Ad fraud

Ad fraud is the use of fake viewers, fake clicks or fake app installs to collect the money that advertisers pay for real ones. Most of it is done by bots, which are programs that pretend to be people. Online, advertisers pay for each thousand times an ad is shown, counted in impressions, or for each click or each app install. So anyone who can create impressions, clicks or installs that look real can be paid for them. The industry calls such traffic invalid traffic, or IVT.

Here is how it works in general. A fraudster sets up a website or an app, or plants hidden software on other people's phones and computers. The fraudster offers the ad space on that site or app for sale, often through an SSP, the publisher's selling software, or through an ad network. Bots then open the pages and load the ads, or click on them, thousands of times a minute. The advertiser's bidding software sees what looks like real readers, and pays for them. The money passes through the ad platforms to the fraudster. Some tricks need no bots at all. In ad stacking, several ads are placed one on top of another, so that only the top one can be seen, but all of them are counted. In domain spoofing, a little-known site pretends to be a well-known news site, so that its ad space sells at a higher price.

Here is how it is caught. Software checks each impression for signs of a bot: a device whose screen is never touched, thousands of visits from one data centre, or clicks that come faster than a person could make them. Ad verification tools run these checks for advertisers, and the platforms that sell ad space run their own. A publisher also puts a short file called ads.txt on its own website. It lists the companies allowed to sell that publisher's ad space, so a buyer can tell when a spoofed site is pretending to be it.

Take, for example, an app maker paying a mobile ad network for each new install. A fraud app on the same phone can fake a click on an ad just before a real install, to claim the fee for that install. A mobile measurement partner rejects installs whose click came only seconds before.

Consider a video ad bought for smart TVs. Fraudsters can send fake traffic from servers that claim to be TV apps, so that the ad is counted as shown on screens that do not exist.

Say an advertiser sees thousands of clicks arrive between 2 a.m. and 4 a.m. from one small set of devices, and no sales. That pattern is a common sign of bots.

How is ad fraud different from the problem that bot management solves? Bot management protects a website from bots that attack it, such as bots that copy its prices or try stolen passwords. In ad fraud, the bots are usually sent by the site's own owner, or by a fraudster who controls the site, to collect advertisers' money. The site gains from them, and the advertiser loses.