Stop fake leads

When website leads never answer the phone, agents blame their follow-up, their market, or their website’s design. The first thing to check is simpler: whether the leads were ever people. A meaningful share of submissions to an unprotected real estate form is automated — and a pipeline salted with bots quietly corrupts everything downstream of it.

Where the junk comes from

Web forms get filled by software for reasons that have nothing to do with you. Spam bots inject links hoping your auto-reply or CRM re-broadcasts them. List-poisoning bots submit strangers’ real email addresses, so your “new lead” welcome message lands as unsolicited mail to someone who never visited your site. Scrapers and probing scripts submit garbage as a side effect of crawling. None of this is targeted; it is weather. Every form on the open web stands in it, and a form without a working challenge simply records whatever blows through.

What a fake lead actually costs

The direct waste is obvious — calls to dead numbers, texts into the void. The indirect damage is worse. Junk contacts poison your conversion math: if a third of your “leads” were never human, every cost-per-lead and follow-up statistic you compute is fiction, and the ROI arithmetic on your marketing spend breaks silently. Automated nurture makes it riskier still: emailing harvested addresses and spam traps damages your sending reputation, which throttles deliverability to the real prospects on the same list — and in Canada, sending commercial email to people who never asked for it is a compliance problem, not just a courtesy one. Speed-to-lead discipline suffers too. A team trained to respond in minutes burns that urgency on ghosts, and the habit erodes exactly where it matters.

Fail-open is the industry’s quiet default

Most lead-capture products treat bot protection as an optional setting, off by default, because vendors are graded on lead volume and a bot inflates the number that renews the contract. Even when a challenge is present, many integrations fail open: if the verification service is slow, unreachable, or blocked, the submission goes through anyway. That design defends the demo, not the pipeline. The moments a checker is down are precisely the moments automated traffic is heaviest, so fail-open protection tends to work right up until it is needed.

What we run in production

BrokerFold’s position is that a lead pipeline is only worth building on if it is human. Every lead form and visitor signup on every site we serve sits behind an invisible bot challenge — Cloudflare’s Turnstile — which verifies visitors without the puzzle-solving that used to tax real users. The check is fail-closed: no valid challenge token, no accepted submission, even when that costs us a borderline case. Submissions are also validated and rate-limited server-side, because client-side checks alone are a suggestion, not a defence. The result is boring in the best way — the capture forms feed the CRM with contacts a human created, so routing, nurture, and your own judgement operate on signal instead of noise.

What to demand from any form you rely on

If you run capture anywhere — on our platform or not — hold it to four questions. Is there a bot challenge on every public form, including the low-traffic ones? Does it fail closed? Is validation enforced on the server rather than only in the browser? And can you see, per lead, where and how it was captured, so an anomaly stands out? A landing page that converts beautifully but cannot answer those questions is measuring its own imagination. Clean capture is not a feature you notice day to day — it is the reason every number you look at afterwards means something.