For local service businesses — plumbers, AC repair, auto repair, appliance repair — the most common click fraud isn't a botnet. It's a competitor across town clicking your ad every morning with their coffee.
If you can identify the IP, add it in Google Ads under campaign settings → IP exclusions. The problems: you need tracking to find the IP in the first place, mobile IPs change frequently, and a determined competitor just switches to a VPN.
Click-fraud software tracks every ad click with a device fingerprint. When a competitor's pattern is confirmed — repeat clicks, instant bounces, fingerprint matches across IP changes — the IP is excluded automatically. When they switch to a VPN, the VPN is flagged. When they switch devices, the new pattern is caught within a few clicks. They get blocked faster than they can rotate, and most simply give up.
You can file an invalid-click report and may receive credits for clicks Google deems invalid. In practice, Google rarely confirms competitor clicking from auction data alone — which is exactly why advertisers run their own landing-page tracking as evidence and protection.