competitor-clicking-my-ads

Often, yes, and it is the first thing to rule out. Intake staff checking the ad is running, a marketing coordinator testing a landing page, or a partner searching the firm name all generate clicks you pay for. Exclude your office IP addresses, then look again after a week. If the pattern disappears, you have your answer and it cost you nothing.

Look at selectivity. Bots hit whatever they encounter, at higher volume, across all hours and all keywords. Targeted clicking concentrates on your most expensive terms, because that is the objective, and it usually follows a human schedule. If your waste is lopsided toward your priciest keywords while cheaper terms look clean, that asymmetry points away from automated traffic.

Yes, up to 500 IP addresses per campaign. It is worth doing for any source you can identify. Understand the limit, though: residential connections are reassigned, mobile traffic rotates through many addresses, and a VPN sidesteps the list completely. IP exclusion raises the effort required to keep clicking you. It does not close the door.

They tend to follow a work schedule: weekdays, business hours, often early in the day when your budget is still available. Genuine legal prospects search on a very different rhythm, including nights and weekends, because legal problems do not keep office hours. When your paid click volume matches someone's shift pattern rather than a crisis pattern, that contrast is worth investigating.

No. Your evidence is a behavioral pattern, not an identification, and a confrontation mostly tells the other side to change their approach. You lose the pattern you were tracking and gain nothing. Put the energy into excluding the traffic so the clicks stop costing you money, which works whether or not you ever learn who was responsible.

You probably cannot prove it to a standard that would satisfy you in court. Click data shows sources, timing, and behavior, not the identity of the person at the keyboard. What you can establish is that a defined slice of your traffic behaves in a way no prospective client would, and that is enough to justify blocking it. Blocking does not require proof of who.