge.

Record evidence with each submission

Our own form now keeps, alongside each message, the time the page loaded, whether a hidden field that people never see was filled in, and the reCAPTCHA score, as our privacy policy describes.

For a request to join the directory it also notes the network the message came from and whether the email address matches the website named. Right now this only records; it refuses nothing. As of 10/26/2026 the limits we chose for the next stage are decided but not in the form's code: no more than five submissions a day from the same source, and none from the same browser within 20 minutes of the last.

Those limits have a known gap. The twenty came from twenty different sources, so a per-source cap would not have stopped them, and a bot that rotates its address can stay under any such cap. What makes a flood harmless is that a request only reaches the directory after a person approves it. The filters decide how much of the flood you have to read.

Give vendors their own door

Our form already tags where each message came from: a restoration company asking about growth, a video inquiry, or a directory correction. On your site, a separate option for "I'm selling something" sorts many honest pitches out of the emergency queue without a single filter. Bots will still pick whatever box they like, which is why the evidence above matters.

Never refuse in silence

Whatever filter you add must say so when it turns someone away. When we hardened our forms in September, we found that three of our other sites showed a thank-you and threw the message away when a visitor's browser blocked the reCAPTCHA script. The fix, live since 09/23/2026, tells the visitor and keeps what they typed. The silent version fails real people without anyone knowing, and a person with water on the floor will call the next company.

Keep the phone first

A form is a slow channel for someone with water on the floor. Make the number the biggest thing on the page, as we cover in what to put on a restoration website that gets calls, so the form is a backup and not the front door.

When to call back anyway

A low score or an odd browser is a reason to look twice, not a reason to stay silent. Call back when a message has any of these:

A property address, or a town and a street.
A description of damage: water, smoke, mold, a roof, a ceiling.
A phone number with a person's name attached.

A two-minute call to a real person who sounded like a bot costs very little. A customer who never hears back calls the next company on the list, which is the whole point of why the first call wins the job. When you do call, work through the same questions every time, using what to ask on a water damage first call.

Skip the callback when a message asks only to sell you a service or a listing and names no property. If you are curious about the offer, answer it later by email, from someone who is not holding the emergency line.

If your form is filling with pitches and you want the system behind it sorted, that is the kind of work we do for restoration companies. Tell us what is arriving and we will take a look.