Every advertiser eventually stares at a click report and thinks it: someone is doing this on purpose. Sometimes the suspicion is wrong; bots and low-quality placements produce the same symptoms. Sometimes it's exactly right: Google's own invalid traffic page names competitors who manually click to increase your spend, and the motive is built into the auction. Every click a rival lands on your ad burns your budget, and in a shared auction, your waste is their discount. Competitors keep clicking as long as it costs you something and costs them nothing. The plan below reverses both sides of that equation.
This is the complete playbook: how the drain works, how to rule out the ordinary causes that look like sabotage, and the seven steps that make hostile clicking stop paying off. For the deeper evidence workflow it builds on, see how to prove competitor click fraud. Brand bidding, a different problem people often confuse with this one, gets its own section near the end.
Why do competitors click your ads?
Understanding the motive helps you read the pattern. Competitor clicking concentrates where the incentive is strongest:
| Motive | How it shows up in your account |
|---|---|
| Deplete your daily budget | Click bursts early in the day; campaigns go 'Limited by budget' while real customers arrive to find your ads gone |
| Inflate your costs on shared keywords | Repeated clicks on your highest-CPC terms, the ones where you compete head-to-head |
| Pollute your optimization data | Fake engagement teaches Smart Bidding the wrong lessons, quietly degrading targeting for weeks |
| Research disguised as sabotage | Rivals checking your ads, prices, and landing pages. Lower volume, still billed |
| Retaliation | Spikes that start right after you enter a market, outrank someone, or win a client |
How do competitor clicks drain your budget?
The damage is bigger than the click price, because a hostile click costs you three times: the money, the lost visibility, and the data. Competitor clicking is rarely a dramatic spike. The costly cases are usually quiet, small and repeated, which is why they survive for months in accounts that only check weekly totals.
The money goes first. A rival aims at the terms where you compete head to head, and those are your most expensive clicks. Every one of them is billed like a real visit.
Then the visibility. Google says a campaign might spend up to twice its average daily budget on a given day, while monthly charges stay at or below 30.4 times the average daily budget. Budget burned by hostile clicks in the morning is budget that can't serve buyers in the afternoon. Your ads go dark during the hours real people search, the campaign shows "Limited by budget", and the rival takes the auctions you dropped out of. Take an illustrative account with a $200 average daily budget on $25 clicks: eight hostile clicks before lunch use a full day's worth of budget. Pacing then has less left for the afternoon, and nothing in the totals looks unusual except an earlier stop.
Then the data. If those visits ever submit a form, or your conversion goal counts shallow actions, Smart Bidding learns from them. It starts bidding for more traffic that looks like the people who never buy. That effect compounds for weeks after the clicks stop, a dynamic we break down in how invalid clicks inflate your CPA and what "Limited by budget" really costs you.
In reports, the drain tends to show up as:
- expensive keywords getting clicks but no qualified leads
- the budget running out earlier in the day than it used to
- locations with steady spend and no sales history
- mobile traffic with very short sessions
- the sales team reporting more fake or low-intent leads
None of these proves sabotage alone. Together, they tell you where to look. Legal search shows the motive at its most expensive, and our guide to click fraud for law firms on Google Ads covers how a firm checks its intake records before blaming a rival.
Which signs point to a competitor?
Before you act, check whether the pattern fits. One anomaly is noise; a cluster is a case:
- Repeat clicks from one IP or a tight range. The classic office-network signature: the same source hitting your ads day after day.
- Concentration on your most expensive keywords. Random bots spread out; a rival aims where clicks hurt most.
- Business-hours clustering. Human sabotage happens 9-to-5, often in your shared local market's time zone.
- Seconds-long sessions with zero engagement. Click, land, leave. No scrolling, no second page, ever.
- Timing that matches competitive events. Spikes right after you outbid someone, launch a campaign, or take the top spot.
- Geographic mismatch. Clicks clustered in one city or region where a specific rival operates. This is distinct from the wrong-country click problem, which has different causes. For a local contractor whose rival works the same streets, location alone is weak evidence; how HVAC, plumbing and roofing businesses handle click fraud covers that local pattern.
- CTR up, conversions flat. The arithmetic signature of paid-for clicks that were never customers.
If several of these line up, move to the plan. If none do, you may still have an invalid traffic problem, just not a rival with a grudge. Bots produce similar symptoms at larger scale, and the response overlaps heavily, so nothing below is wasted either way.
Is it a competitor or a bot?
Usually you can tell by volume, timing, and what happens after the click, though often not with certainty. A person clicking out of spite has limited time and a fixed location. A bot has neither limit. Compare the pattern you see against both profiles:
| Signal | Leans competitor | Leans bot |
|---|---|---|
| Volume | A handful of clicks a day | Dozens or hundreds, often in bursts |
| Timing | Business hours in your market | Around the clock, or at machine-regular intervals |
| Source | One office network or local ISP, near a known rival | Data center ranges, proxies, or many countries at once |
| Keywords | Your most expensive head-to-head terms | Spread widely, including cheap terms and Display placements |
| Session | A human visit: may glance at pricing, then leave | No scroll, no interaction, or signs of a headless browser |
| Device | The same desktop and browser, day after day | Many devices with identical setups |
| Forms | Rarely submitted | Junk submissions with patterned details |
Be honest about what your evidence supports. Google Ads does not show the IP address behind a click, so the "Source" and "Device" rows need site-side data or click-level monitoring. A rival who uses a click service, or a bot that targets your expensive keywords, can land in the opposite column. When the signals split, treat it as invalid traffic of unknown origin and run the plan below anyway.
Rule out the lookalikes before blaming a rival
Most "a competitor is clicking my ads" alarms have an ordinary cause, so check those first. Google's own invalid traffic guidance lists genuine reasons for a traffic spike: seasonal trends or news, your own budget, keyword, audience or location changes, and even a competitor pausing their ads, which lets yours show more often and collect more clicks. It points you to Change history first.
These ordinary PPC problems produce the same symptoms as a hostile rival:
| Lookalike | Why it looks like sabotage | What to check |
|---|---|---|
| Broad match drift | Clicks rise on expensive terms with no qualified leads | Search terms report, match type changes, negatives, Change history |
| Search Partners or wider inventory | The traffic source shifts while campaign averages hide it | Network segment, placement reports, channel breakdowns |
| Display or app placement waste | Short sessions and accidental clicks go up | Placements, apps, engagement, qualified outcomes |
| Landing page or tracking failure | Clicks keep coming but conversions vanish | Auto-tagging, redirects, form health, tags, page speed |
| Conversion lag | Recent clicks haven't had time to become leads or sales | Your lead cycle length and offline import timing |
| Seasonal or auction pressure | CPC rises and CPA gets worse | Auction insights, impression share, last year's same period |
| Generic form spam | Junk leads pile up and sales acceptance drops | Form validation, source clustering, lead quality rules |
If one of these explains the pattern, fix it first. If the pattern survives the cleanup, your case for invalid traffic gets much stronger, and you've removed the easy objections a Google reviewer would raise.
Use Auction insights to see who is in your auctions
Google's Auction insights report shows which other advertisers entered the same auctions as you, and how often. It is available for Search, Shopping, and Performance Max campaigns, and reports impression share, overlap rate, and outranking share, plus position above rate and top of page rates for Search.
What it does not show is who clicked. Auction insights is about bidders, not clickers. A rival appearing in the report proves they compete with you, nothing more.
It is still useful as context. If a new competitor's overlap rate jumps in the same week your click spike starts, or the spike begins right after you outrank someone, that timing belongs in your evidence file. Treat it as a correlation that points you toward where to look, never as proof. Pick a date range that covers both the spike and the weeks before it, so you can see whether anything in the auction actually changed. Our guide to using Auction Insights walks through reading each metric.
Follow the 7-step response plan
Step 1: Confirm the pattern before you blame anyone
Start with a baseline. Pull the previous 14 to 30 days for the affected campaigns and compare clicks, spend, CPC, CTR, conversion rate and cost per qualified lead, then break the same period down by location, device, hour of day and search term. If today's pattern isn't meaningfully different from that baseline, you don't have a case yet.
Then work through the segments Google already gives you: clicks by hour of day, by geography, by device, by network, and the search terms report. Cross-check against analytics: billed clicks versus real sessions and engagement. What you're looking for is repetition tied to a source, not a bad week. This discipline matters because the most expensive mistake in this whole area is blocking real customers based on a hunch.
Step 2: Build the evidence file as you go
Start a running log from day one: dates and timestamps, campaigns and keywords hit, IPs and patterns where you can see them, screenshots of the reports, and the spend affected. You'll use this same file three times: for Google's review team, for your own exclusion decisions, and (rarely) for lawyers. Cases and credit claims fail on vague suspicion; they succeed on documentation. Everything Google counts as invalid activity is defined in its invalid clicks documentation.
Let the strength of the file decide how hard you act:
| Evidence level | What it looks like | What to do |
|---|---|---|
| Clue | One odd metric, such as a spend spike or short sessions | Watch it and check recent campaign changes |
| Pattern | Weak traffic that repeats by hour, location, device, keyword or source | Segment the reports and compare with your baseline |
| Evidence file | A repeated pattern plus session behavior, lead quality, and no campaign change that explains it | Apply narrow exclusions and prepare a report to Google |
| Ongoing attack | The pattern keeps coming back and costs real budget | Add click-level monitoring, clean up conversions, keep exclusions documented |
The ladder stops a team from jumping from a clue to an accusation. Notice that no level requires proving who clicked. Useful defense only requires proving which traffic pattern should stop receiving your budget.
Step 3: Exclude what you can prove
Google Ads supports excluding IP addresses, with a limit of 500 addresses or ranges per campaign. That's more than enough to remove an identified office network, and it's the right tool for a persistent, static-IP offender. Apply it with two eyes open. First, precision: block the addresses you have evidence for, not whole regions of shared infrastructure, because one IP rarely equals one person. Second, reach: manual IP lists can't follow the offender home, onto mobile data, or behind a VPN. Rotating residential proxies defeat static lists entirely. IP exclusions stop the lazy competitor. They inconvenience the determined one.
Step 4: Shrink the attack surface with targeting
Every targeting setting that tightens who can see your ads reduces what a hostile clicker can reach:
- Location options: target "Presence" rather than "Presence or interest," so people merely searching about your area don't trigger ads.
- Ad scheduling: if the hostile clicks cluster at known hours, bid down or pause those windows while you gather evidence.
- Negative keywords: cut the low-intent queries where junk clicks concentrate.
- Exclusion lists: apply your IP and placement exclusions account-wide through shared exclusion lists so a new campaign never launches unprotected.
None of this is fraud-specific. It's just good account hygiene that happens to starve bad actors of opportunities.
Step 5: Report it to Google and claim your credits
Google filters the invalid clicks it detects before billing, and credits invalid traffic it finds after your invoice in the next billing cycle. For what slipped through, request a review, generally within 60 days of the suspicious traffic, through the invalid traffic guidance and its invalid clicks contact form. Approved claims arrive as account credits, not cash. Google says the manual review typically takes several business days. Your Step 2 evidence file is what separates an approved claim from a form rejection. A strong request includes the account and campaigns, exact date and time ranges, click IDs (GCLIDs) where you have them, the IP or location patterns, the keywords hit, exports or screenshots, and a short explanation of why the traffic looks invalid. Add what you already ruled out from the lookalikes table: search terms, recent changes, tracking, placements and conversion lag. A request that explains the pattern gets further than one that only says conversions dropped. The full process, including what reviewers look for, is in our invalid click credits guide. Set expectations accordingly: credits recover some past damage. They don't give back the impression share you lost or clean the conversion data Smart Bidding already learned from, and they don't stop tomorrow's clicks; that's what Steps 3, 4, and 7 are for.
Step 6: Keep the legal option in its lane
Treat legal action as a last resort for large, provable damage; the legality section below and our guide to whether click fraud is illegal explain why.
Step 7: Automate the detection and the blocking
Everything above is manual: you notice, you investigate, you block, you re-notice next month. The structural fix is protection that watches every click in real time, scoring each click on 100+ device, network and behavior data points, recognizing returning devices even when their IP changes, and pushing IP exclusions to your campaigns automatically the moment a source crosses the threshold. That closes the two gaps manual defense always leaves: speed (blocking happens before the tenth click, not after the hundredth) and memory (an offender who returns on a new IP is recognized by device, and the new IP is excluded too). This is exactly what ClickFortify's real-time blocking and evidence trail were built for. See how ClickFortify works, and run your suspected waste through the ad fraud calculator to size the problem first.
Protect your conversion data while you fix it
Keep hostile traffic out of your conversion data, or Smart Bidding keeps paying for it after the clicks stop. Blocking sources protects tomorrow's budget. Cleaning conversions protects the model that decides where tomorrow's budget goes.
- Count qualified leads, not raw form fills. Import a qualified lead stage from your CRM as the primary goal, and keep form submissions as secondary.
- Remove spam from primary goals. A junk lead that counts as a conversion teaches the bidder to find more junk.
- Feed back lead outcomes. Enhanced conversions for leads and offline imports let Google see which clicks became customers.
- Watch sales acceptance by campaign. A sudden drop is often the first sign that bad traffic is reaching your forms.
Pair this with any exclusion work, and keep exclusions narrow enough that real buyers still get through. Our guide on how invalid traffic damages lead quality walks through the cleanup in detail.
What should you avoid?
Three tempting responses make things worse:
- Don't blanket-block regions you actually serve. Punishing a whole city to stop one office throws away real customers; surgical beats sweeping.
- Don't pause everything in a panic. Going dark hands the auction to the exact rival you suspect; tighten instead of retreating.
- Don't accuse anyone publicly without proof. Attribution is genuinely hard; a public accusation you can't back becomes their legal claim against you.
Should you click a competitor's ads back?
No. Retaliating puts you on the wrong side of the same rules you are relying on, and it probably will not even cost them money.
Google's invalid clicks definition covers manual clicks that increase an advertiser's costs. That is exactly what a revenge click is. Google says advertisers aren't charged for invalid clicks it detects, so a burst of repeat clicks from your office is the kind of pattern its filters are built to remove before the rival is ever billed. The likely result is no damage to them and a record of invalid activity from your network.
It also weakens your own position. Your evidence file, your credit claims, and any legal option depend on you being the injured party. If the rival can show the same pattern coming from you, every one of those gets harder. The legal exposure that applies to them would apply to you too.
The better use of the same energy is the plan above: document, exclude, tighten, claim, and automate.
Is competitor click fraud illegal?
It can be, but small-scale competitor clicking is rarely prosecuted or successfully sued. Most places have no law that names click fraud as an offense. Civil cases against competitors have repeatedly failed on attribution (proving who clicked) and damages (proving a quantifiable loss). Large, automated schemes are a different matter and have been prosecuted under fraud statutes such as wire fraud in the United States. What changes the picture is scale: a script or paid click service running thousands of clicks leaves the volume, the money trail, and the evidence of intent that a court needs, while a rival clicking a few times a day leaves very little.
For most advertisers the practical answer is to treat it as a budget problem first. Keep the evidence file as if a lawyer might read it, and talk to one only when the damage is large, persistent, and provable. The legal guide walks through the real cases and outcomes.
How is competitor clicking different from brand bidding?
Advertisers often discover both at once and conflate them. A competitor bidding on your brand name is legal, and Google policy explicitly allows it. The responses there are trademark rules on ad text, brand campaigns, and auction pressure, covered in competitors bidding on your brand name. A competitor clicking your ads is invalid activity you can document, block, and claim credits for. Mixing them up leads to firing the wrong response at each. The two do compound, though: brand-term CPCs inflated by a bidding war make every fraudulent click on those terms more expensive, which is one more reason traffic quality and brand defense belong in the same weekly review.
What if it isn't a competitor after all?
A final calibration point, because honest diagnosis beats satisfying blame: many suspected competitor cases turn out to be automated traffic: bot farms, scrapers, and AI agents that hit high-CPC keywords for their own reasons and leave competitor-shaped fingerprints. The good news: the response plan is the same. Evidence, exclusions, tighter targeting, credit claims, and automated blocking work identically whether the clicker is a rival's intern or a botnet. The only step that changes is whether there's anyone to send the demand letter to.
What should you do next?
Competitors clicking your ads is real, common enough that Google names it in its invalid traffic policy, and impossible to prevent outright, but entirely possible to neutralize. Confirm the pattern before acting. Document as you go. Block what you can prove, tighten what you can control, claim what you're owed, and keep lawyers for the rare case that earns them. Then automate the whole loop, because the difference between a competitor who keeps clicking and one who gives up is simple: whether it still works. Make it stop working.
