We had a similar issue with Reddit, spent $500 and got a lot of clicks - none of them ever did anything else, not even by mistake. When we reported this behavior to Reddit, the rep who helped us set up the campaign just vanished. No answer. After a while, another rep came out and asked if we were interested in advertising on Reddit. Explained the situation and... poof! this other rep disappeared too. My feeling is th…
Google itself forces advertisers into fraud-friendly products like PMAX. Then, when you detect the fraud, the hapless account rep says "ummm... maybe try using IP exclusion lists?" (Like one of the comments below). Google, with all the data it collects on people who click the ads, wants you to catch sophisticated fraud networks by manually building up IP blocklists. Yeah right.
And the victim of this entire ecosystem is your clever YC startup.