When advertisers discover click fraud draining their budget, the first question is usually practical: how do I stop it? The second question comes right after: is this actually illegal, and can I do something about it legally?
The honest answer requires looking at what courts have actually decided. The record includes a $90 million settlement with Google, a fraud operator sentenced to a decade in federal prison, a jury that acquitted an alleged botnet operator of every felony, and a $2.3 million click fraud verdict that was reduced to zero on appeal.
This guide walks through the real cases and what they mean for your options.
The Short Answer: Illegal Conduct, but No "Click Fraud Law"
No US federal or state statute criminalizes click fraud by name. Prosecutors and plaintiffs reach it through existing laws:
| Law | What it covers | How it has worked in practice |
|---|---|---|
| Wire fraud (18 U.S.C. § 1343) | Schemes to defraud using electronic communications | The workhorse for criminal cases. Convicted the Methbot operator, who received 10 years. |
| Computer Fraud and Abuse Act (18 U.S.C. § 1030) | Unauthorized computer access | Works against botnets and hacking. Repeatedly fails against competitors who simply click public ads. |
| Lanham Act § 43(a) | False designation of origin, false advertising | Viable in narrow fact patterns, but budget-draining clicks alone are not 'commercial advertising.' |
| State unfair competition laws | Unfair or fraudulent business practices | Often the strongest surviving civil claims, but cases tend to settle quietly rather than set precedent. |
| Money laundering and identity theft statutes | Handling fraud proceeds, using stolen identities | Added in large criminal indictments such as the 3ve case. |
Outside the US, the UK's Fraud Act 2006 (fraud by false representation) and Computer Misuse Act 1990 apply in principle, though we found no verified UK click fraud prosecution to date.
The pattern across all of it: the law can reach click fraud, but only when the evidence is specific and the scale justifies the effort. That distinction runs through every case below.
Criminal Cases: When Click Fraud Led to Prison
Methbot and 3ve: the "King of Fraud" gets 10 years
The largest ad fraud prosecution to date began with a 13-count indictment unsealed in the Eastern District of New York in November 2018, charging eight defendants behind the Methbot and 3ve operations with wire fraud, computer intrusion, aggravated identity theft, and money laundering.
Methbot ran from roughly 2014 to 2016. Its operator, Aleksandr Zhukov, rented around 2,000 datacenter servers that simulated human behavior (mouse movements, scrolling, fake sessions) across more than 6,000 spoofed domains impersonating premium publishers. The scheme billed US advertisers more than $7 million for ads no human ever saw. The related 3ve operation caused losses above $29 million.
Zhukov was arrested in Bulgaria, extradited, and convicted by a jury in 2021 of wire fraud and money laundering charges. He was sentenced to 10 years in prison and ordered to pay $3,827,493.
What it proves: large-scale ad fraud is prosecutable as ordinary wire fraud. What it also proves: the takedown required an FBI-led coalition of ad-tech companies, and five of the eight defendants were never in US custody. This is what enforcement looks like at its absolute peak, and it has not been repeated since.
United States v. Gasperini: the caution for prosecutors
In 2017, Italian national Fabio Gasperini became the first click fraud defendant to face a US jury. Prosecutors alleged he ran a botnet of more than 150,000 compromised devices for an auto-clicking scheme, charging him with felony computer intrusion, wire fraud, and money laundering (up to 70 years of exposure).
The jury acquitted him of every felony. He was convicted only of misdemeanor computer intrusion and sentenced to the one-year statutory maximum plus a $100,000 fine, an outcome affirmed on appeal.
This case is frequently miscited as a felony click fraud conviction. It was the opposite: a demonstration that proving click fraud beyond a reasonable doubt to a jury is genuinely hard, even with a botnet in evidence.
The click farm gray zone
In 2017, Thai police raided an operation near the Cambodian border and found three operators, roughly 500 phones on racks, and over 340,000 SIM cards being used to inflate engagement metrics. The notable legal detail: the operators were charged with working without permits and customs violations, not fraud. In many jurisdictions, manually clicking things for pay is not clearly a crime at all.
That gray zone matters for advertisers, because a meaningful share of paid-click abuse comes from exactly this kind of operation, sitting outside any realistic enforcement reach.
Civil Lawsuits: What Happens When Advertisers Sue
The civil record is where expectations need the most adjustment. Here are the cases that define it:
| Case | Year | Core claim | Outcome |
|---|---|---|---|
| Lane's Gifts v. Google | 2006 | Google billed advertisers for invalid clicks | $90M settlement, paid almost entirely in ad credits |
| Satmodo v. Whenever Communications | 2017–2019 | Competitor clicked ads via rotating proxies | Federal computer-crime claims dismissed; unfair-competition claim survived; case resolved and dismissed with prejudice |
| Motogolf v. Top Shelf Golf | 2020–2022 | Competitor systematically exhausted ad budget | Advertiser lost: CFAA and Lanham Act claims failed |
| WickFire v. TriMax | 2014–2021 | Competitor click fraud, tortious interference | Jury awarded $2.3M; appeals court reversed every dollar |
| Facebook v. LionMobi & JediMobi | 2019 | App-based click injection fraud | Reportedly settled with damages and platform bans |
| Uber v. Phunware | 2017–2020 | Ad network billed for fake app installs | Settled for $6 million |
| Google v. BadBox 2.0 operators | 2025 | Botnet of 10M+ infected devices used for ad fraud | Ongoing: Google seeking to dismantle the operation |
Lane's Gifts v. Google: the $90 million template
The landmark. In 2005, advertisers filed a class action in Arkansas alleging Google billed them for invalid and fraudulent clicks. Google settled in 2006 for $90 million, but roughly a third went to attorneys' fees, and the rest was paid as advertising credits, not cash, working out to about $4.50 per $1,000 spent. Google admitted no liability, and an independent report it commissioned concluded its invalid-click detection was "reasonable."
Twenty years later, this is still the template: platform recourse means credits, not damages. A related chapter closed in 2025, when a long-running class action over Google's click billing practices (alleging improper Smart Pricing discounts and charges for clicks outside geo-targets) received final approval of a $100 million settlement. That case concerned how Google billed for clicks rather than third-party fraud, but the shape of the outcome was the same: a long fight, a fund, no admission.
Motogolf v. Top Shelf Golf: the door that closed
If you remember one civil case, make it this one. Motogolf, an online golf retailer, sued a competitor in 2020 alleging a coordinated campaign of clicking its Google ads to exhaust its budget and knock its ads off the page. It brought federal computer-crime, Lanham Act, racketeering, and tortious interference claims.
The court dismissed the CFAA claim with reasoning that now dominates this area: clicking a publicly accessible ad is not access "without authorization," no matter how malicious the intent. The Lanham Act claim failed too, and judgment was ultimately entered for the defendants.
For advertisers, the lesson is blunt: the most obvious federal statute mostly does not cover competitor click fraud.
WickFire v. TriMax: winning the verdict, losing the money
WickFire, a performance marketing firm, convinced a Texas jury that a competitor had committed click fraud against it and won $2.3 million in damages for tortious interference. The Fifth Circuit then reversed every dollar: no evidence any specific contract was actually breached, and the alternative damages theory was too speculative. Net recovery: zero.
The appeals court did confirm that click-fraud-adjacent conduct can support a Lanham Act claim in the right fact pattern. But the case is the clearest illustration of where these lawsuits die: not on whether fraud happened, but on proving exactly what it cost.
Satmodo v. Whenever Communications: the realistic middle path
Satmodo, a satellite phone retailer, documented a competitor clicking its ads through rotating proxies (around 96 clicks within minutes) and sued in 2017. The court dismissed the federal computer-crime claims but allowed a California unfair competition theory to proceed, observing that click fraud can constitute unfair conduct that "violates the spirit" of competition law. The case was resolved and dismissed with prejudice in 2019, consistent with a settlement whose terms were never made public.
This is the realistic best case for an advertiser with strong evidence: survive on state unfair-competition claims, then settle quietly.
Platforms as plaintiffs
The most active click fraud litigants today are the platforms themselves. Facebook sued app developers LionMobi and JediMobi in 2019 over click injection fraud (apps that generated fake ad clicks from users' phones), in a case that reportedly settled with damages and permanent bans. Uber sued ad network Phunware over billing for fake app installs and settled for $6 million in 2020. And in July 2025, Google filed suit against the operators of BadBox 2.0, a botnet of more than 10 million infected Android devices used for large-scale ad fraud and residential proxy resale.
Platform suits protect the ecosystem, and that helps advertisers indirectly. But none of them put money back in an individual advertiser's account.
Why Click Fraud Cases Are So Rare
Across two decades of cases, four barriers repeat:
- Attribution: rotating proxies, VPNs, and residential IP networks make it extremely hard to prove who clicked without subpoena power
- Damages: courts demand non-speculative numbers; a jury's $2.3M click fraud award was zeroed out for exactly this reason
- The CFAA doorway is closed: clicking a public ad is not 'unauthorized access,' so the most natural federal claim usually fails
- Scale threshold: criminal enforcement has only materialized at Methbot scale, with FBI involvement and an industry coalition, and not since 2018
That last point deserves emphasis. There has been no major US federal ad fraud enforcement action since the 3ve takedown in 2018, a gap prominent enough that in March 2025, Senator Mark Warner publicly pressed the FTC and DOJ to address "rampant fraud in digital advertising." For everyday advertisers, no cavalry is coming.
What You Can Realistically Do
The legal record points to a clear hierarchy of options:
| Route | What you can get | What it requires |
|---|---|---|
| Google invalid activity review | Account credits for invalid clicks | A claim generally within 60 days of the traffic, with specific evidence: timestamps, campaigns, click IDs, IP patterns |
| Cease-and-desist letter | Often stops small-scale competitor abuse | Documented click patterns tied to a plausible source |
| State unfair-competition suit | Settlement leverage, possible injunction | Forensic evidence attributing clicks to a specific actor, plus quantified losses |
| Criminal referral | Realistic only for large organized fraud | Methbot-scale losses and law-enforcement interest |
| Real-time protection | Stops the waste as it happens | Click-level monitoring and automated blocking |
Two practical notes on the Google route. First, approved invalid-click claims are paid as ad credits, never cash; that has been true since Lane's Gifts. Second, the review window is short, generally 60 days, so evidence collection cannot wait until you are certain. Our guide to recovering invalid click credits covers the process step by step.
If you suspect a competitor specifically, build the evidence file before doing anything else:
- Dates, timestamps, and click IDs for every suspicious click
- Campaigns, keywords, and placements affected
- IP addresses, networks, and device patterns, especially repeats
- Session behavior: duration, pages viewed, engagement
- Quantified impact: wasted spend, budget exhaustion windows, lost impression share
- A clean timeline you could hand to a lawyer or a platform review team
We cover the attribution problem in detail in how to prove competitor click fraud, including why patterns matter more than motives. For firms whose clicks are among the most expensive in search, law firm click fraud in Google Ads covers the intake checks to run before treating a rival firm as the cause.
Prevention Beats Litigation
Here is the uncomfortable math the cases teach. Lane's Gifts took a year to settle and paid out in credits. WickFire litigated for seven years and recovered nothing. Motogolf lost outright. Meanwhile, every one of those advertisers kept paying for invalid clicks while their cases moved.
The legal system treats click fraud as it treats most commercial harms: slowly, expensively, and only with proof. Real-time click fraud protection inverts that equation: it blocks the suspicious source in the moment, and it generates exactly the click-level evidence file (IPs, timestamps, patterns, session behavior) that both Google's review team and any future legal action would require.
In other words, protection is not the alternative to your legal options. It is what makes them usable.
If you are currently watching suspicious clicks drain a campaign, start with our guide to how click fraud works, document what you are seeing, and file for invalid activity credits inside the 60-day window while the evidence is fresh.
Related Guides
Protect your Google Ads and Meta budget
ClickFortify scores every paid click in real time, excludes bots, click farms and repeat offenders automatically, and keeps fake conversions out of Smart Bidding and Meta CAPI.
Try it on your own account
See what ClickFortify flags in your first week. No credit card required.
Frequently Asked Questions
Is click fraud illegal in the United States?
There is no statute that criminalizes click fraud by name. Large-scale operators have been prosecuted under existing laws such as wire fraud and computer intrusion statutes, and the Methbot operator received a 10-year sentence. Small-scale click fraud, such as a competitor clicking your ads, is much harder to reach legally.
Can I sue a competitor for clicking on my ads?
You can, but the track record is discouraging. Federal computer-crime claims have repeatedly failed because clicking a publicly visible ad is not unauthorized access, and even a jury verdict for click fraud was reversed on appeal for lack of provable damages. State unfair-competition claims have survived early motions, but most cases end in quiet settlements.
Has anyone gone to prison for click fraud?
Yes. Aleksandr Zhukov, operator of the Methbot ad fraud scheme, was convicted of wire fraud and money laundering in 2021, sentenced to 10 years in prison, and ordered to pay $3,827,493. Prosecutions at this scale are rare and required an FBI-led industry coalition.
Can I get money back from Google for invalid clicks?
Google filters invalid clicks automatically and lets advertisers request a manual review of suspicious activity, generally within 60 days of the traffic. Approved claims are paid as account credits, not cash refunds. Detailed evidence such as click timestamps, IPs, and campaign data improves the outcome.
What evidence do I need to prove click fraud?
Courts and platform review teams both want specifics: dates and timestamps, campaigns and keywords affected, click IDs, IP addresses and network patterns, session behavior, and quantified financial impact. Vague suspicion of a competitor is not enough; the cases that fail usually fail on attribution and damages.
