Ad fraud: from click hijacking to pixel stuffing

The World Fed­er­a­tion of Adver­tis­ers has pre­dict­ed ad fraud will see adver­tis­ers wast­ing $50 bil­lion a year by 2025. It’s a ter­ri­fy­ing fig­ure mar­keters will hope is an over­es­ti­mate to be allayed by con­tin­u­ing invest­ment in fraud pre­ven­tion. But with many fraud­sters view­ing dig­i­tal adver­tis­ing as low-hang­ing fruit, the threat is very real.

Steve Chester, direc­tor of media at ISBA, the body rep­re­sent­ing the UK’s lead­ing adver­tis­ers, describes the sit­u­a­tion as an “ongo­ing arms race” between brand own­ers and fraud­sters, and cau­tions chief mar­ket­ing offi­cers (CMOs) to stay informed of the lat­est devel­op­ments.

Nick Mor­ley, man­ag­ing direc­tor, Europe, Mid­dle East and Africa, at dig­i­tal ad ver­i­fi­ca­tion spe­cial­ist Inte­gral Ad Sci­ence, says: “Ad fraud has become a glob­al mul­ti-bil­lion-dol­lar busi­ness and it will con­tin­ue to be a major issue for the adver­tis­ing indus­try. This is because it remains attrac­tive with­in the realm of crim­i­nal activ­i­ty, as it has high pay­out poten­tial at a low risk to the fraud­ster.”

All a fraud­ster needs is a few com­put­ers and the tech­ni­cal know-how. This low bar­ri­er to entry makes dig­i­tal ad fraud an attrac­tive prospect over oth­er forms of fraud that require more invest­ment or infra­struc­ture.

Dif­fer­ent types of ad fraud include domain spoof­ing, click hijack­ing, app spoof­ing and pix­el stuff­ing. How­ev­er, bot­nets present the most per­va­sive ad fraud type. These work by hijack­ing devices with mal­ware to gen­er­ate fraud­u­lent traf­fic.

Bot­net oper­a­tions have been get­ting more sophis­ti­cat­ed over the years, says Ste­van Rand­jelovic, direc­tor of brand safe­ty and dig­i­tal risk for GroupM. “The indus­try has seen an uptick in bot­net schemes, but in a slight­ly more refined way. Instead of gen­er­at­ing traf­fic direct­ly on a hijacked device, it is gen­er­at­ed else­where on a serv­er and then it is prox­ied through the hijacked device,” he says. “This adds one more lay­er of obfus­ca­tion, avoid­ing detec­tion with tra­di­tion­al deter­min­is­tic meth­ods.”

The ad verification pushback

Col­lec­tive­ly, adver­tis­ers, media buy­ers, adtech com­pa­nies and legit­i­mate media own­ers sell­ing high-qual­i­ty inven­to­ry have been fight­ing back through greater use of ad-ver­i­fi­ca­tion tools and some indus­try-wide ini­tia­tives.

“Research from the Trust­wor­thy Account­abil­i­ty Group (TAG), which works with hun­dreds of mem­bers across the indus­try to tack­le fraud, shows that lev­els of invalid traf­fic in Europe in 2019 stood at 9.2 per cent, but this lev­el was great­ly reduced to 0.53 per cent when work­ing with TAG-cer­ti­fied ven­dors,” says Tina Lakhani, head of adtech at IAB UK.

More­over, IAB UK’s own Gold Stan­dard 2.0 recent­ly intro­duced new require­ments for cer­ti­fied com­pa­nies to adopt IAB Tech Lab’s sellers.json and Open­RTB Sup­ply­Chain Object, as well as ads.txt, resources that should strength­en the indus­try-wide abil­i­ty to com­bat fraud. Lakhani says work­ing with TAG-accred­it­ed com­pa­nies is key to turn­ing the tide on ad fraud.

In Sep­tem­ber, TAG, his­tor­i­cal­ly US focused, merged with JICWEBS, for­mer­ly the UK enti­ty over­see­ing stan­dards for dig­i­tal ad trad­ing, to cre­ate a new body, albeit retain­ing the TAG name. Jules Kendrick, its man­ag­ing direc­tor for the UK and Europe, asserts the new organ­i­sa­tion is mov­ing aggres­sive­ly to build a world­wide stan­dards infra­struc­ture to reduce ad fraud, share intel­li­gence on emerg­ing threats and pro­tect brand safe­ty.

Giv­en these reas­sur­ing moves, can CMOs leave fraud pre­ven­tion entire­ly in the hands of the spe­cial­ists? Absolute­ly not.

Scott Thom­son, chief oper­at­ing offi­cer at Method Media Intel­li­gence, says adver­tis­ers have to stay on top of the issue. “They can­not rely on doing it by proxy, be that via their agen­cies, or reliance on ‘tried but tired’ fraud detec­tion meth­ods, or indeed self-cer­ti­fied sup­pli­ers of ‘clean’ audi­ence fig­ures.”

Pete Markey, CMO at TSB, says mar­ket­ing lead­ers need to work along­side their agency part­ners and tech ven­dors to ensure the required exper­tise is present at all lev­els. “Trans­paren­cy should be the main require­ment, espe­cial­ly as there isn’t a fix-all solu­tion that is cur­rent­ly in-mar­ket. As more and more chan­nels become dig­i­tal­ly con­nect­ed – TV see­ing an impor­tant plan­ning shift through 2020, for exam­ple – the oppor­tu­ni­ty for fraud in these new­ly con­nect­ed chan­nels could be greater.”

Under­stand­ing the prob­lem exists and ensur­ing the right avail­able tech­nol­o­gy is in place to pre­vent fraud and oth­er forms of invalid traf­fic that lead to wast­ed bud­get should be the start­ing point for CMOs. Although a bal­ance must be struck to ensure the prob­lem does not hin­der the impor­tant dri­ve for inno­va­tion.

Fraudsters tuning in to connected TV

The point about TV’s grow­ing dig­i­tal con­ver­gence is an inter­est­ing one. “Con­nect­ed TV (CTV) has a lot of appeal to fraud­sters right now,” says Sam Man­sour, prin­ci­pal prod­uct man­ag­er at Ora­cle Data Cloud. “This is due to it being a new­er medi­um for dig­i­tal adver­tis­ing, with big­ger mea­sure­ment gaps, and because CTV CPMs [cost per thou­sand views] are extreme­ly valu­able.” Moat by Ora­cle met­rics are among the tools avail­able to mar­keters for mon­i­tor­ing over-the-top inter­net TV ser­vices and CTV for non-human traf­fic and oth­er sus­pi­cious behav­iour.

Major bot­net ad fraud scams such as 3ve and 404bot have made glob­al head­lines and ille­gal­ly siphoned off mil­lions of pounds. Ever-evolv­ing tech­nolo­gies increas­ing­ly allow for the cre­ation of bots and oth­er meth­ods with near-human capa­bil­i­ties.

“Attack­ers are also becom­ing clever in reverse engi­neer­ing against anti-fraud soft­ware so that they can avoid future detec­tion,” says Roy Dovas­ton, co-founder of Click Guardian. “This is expect­ed to cre­ate par­tic­u­lar issues for mobile ad fraud, which is becom­ing more refined. Attack­ers are now able to cre­ate new IP address­es using flight-mode and oth­er phone set­tings, in an attempt to cir­cum­vent anti-click fraud solu­tions.” 

The war against ad fraud is set to rage on for a long time and may nev­er be ful­ly won. “From a CMO’s per­spec­tive, the best way to min­imise the risk of ad fraud is to make sure you under­stand the dif­fer­ent forms ad fraud takes, how the avail­able tools work to address dif­fer­ent types and to adopt a nuanced approach accord­ing­ly,” says Lakhani at IAB UK. “In short, you can’t solve ad fraud via a sin­gle approach; dif­fer­ent types of fraud neces­si­tate dif­fer­ent tools to be work­ing in tan­dem to reduce risk.”