Special Episode - Digital Ad Fraud 101

Ad Fraud is costing the digital marketing industry money. Lots of money. And anyone using online advertising in any form can be affected. 

But what exactly is Ad Fraud and what can you do about it? 

In this special episode of The Digital Distillery Podcast we take a look at some of the most common types of Ad Fraud, how it affects tradition and programmatic advertising online, and what you can do to protect yourself from this deviant behaviour. 

This episode is brought to you as always by The Digital Distillery.

If you would like to get in touch with us you can head to our website or email podcast@the-digital-distillery.com

You can follow us on:
Facebook, Twitter, Instagram & LinkedIn

Written, Produced & Engineered by Phil McDowell
Executive Producer: Nadia Koski
Project Leads: Dennis Kirschner

Transcript

Welcome to this special episode of the Digital Distillery Podcast where we take you for a short sharp plunge into the cold dark world of digital ad-fraud.

If you joined us for our programmatic episode, then you likely got the idea that this is a big, important and pretty interesting topic and thus in need of a special episode. I got a chance to talk to Senior Vice President of ShowHeroes Group Kay Schneider, who, through a storied career in the digital ad space, happens to know a thing or three about the topic.

Now, I’m going to break things down as follows so you can jump around to the various sections if you like.

First I’ll go over a broad overview of what digital ad fraud is and the broad impact that it currently has on the industry and as usual a big thanks to IAB Europe for their impeccable reporting on industry stats.

Then we will go over some of the different types of digital ad fraud that exist, 

And how they work.

Next is, in line with episode 2, how they affect programmatic advertising specifically and wrapping up with some tips on how you can recognise and identify ad fraud as well as what you can do to protect yourself from it.

So in its most basic form, ad fraud is the malicious practice of inflating impressions, clicks or conversion data for financial gain, and in doing so, wasting an advertisers budget.

It can be committed by cyber criminals alone or in a group like in the case of the Russian criminal group AFK13 who were reportedly making between 3 and 5 million dollars a day scamming companies by managing to fake video views creating URL’s that appeared to belong to big name publishers like ESPN or Vogue. 

But it also can be committed by large, dodgy organisations seeking an unfair advantage over their competitors.

Regardless of the perpetrator, the result is always the same; money is wasted on ad’s that are never seen by their intended audiences. It costs a lot of money, in fact it is predicted by the world federation of advertisers to cost as much as 50 billion dollars per year by 2025.

Sometimes called IVT, or Invalid traffic, the digital ad fraud landscape is constantly changing and evolving in an arms race like fashion as fraudsters and the protections front go head to head.

So what exactly are these different approaches that fraudsters take for their dastardly endeavours.

Lets go through some of the most common types of IVT

Click Fraud involves individuals or bots deliberately clicking on an advertisers pay-per-click (PPC) ad with no intention of actually buying the product. And because these clicks create such a direct false impression of the relationship between clicks and purchases, it's one of the quickest and most efficient way ad spend can be wasted.

Domain Spoofing occurs when and fraudster masquerades their fake site as a legitimate, and usually highly sought after one, like in the case of AFK13. They then trick the advertisers into paying premium prices for low quality ad space.

This is similarly done with app installs in whats called SDK spoofing and in one infamous case, a malware program called ‘Drainerbot’ which was designed to generate secret video ad views, was downloaded as many as 10 million times before being found out and shut down.

Ad injection is where fraudulent ads are placed on publisher’s websites without their knowledge and either replace the website’s existing ads or position themselves right next to genuine ones.

Its usually conducted through compromised browser extensions and plugins and so can be really difficult to detect. This is because many popular security tools focus on server side monitoring while injected ads are inserted through the client side.

Ad Stacking

Now perhaps the best way to describe this is the old adage ‘nothing is as it seems’.

This trick is where fraudsters place multiple ad’s visually underneath legitimate ones so that they collect impressions when the real one is clicked.

Pixel Stuffing 

Now this one tickled me for some reason, maybe because it’s so simply devious, but pixels stuffing is the practice of creating an ad of some sort you want clicked, and virtually stuffing it into a tiny space, like a pixel sized tiny space. This allows fraudsters to place heaps of ads on a website and get impressions to be recorded through unrelated activity, since the ads themselves are pretty much invisible. 

Location masking or geo masking is where take low quality traffic of some kind, and disguise it as much more attractive before upselling it to advertisers.

Phew. Ok there’s a lot of metaphorical moustache twirling ingenuity when it comes to fraudulent means of earning a buck, and a lot more to boot, but that gives a pretty decent overview of the main types to look out for. 

When it comes to ad fraud that effects Programmatic advertising specifically, there are a few more angles that can and have been leveraged by fraudsters, and in its early days, it almost brought programmatic to its knees.

Basically, the techniques of fraud are similar, there still plenty of click fraud and stuffed pixels but the Scale is something else. Because Programmatic uses software to decide where to place ads at a speed and quantity capable of taking the breath away from a blue whale, the opportunity for damage to an advertiser before they can figure out what is going on is significantly increased.

Of course there is no silver bullet for defending yourself against ad fraud but with the right measures, you can go a long way to having the best chance at protecting your online marketing activity. Now, ad fraud is going to happen but the most important thing is that you set up frameworks to allow you to detect it as soon as possible and as such minimise the impact to your organisation.

The first thing you can do is maintain old-school bookkeeping hygiene such as keeping an ‘ads.txt’ document where you simply keep an up-to-date list of all the supply side platforms that have permission to re-sell your ad content. This is essential if you want to be able to easily identify when they crop up where they shouldn’t.

For click fraud specifically, it can be useful to set up an IP blacklist on Google Ads by adding any suspicious clicks as soon as you receive them, thus, blacklisting those specific IP’s from viewing your ads in the future.

Custom alerts on google analytics can help by notifying you of any sudden changes in your metrics and traffic. You can then question these metrics and these anomalies and respond accordingly. Examples are, say, an ad that's registered 100% viewability,  a report of zero exposure to ad fraud or perhaps getting 90% of your clicks from a region that you're not even targeting.

Only use 3rd party plugins and scripts from developers you trust and ideally check its code to verify it only does what it says on the box and if it's feasible you can use a dedicated fraud detection tool. Here at ShowHeroes for example we use tools from Integral Ad Science and Moat which cover our activities from Programmatic specific ad fraud detection all the way through mobile specific.

And finally, keep yourself informed. Stay up to date with new trends, threats, and protective measures so that you stay sharp and don’t get snuck up on.