Winning the race against ad fraud

Ad fraud is big busi­ness for crim­i­nals – and a grow­ing prob­lem for com­pa­nies. 

Fraud­sters adopt a range of scams (see below) aimed at cheat­ing adver­tis­ers of their mon­ey, from sell­ing ads on fake web­sites to con­ceal­ing the true ori­gins of “clicks”. Accord­ing to Forbes, the aver­age per­pe­tra­tor makes any­where from $5 mil­lion to $20 mil­lion a year, though it notes that “ad fraud costs are all over the map”. 

The cost isn’t just felt in the ad bud­get; loss of rev­enue can occur all along the chain.

“If $100,000 worth of ads is unseen, that could mean an over­all loss in rev­enue of $1 mil­lion,” says Dr Rober­to Cava­zos, exec­u­tive in res­i­dence in the Depart­ment of Infor­ma­tion Sys­tems and Deci­sion Sci­ence at the Uni­ver­si­ty of Bal­ti­more. Every dol­lar lost is poten­tial­ly a mul­ti­ple in lost sales, he says. 

“It even affects eco­nom­ic sta­bil­i­ty.”

If the impact of ad fraud is dif­fi­cult to esti­mate, imag­ine how hard it is to track and stop. Accord­ing to Cava­zos, we’re in a race between the crim­i­nals and the com­pa­nies devel­op­ing solu­tions against the threat, with the dan­ger always evolv­ing. Indeed, it’s hard to know which form of ad fraud is most con­cern­ing, he says, with the answer depend­ing on an advertiser’s par­tic­u­lar activ­i­ties, among oth­er fac­tors. 

Tina Lakhani, head of ad tech at trade body the Inter­net Adver­tis­ing Bureau (IAB) UK, agrees. She says there is a range of tech­nolo­gies avail­able to help mon­i­tor and mit­i­gate fraud. The chal­lenge is “eval­u­at­ing dif­fer­ent tech­nolo­gies out there, know­ing which ones to work with and where to start”.

The IAB has been cre­at­ing indus­try stan­dards for such tech­nolo­gies, along with bod­ies like the Trust­wor­thy Account­abil­i­ty Group (TAG), help­ing assure buy­ers that their secu­ri­ty providers have been inde­pen­dent­ly audit­ed.

Cava­zos thinks there’s poten­tial to include inter­net fraud with­in inter­na­tion­al agree­ments in dig­i­tal secu­ri­ty. How­ev­er, it may be some time before the struc­ture of the online ad indus­try evolves to be able to mount a stronger defence against the fraud­sters, he says. 

To deter­mine the appro­pri­ate solu­tion for a par­tic­u­lar com­pa­ny, Lakhani encour­ages mar­ket­ing and tech­nol­o­gy lead­ers to talk to their ven­dors. “You have to take an informed view, so ask them direct ques­tions about how they pro­tect against spe­cif­ic areas. Col­lab­o­rate with them to under­stand how their tech­nolo­gies work, what their method­olo­gies are. They may be able to teach you about fraud tac­tics you hadn’t even been look­ing out for.” 

Tech­no­log­i­cal solu­tions aren’t an option for every­one, Cava­zos notes, par­tic­u­lar­ly small to medi­um sized busi­ness­es or per­haps com­pa­nies in devel­op­ing nations. How­ev­er, Lakhani stress­es that many fraud mit­i­ga­tion ven­dors’ busi­ness mod­els are based on a per­cent­age of over­all ad spend, rather than a flat fee or the num­ber of frauds they attempt to detect. Still, she acknowl­edges a degree of frus­tra­tion from com­pa­nies who see fraud detec­tion invest­ments as a kind of “tech tax” or “leaky buck­et”. 

Com­pa­nies’ efforts to defend against online fraud should be viewed as a form of cyber­se­cu­ri­ty, Cava­zos says. 

“Every­one imag­ines that’s some­one in a hood­ie try­ing to under­mine the trea­sury. But what hap­pens is a com­pa­ny spend­ing a mil­lion dol­lars is [actu­al­ly] get­ting $750,000,” while also tak­ing a hit to brand recog­ni­tion, poten­tial sales and more, Cava­zos says.  

Such solu­tions are impor­tant from a rep­u­ta­tion­al per­spec­tive, Lakhani says, adding val­ue in areas of con­cern for adver­tis­ers, such as ver­i­fy­ing envi­ron­ments and the con­tent ads appear against. 

“These are all impor­tant con­sid­er­a­tions, espe­cial­ly if you’re mak­ing a sub­stan­tial invest­ment in online adver­tis­ing.”

Here are five key types of ad fraud tac­tic:

1. Domain spoofing

Esti­mat­ed by anti-fraud com­pa­ny, Anu­ra, to poten­tial­ly cost adver­tis­ers $1 mil­lion a year, domain spoof­ing is when com­pa­nies – and the ad tech or agen­cies they rely on – believe they are adver­tis­ing on a legit­i­mate web­site, when it’s actu­al­ly fake or linked to a less favourable web­site. The fraud­sters cre­ate a plau­si­ble URL to attract adver­tis­ers who would prob­a­bly nev­er choose to adver­tise with them, either because of small or non-tar­get audi­ences or inap­pro­pri­ate con­tent. At best it drains bud­get; at worst it aligns your brand with crim­i­nal­i­ty or ter­ror­ism.

2. Ad stacking

Par­tic­u­lar­ly com­mon on mobile, ad stack­ing is a sim­ple but effec­tive way for fraud­sters to boost their cof­fers. The con­sumer sees a sin­gle ad that they may click on. But beneath that ad can be many more; although unseen by the end user, they each trig­ger a charge. The ads have loaded cor­rect­ly, and appear to have been clicked, skew­ing the advertiser’s cost per click or “cost per mille”, the amount the com­pa­ny pays per 1,000 views of the ad. These costs are only jus­ti­fied if a cer­tain num­ber of poten­tial cus­tomers go on to buy. But of course, those who have nev­er seen the ad won’t pur­chase, leav­ing the com­pa­nies won­der­ing why so many peo­ple are click­ing but no-one is buy­ing.

3. Ad click and bot fraud

This dou­bles down on the sort of fraud seen in domain spoof­ing, where adver­tis­ers mis­tak­en­ly believe their ads are on a gen­uine site. By adding click fraud to the mix, scam­mers can increase their rev­enues fur­ther. Click fraud uses either low-paid humans in a “click farm” or bots to gen­er­ate huge amounts of clicks on ads, which all use up ad bud­get that goes to the fraud­ster.

4. Click injection

More nefar­i­ous still, this attack sees cyber­crim­i­nals put mal­ware on users’ devices via down­loads of “junk” apps (an exam­ple could be apps cre­at­ed for a sin­gle fad, such as face chang­er apps), which are cheap and easy to cre­ate. The mal­ware gen­er­ates clicks on ads – which could be run on plat­forms such as Face­book Net­work for exam­ple – which inflates spend and cre­ates rev­enue for the devel­op­ers. One com­pa­ny inves­ti­gat­ed two such junk apps that had gen­er­at­ed 3,061 requests for an ad and 169 suc­cess­ful clicks on a mobile while it was in sleep mode for 24 hours. 

5. Geo masking

The world wide web is just that – world­wide. But com­pa­nies might not want to sell to some coun­tries for any num­ber of rea­sons: ship­ping costs, for exam­ple, or appro­pri­ate­ness of prod­uct. Com­pa­nies only want to pay for high-qual­i­ty leads in coun­tries they serve, so clicks from those coun­tries usu­al­ly come at a pre­mi­um price. Geo mask­ing hides the ori­gin of clicks, mak­ing it look like they all come from a pre­mi­um loca­tion, inflat­ing the over­all cost of ads with­out deliv­er­ing ser­vice­able cus­tomers.