Written by Jorge Argota · Legal Marketing · United States
So I had this PI firm in South Florida and they were spending $15,000 a month on Google Ads and some days they’d get zero intakes. Not low intakes. Zero. And the impression share was high and the click volume looked normal and everything in the dashboard said the campaign was healthy. I pulled the forensic logs and found that 40 to 60% of the clicks on their branded campaigns were coming from the same handful of devices rotating through different IP addresses.
Other lawyers were clicking their ads to drain the daily budget by 10 AM so their own ads would run unopposed the rest of the day. The direct ad waste was around $6,000 a month in clicks that were never going to become clients. But the real damage was the pipeline: that $6,000 in stolen budget should have generated roughly 40 legitimate clicks, and in PI even one of those converting to a signed case is $25,000 to $100,000 in settlement value missing from the firm’s revenue. Over a quarter they were hemorrhaging six figures in lost cases, not just the ad spend itself.
25% of clicks on legal Google Ads are fraudulent. Law firms are the third most targeted industry globally. At $150 per click, ten fake clicks a day is $1,500 a week in direct ad waste and potentially $50,000 or more in lost case revenue per month.
I tell that story because every managing partner I talk to thinks click fraud is a bot problem from Russia or something and it’s not. The biggest source in legal PPC is the attorney down the street whose paralegal clicks your ad six times before lunch.
Who’s actually clicking your ads
COMPETITOR MALICE · 18 to 25% of fraud
Other lawyers clicking your ads from their office, usually between 8 AM and 10 AM. They use VPNs, rotating IPs, and their staff’s personal phones toggling airplane mode to get a fresh IP every few minutes. The goal is to exhaust your $500 daily budget before noon so their ads run unopposed the rest of the day at lower bids. During the pandemic this spiked 30% because firms had less work and more time to be petty about it. How to spot it: look for high-velocity clicks in your logs; same device ID, different IP, hitting your “Call Now” button three times in 60 seconds. That pattern is a competitor, not a client.
CLICK FARMS AND BOT NETWORKS
Offshore operations targeting legal ads because the CPC is so high that even a handful of fake clicks generates real revenue for the networks hosting the placements. Mobile fraud is up 62% and the new bots replicate scroll delays, cursor hesitation, and varied dwell times so they pass Google’s basic behavioral checks. Google’s native filters catch less than 40% of this stuff which means most of it sails right through.
MALWARE AND GHOST CLICKS
Hijacked home computers that generate clicks from what looks like a real person at a real local IP address inside your geo-fence. The IP is real, the device is real, the only thing fake is the intent behind the click. This is why IP blocking alone is basically useless in 2026 and why device fingerprinting matters more than anything else in your fraud detection stack.
What the tools cost and the pricing problem with ClickCease
The thing the review sites never mention: ClickCease bills based on total website visitors, not paid clicks. Their Standard plan caps at 5,000 visits and the Pro caps at 10,000 to 40,000 depending on the tier. All visits count; organic, direct, referral, everything. So if your blog generates 20,000 organic readers a month and you only bought 500 paid clicks, you blow through the cap in the first week on traffic that has nothing to do with fraud protection and get forced into the $349/mo Advanced tier. You’re being penalized for having good SEO, which is honestly kind of backwards.
| Platform | What They Bill | $15K budget | $50K budget | Legal advantage |
|---|---|---|---|---|
| ClickCease | All traffic incl organic | $149 | $349 | AdSpy competitor intel; session recordings |
| Click Guardian | Ad spend brackets | $99 | $189 | Transparent flat pricing; unlimited domains at $379 |
| Fraud Blocker | Paid clicks only | $69 | $109 | Doesn’t charge for organic visitors; best if strong SEO |
| ClickPatrol | Session volume | ~$64 | ~$162 | Four protection modules; GDPR compliant |
| Lunio | Custom enterprise | N/A | Custom | Cross-channel: Meta, LinkedIn, TikTok, Reddit |
If your firm has strong organic traffic and you’re primarily on Google Search, Fraud Blocker or Click Guardian will run you 50 to 70% less than ClickCease for functionally the same protection. If you’re running multi-platform across Google and Meta and LinkedIn, Lunio is the only option that syncs threat data across all of them so a bot caught on one network gets blocked on every other network automatically.
Quick diagnostic: check your organic-to-paid ratio
Log into Google Analytics and compare your organic traffic to your paid traffic. If organic outnumbers paid by 5:1 or more, ClickCease’s visit-based billing will cost you two to three times what a click-based alternative would. A firm pulling 20,000 organic visitors and 500 paid clicks per month burns through ClickCease’s Pro cap in the first week on traffic that has nothing to do with fraud protection.
The five settings I change on day one of every legal account
None of these tools work on default settings. They ship calibrated for ecommerce where a click costs $2 and the fraud thresholds are way too loose for legal. Here’s what I change immediately.
Getting your money back from Google
What gets rejected
“We think competitors are clicking our ads.” Subjective claims without forensic data. Google’s traffic quality team won’t open an investigation based on suspicion, poor campaign performance, or low conversion rates.
What gets approved
A .csv export containing timestamps, IP subnets, and GCLID (Google Click IDs) showing behavioral anomalies like zero-second dwell time, repetitive micro-interactions, and device spoofing indicators. Pair that with a third-party forensic report from ClickCease or Fraud Blocker. Processing takes about two weeks. Credits show up as “invalid traffic adjustments” in your account, not cash refunds.
The direct ROI math on any fraud tool is straightforward: a $100 monthly subscription that gives you the forensic documentation to recover even two fraudulent $150 clicks through Google’s credit system pays for itself the first week. But the real value isn’t the ad credits; it’s the protected pipeline. That Florida firm I mentioned didn’t just get a few thousand back in invalid traffic adjustments from Google. They recovered the 40% of their budget that was being stolen, which meant those clicks actually went to real prospects, which meant cases started coming in again. The protected pipeline value over a quarter was well into six figures when you count the cases that would have gone to the competitor whose ads were running unopposed every afternoon. The expensive keywords page covers the broader fraud exposure by practice area and the spend thresholds where protection becomes mathematically required.
I audit the search terms report, the IP logs, and the conversion data to find where the waste lives. If it’s fraud I configure the tool and file the refund claim. If it’s not fraud I tell you that too. Request a fraud audit.
Jorge Argota · 10 years in legal marketing. I configure fraud detection for PI firms in South Florida where competitor clicking is just part of the landscape. Full bio.
Related: Fraud Exposure by Practice Area · 350+ Negative Keywords · CPC Benchmarks · Cost Per Signed Case
