After downloading the report use the Manual refund claims Google page. Below are our recommendation for the form fill (of course, if you have any specific subjects you'd like to address, you're free to fill in the form as you see fit):
Contact name: Submit your full name.
Contact email: The email at which you would like to receive Google’s response.
Account Login Email ID: This should be your registered Google Ads login email and should be filled in automatically.
Google Ads Customer ID: Your Google Ads client ID. Make sure NOT to submit your MCC ID in case you are logged in through an MCC account currently.
Date when the suspicious activity began: Start date of the report.
Date when suspicious activity ended: End date of the report.
Campaigns affected: All.
Add additional: All.
Ad Groups affected: All.
Keywords affected: All.
Did you recently opt into the Google Display or Search Networks?: Answer accordingly.
Were any of your ads approved in the past month?: Answer accordingly.
Did you recently increase your budget or bids?: Answer accordingly.
Have you checked for invalid clicks in your account?: Answer accordingly, the default answer should be Yes.
Summary of the issue: “Please see the attached form for fraudulent activity and check our account”.
IP addresses: Leave empty, included in the report.
Suspicious sites: Leave empty.
Attach a copy: Upload the report that you have downloaded via ClickCease dashboard.
How would you like a Google expert to respond?: Email me.
Email CC: Submit your email address again or someone else’s who you would like to receive Google’s response.
If you have any questions about this process, feel free to reach out to our 24/7 chat support.