Signs Your Competitors Are Clicking Your Google Ads: A Diagnostic Checklist

If you suspect a competitor is draining your Google Ads budget, start by pulling your click performance report and comparing it against Google's invalid clicks report. Look for clicks that cluster around your peak bidding hours, originate from a narrow set of IP addresses or ISPs, and produce zero conversions despite normal-looking click-through rates. These patterns — especially when they appear suddenly and persist across days — are the strongest indicators that a competitor is clicking your ads deliberately.

What competitor click fraud looks like in your data

Competitor click fraud doesn't announce itself. It mimics real traffic just well enough to pass Google's basic filters. The telltale signs appear when you cross-reference dimensions that fraudsters rarely spoof perfectly: time of day, geographic precision, device consistency, and post-click behavior.

You'll often see a spike in clicks from a single city or metro area where you have no physical presence and no historical conversions. The clicks arrive in tight bursts — five to ten minutes apart — during the hours your competitor's team is at their desks. Device fingerprints repeat: same browser version, same screen resolution, same operating system. And critically, the on-site behavior is hollow: zero scroll depth, no mouse movement, session durations under three seconds.

Contrast this with legitimate traffic from the same region. Real visitors vary in device, browser, and time on site. They scroll, they click internal links, they sometimes convert. Competitor clicks are sterile by comparison.

The diagnostic sequence: step-by-step check

1. Pull the click performance report in Google Ads (Reports → Predefined → Basic → Click Performance). Segment by day, hour, device, and "Most specific location."
2. Overlay Google's invalid clicks report (Tools → Billing → Invalid clicks). Note the gap: Google's automated filters catch less than 50% of invalid traffic, so the remainder is sophisticated invalid traffic (SIVT) you must document yourself.
3. Filter for anomalies: days where clicks jump 30%+ without a bid change, new keyword, or ad edit. Isolate those days.
4. Drill into the anomalous days by hour. Competitor clicks often cluster 9 AM–5 PM in the competitor's time zone, not yours.
5. Check ISP and organization data in Google Analytics (Acquisition → All Traffic → Source/Medium → Secondary dimension: Network Domain). Corporate ISPs, hosting providers, or VPN exit nodes are red flags.
6. Review on-site behavior for those sessions: bounce rate near 100%, average session duration under 5 seconds, pages per session = 1.00.
7. Correlate with conversion data. If clicks rose but conversions flatlined or dropped, and your landing page didn't change, the extra clicks are almost certainly non-human or non-genuine.

Each step narrows the suspect pool. By step seven, you either have a clear pattern pointing to a competitor's office network or you've ruled out the most common fraud signatures.

Key signals that point to competitors specifically

Not all invalid traffic comes from competitors. Click farms, scraper bots, and accidental clicks leave different fingerprints. Here's how to tell the difference:

• Business-hours alignment: Competitor clicks follow a 9-to-5 rhythm in a specific time zone. Botnets and click farms run 24/7 or in random bursts.
• Keyword precision: Competitors target your brand terms and high-value non-brand keywords. Scrapers hit everything; click farms hit whatever pays.
• Geographic tightness: Clicks originate from the competitor's known office location or a nearby coworking space. Use IP geolocation tools to verify.
• No conversion attempts: Competitors don't fill forms or start checkouts. Click-farm workers sometimes go through motions to mimic conversions.
• Reaction to bid changes: If you pause a keyword and the suspicious clicks stop immediately, the clicker is monitoring your live ads — a strong competitor signal.

One signal alone isn't proof. The diagnostic value comes from the combination: business-hours clicks from a corporate ISP in the competitor's city, on your brand terms, with zero on-site engagement.

How to gather evidence Google will accept

Google's refund process for invalid clicks requires "sufficient evidence" that the clicks were illegitimate. The platform's own documentation emphasizes that automated filters catch less than half of invalid traffic, leaving advertisers to document the rest.

Evidence that carries weight:

• Click timestamps matched to your competitor's business hours and time zone
• IP addresses resolving to the competitor's known corporate network, ISP, or office building
• Behavioral logs showing zero mouse movement, zero scroll, superhuman click speeds (under 1 millisecond between page load and click)
• GCLID (Google Click Identifier) captures for each suspicious click, tied to session recordings or client-side behavioral data
• A written summary explaining the pattern, why it's not explained by campaign changes, seasonality, or targeting errors

Client-side tracking — JavaScript that records mouse tremor, scroll depth, pointer path linearity, and input timing — produces the behavioral evidence Google's server-side logs cannot. Tools that capture GCLIDs alongside this behavioral data let you build the audit-ready reports Google's billing team expects.

What Google's automated filters catch (and miss)

Google's invalid traffic detection runs on three layers: proactive filters (real-time), reactive filters (post-click analysis), and manual reviews. Together they catch basic fraud: known botnet IPs, data-center traffic, obvious click patterns.

They miss what the industry calls sophisticated invalid traffic (SIVT): residential proxy networks that route clicks through real household IPs, competitor employees clicking from office networks, click farms using actual mobile devices, and bots that simulate human mouse movement and scroll behavior.

According to aggregated audit data, the average invalid click rate across all Google Ads campaigns is 11% to 14%. In high-CPC verticals — legal, insurance, B2B SaaS — rates climb higher. Google's own filters catch less than 50% of this traffic. The gap is where your budget bleeds and where a manual refund claim becomes necessary.

When to use third-party detection vs. manual review

Manual review works if you have one or two campaigns, low spend, and time to pull reports weekly. It breaks down when:

• You manage multiple accounts or client accounts
• Monthly spend exceeds $10,000 (the volume of data becomes unmanageable in spreadsheets)
• You need continuous monitoring — fraud patterns shift daily
• You want to block IPs in real time, not after the fact
• You need audit-ready reports formatted for Google's dispute process

Third-party detection tools automate the diagnostic sequence above: they capture GCLIDs, record client-side behavior, flag anomalies in real time, and generate the refund dispute packages Google accepts. The trade-off is cost and implementation effort. For accounts under $10K/month, a weekly manual check using the sequence in this article is often sufficient. Above that threshold, automation pays for itself in recovered spend and time saved.

Limitations: what this diagnostic cannot prove

Even a perfect diagnostic sequence has limits you should acknowledge before filing a dispute:

• Attribution certainty: You can prove the clicks are invalid. You cannot definitively prove who clicked them. Google's refund policy covers invalid clicks regardless of source; naming a competitor in your claim is optional and doesn't change the evidence standard.
• Retroactive reach: Google typically considers refund requests for the past 60–90 days. Older clicks are rarely eligible, though some third-party tools can recover spend dating back to 2017 by leveraging platform dispute processes.
• False positives: Aggressive IP blocking can exclude legitimate corporate traffic (e.g., your own employees, partners, or prospects researching from office networks). Always verify before adding exclusions.
• Platform policy changes: Google's invalid traffic definitions and refund thresholds evolve. What qualified last year may not qualify next quarter.

Treat the diagnostic as a probability engine, not a courtroom verdict. The goal is to meet Google's "sufficient evidence" bar, not to achieve metaphysical certainty.

Key facts

Metric	Value	Source
Average invalid click rate (all Google Ads campaigns)	11%–14%	BotRefund audit data, third-party studies
Google automated filter catch rate	Less than 50% of invalid traffic	BotRefund audit data
Global digital ad fraud projection (2026)	Over $100 billion	Juniper Research
Invalid traffic share of programmatic spend	10%–30%	World Federation of Advertisers
Google Search invalid click rate range	4% (well-protected) to 35%+ (high-CPC competitive)	Industry studies
Non-human share of total internet traffic	43%	Imperva Bad Bot Report
Typical monthly loss at $50K spend	$5,000–$15,000	Industry estimates
Refund success rate for high-volume advertisers (BotRefund)	83%	BotRefund platform data

FAQ

How quickly should I act when I spot suspicious clicks?

Start the diagnostic sequence within 48 hours. Google's refund window is typically 60–90 days, but evidence degrades: IP logs rotate, session recordings expire, and GCLID-to-session mapping becomes harder the longer you wait.

Can I just block the suspicious IPs in Google Ads and move on?

You can, but blocking alone doesn't recover past spend. It also risks blocking legitimate users if the IP is a shared corporate proxy or VPN. Use IP exclusions as a stopgap while you build a refund case.

What's the difference between competitor clicks and click-farm traffic?

Competitor clicks follow business hours in a specific location, target your high-value keywords, and show zero conversion intent. Click-farm traffic often runs 24/7, hits a broader keyword set, and sometimes mimics conversion steps (scrolling, form fills) to evade detection.

Does Google tell me which clicks they've already filtered?

Yes. The Invalid Clicks report (Tools → Billing → Invalid clicks) shows clicks Google caught and credited automatically. Your diagnostic should focus on the clicks not in that report — the sophisticated invalid traffic Google missed.

How much budget should I expect to recover?

Recovery varies. Industry averages suggest 10–30% of spend is invalid; Google's filters catch roughly half. High-volume advertisers using behavioral evidence and formal disputes see approval rates around 83%. Your actual recovery depends on evidence quality, spend volume, and vertical.

What if the competitor uses residential proxies or mobile devices?

Residential proxies and real devices defeat IP-based detection. That's why behavioral signals — mouse tremor, pointer path linearity, input speed, scroll depth — matter more than IP alone. Client-side tracking captures these signals regardless of IP origin.

Is it worth pursuing a refund for small accounts?

If you spend under $5,000/month, the time cost of a manual dispute may exceed the recovery. Focus on prevention: add IP exclusions for clear patterns, enable Google's auto-tagging, and monitor weekly. For larger accounts, the ROI on evidence gathering and dispute filing is strongly positive.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Competitor Click Fraud in Google Ads: Signs and Defenses | ...
• Signs of Competitor Click Fraud in Google Ads and How to Stop Them
• How to Spot and Block Competitor Clicks on Your Google Ads | ...

Learn more

Visit the website for more information.