THE MANY FACES OF AD FRAUD AND HOW TO PROTECT YOURSELF White Paper
THE MANY FACES OF  AD FRAUD AND HOW TO PROTECT YOURSELF  White Paper
CONTENTS Introduction to ad fraud 1 De ning ad fraud 2 Game of bots 3 Of human fraudsters 3 Misrepresentation and quality 5 So how can you determine if you have a fraud problem 6 Why is ad fraud so rampant 6 Who is the victim 7 Who is responsible 8 Best practices to counter ad fraud 9 About Centro 10
CONTENTS Introduction to ad fraud  1  De   ning ad fraud  2  Game of bots  3  Of human fraudsters  3  Misrepresentation an...
INTRODUCTION TO AD FRAUD In this article we will take a comprehensive look at ad fraud and try to answer some basic questions What is ad fraud How does it work Why does it exist Who are its victims Who is responsible And most importantly how can you guard against it Ad fraud is a natural outgrowth of the prevailing shift to programmatic buying According to eMarketer 59 percent of all online advertising spend went through programmatic channels in 2015 and that portion is expected to rise to 67 percent in 2016 1 With all of this programmatic buying fraud has found a way to in ltrate the space causing a signi cant amount of wasted spend How big is the problem A recent study by the Association of National Advertisers ANA in cooperation with White Ops a fraud detection company found that bots cause somewhere up to 70 percent of all video ad impressions and up to 30 percent of all display ad impressions The study projects 7 2 billion in losses due to ad fraud in 2016 2 In 2016 we re expecting 7 2 billion in losses due to ad fraud Fraud rates vary between formats because we are dealing with a complex landscape where not all of the marketplaces are created equal The number of suppliers in our industry is staggering There are probably more than a hundred supply side platforms The supply of high quality inventory is nite yet platforms need quantity to survive and one way or another they nd it The higher end publishers tend to gravitate toward market leading exchanges which is why we see very clean high quality inventory on marketplaces like Google Rubicon Project and OpenX But to meet the desire for cheaper inventory or the need for more scale advertisers often venture away from the largest most well known suppliers In their attempt to achieve maximum reach they run the risk of lower quality and potentially fraudulent inventory _____________________ 1 http www wsj com articles marketers ock to programmatic ads despite concerns about fraud and transparency 1457017201 2 http www ana net content show id botfraud 2016 1
INTRODUCTION TO AD FRAUD In this article, we will take a comprehensive look at ad fraud and try to answer some basic quest...
DEFINING AD FRAUD So how do we de ne fraud Here s a simple de nition Ad fraud is the practice of serving digital ads that have no chance to be viewed by a human user or which misrepresent their actual intent This de nition excludes low viewability low quality or poor performance These are quality problems that must be addressed differently Broadly speaking there are two types of fraud non human and human Non human traffic originates from bots which generate the bulk of fraudulent traffic But a signi cant amount of fraud also originates with human traffic especially in cases where ad inventory is being misrepresented 2
DEFINING AD FRAUD So how do we de   ne fraud  Here   s a simple de   nition  Ad fraud is the practice of serving digital a...
GAME OF BOTS Bots are the leading cause of ad fraud They are the focus of most anti fraud companies as well as the most media attention and industry research Put simply a bot is a piece of software that performs automated activities on the internet to simulate user activities when in fact no human actors are present Bots are not necessarily malicious Many bots provide useful services For example all search engines use bots to crawl web pages scan their contents and place them into search engine indices Bots can also perform contextual classi cation such as the contextual targeting available on DSPs from companies like Peer39 Proximic Grapeshot and comScore Ad fraud bots are another story Simple bots are fairly easy to detect and lter They tend to display clearly robotic behavior such as visiting pages faster than humanly possible More sophisticated bots never identify themselves as such because their creators want them to be perceived as human Some have been observed to replicate human behavior by recording actual mouse movements to avoid detection When a bot simulates human behavior it is probably a part of a botnet A botnet is a collection of computers running bot software usually infected home computers You may have up to hundreds of thousands of computers whose users are unaware that in the background they are running malicious software that sends spam emails and generates fake web traffic OF HUMAN FRAUDSTERS Not all fraud traffic is bot traffic Some is of human origin Human fraud includes click farms invisible or stacked ads spoo ng laundering and unintentional navigation where the ad is hard to nd but still viewable perhaps by scrolling to the page bottom in this case there is no way for a human to ever see it The ad may be positioned in an area that can never be scrolled to or under other ads The latter are called stacked ads Multiple pieces of ad code are layered one on top of each other like sheets of paper Each sheet has content but the user can see only what s on the top Click farms One of the simplest ways of generating fraudulent traffic a click farm is a group of humans intentionally working to in ate impression or click counts on a site These schemes are often called paid topromote or paid to click They may be billed as a legitimate work from home opportunity The people doing the clicking receive low pay to visit websites and generate impressions and clicks This traffic is of no value to the advertiser since the users have no interest in the ad Spoo ng In some cases the site domain may misrepresent actual site content For example a porn or piracy website with pirated TV or movie content may claim to be CNN com Such undesirable sites are generally not allowed to Invisible ads A more sophisticated form of human fraud traffic is the serving of ads that are invisible Unlike an ad with low viewability 3
GAME OF BOTS Bots are the leading cause of ad fraud. They are the focus of most anti-fraud companies, as well as the most ...
participate in ad exchanges and are likely to be blocked by buyers Misrepresentation gives the site a false appearance of real value Spoo ng is possible whenever ad exchanges allow users to override the automatic detection of an impression s domain of origin An IFRAME is something you can put on your web page that allows you to load another page s content inside it The problem is it s not obvious that an IFRAME is being used to show this ad on a piracy website or some other website that can t directly join an ad exchange Laundering Inventory laundering happens when operators of an undesirable site decide to serve ads on a shell website They might create a generic site that looks like an authentic cooking blog for example On the domain for this site they might put a simple HTML le that contains nothing other than the ad code from an ad network or exchange They also put this ad code on the real cooking blog to make it look like a normal website so that it passes any sort of human audit when being approved by networks and exchanges But what s really there is a single page with nothing but an ad on it and an IFRAME which is like a little window to another web page Unintentional navigation Unintentional navigation includes such techniques as zero click traffic pop unders and pop ups It may also be caused by unwanted browser add ons toolbars or extensions that redirect users In each case the page or website is loaded without the user intending to go there As a result it is possible to generate ad impressions involving actual human users even though the users had no intention to go to the page Auto playing video ads may be run in pop under mode so that they are never seen by the user Such ads may be set to automatically refresh while the user is watching a TV show on a piracy website This is one sneaky way to generate a great deal of video ad inventory How big is the human fraud problem One word huge At Centro we have identi ed and blacklisted over 3 000 domains that are feeding this kind of traffic into the ad exchanges After blocking these domains we have seen inventory volume on certain exchanges drop by 50 percent or more 4
participate in ad exchanges and are likely to be blocked by buyers. Misrepresentation gives the site a false appearance of...
MISREPRESENTATION AND QUALITY Low quality sites may or may not be fraudulent but low quality can be warning sign Among the potentially fraudulent techniques associated with low quality are site bundling ad injection and arbitrage content and when it detects an ad being loaded it swaps out the code for its own This deprives publishers of legitimate revenue from their ad units siphoning it to the toolbar authors instead Site bundling Site bundling involves cases where the domain is masked so that the true domain is not revealed to the buyer by the ad exchange This may not in itself be a problem Some premium publishers choose to hide their domain when they sell inventory through ad networks because they want to avoid channel con ict Unfortunately this makes it possible to slip low quality or undesirable traffic into the mix without the buyer s knowledge If an ad network sells all of its inventory under adnetwork com or through subdomains like news adnetwork com there may be no way for the buyer to tell whether the site list matches the inventory actually being sold Arbitrage Arbitrage happens when someone buys an impression via real time bidding then immediately resells it into another ad exchange When an impression is resold multiple times through a series of ad networks it becomes very difficult to tell whether or not it is highquality legitimate inventory In some cases for example the arbitrage buyer buys a display ad spot then loads in a small video player containing some stock content which is then sold as an in stream video ad on video exchanges This is certainly not what buyers had in mind When they speci ed in stream video inventory they didn t mean in a banner somewhere at the bottom of a page that probably is not viewable Ad injection In this type of low quality traffic browser add ons or toolbars are created with extra code that unbeknownst to the user may either replace existing ads or add new units to a web page As the user loads the page in a browser the plug in or the toolbar reads the 5
MISREPRESENTATION AND QUALITY Low-quality sites may or may not be fraudulent, but low quality can be warning sign. Among t...
SO HOW CAN YOU DETERMINE IF YOU HAVE A FRAUD PROBLEM First impression Do a sniff test Review the most granular reporting data available Domain level reports are a good place to start Are the domains plausible Are they known websites Next inspect sites for articles without attribution lack of a social media presence or generic low quality content These may be symptoms of a fraud scheme Also look for any irregularity in performance metrics such as click through or conversion rates Look upstream Once you notice something that may be amiss look a little further upstream Tools like Alexa or SimilarWeb can help reveal traffic patterns Where did users come from before they arrived on the website you are investigating If you see referrals from porn or piracy websites or traffic coming from pop under ad networks that is certainly a cause for concern Identify bad behavior To further root out bad behavior you can use things like Google Analytics to scour IP level data and discover unusual or excessive activity from certain IP addresses Find ngerprints Using tools like Alexa or SimilarWeb nd out if suspicious sites share traffic with other fraudulent sites We recently discovered an entire network of sites with identical About Us pages that were all a part of the same fraud traffic network If you can get log level data from your DSP see if the same users tend to have unusual cross visiting patterns such as visits to both omenshealth com and menshealth com for example WHY IS AD FRAUD SO RAMPANT lucrative This is a case where law has not caught up with technology For schemes like video fraud the payoffs are high the risks low From the point of view of bad actors it looks like a no brainer path to easy money The challenge of open marketplaces Open marketplaces are a mixed blessing On the upside they offer egalitarian access All you need is one piece of software a DSP to access an entire universe of supply Unfortunately there is a downside Whether we like it or not the open market is a ready playground for fraudsters The alternatives to open marketplaces are closed platforms such as Facebook but these have their own trade offs They have limited measurement capabilities and are not enabled for third party measurement vendors Buying is not as exible and scale is inherently limited even on a large platform like Facebook Incentive to look the other way Throughout the ecosystem there are few incentives to eliminate fraud Advertisers want to spend as little as possible to achieve the greatest possible return in the form of sales But other players in the ecosystem publishers ad networks and exchanges are paid on volume Everyone takes a cut of the media dollar the more inventory in the ecosystem the more money there is to be made This situation creates an incentive to look the other way Most fraud is technically legal Despite all the losses the fact is that most ad fraud is not exactly illegal right now and it s highly 6
SO HOW CAN YOU DETERMINE IF YOU HAVE A FRAUD PROBLEM  First impression. Do a sniff test. Review the most granular reportin...
WHO IS THE VICTIM Advertisers The biggest victims of course are the brands and agencies that are effectively nancing ad fraud For them it s death by 1 000 cuts For any given campaign the amount of fraudulent activity looks small But taken as a whole it adds up As much as 7 2 billion in losses to ad fraud is projected for 2016 according to the ANA 3 Users Internet users themselves are also victimized because exploits like ad injection toolbars or malicious botnet software can slow computers down or introduce annoying low quality ads to web pages As a result users often take matters into their own hands and install ad blockers The industry The increasing adoption of ad blockers points to the broader harm which is that ad fraud undermines trust throughout the ad tech industry as a whole _____________________ 3 http www ana net content show id botfraud 2016 7
WHO IS THE VICTIM  Advertisers. The biggest victims, of course, are the brands and agencies that are effectively    nancin...
WHO IS RESPONSIBLE Fake traffic has become a commodity There s malware for generating it and brokers who sell it Some companies pay for it intentionally some accidentally and some prefer not to ask where their traffic comes from Bloomberg September 20154 The publisher Publishers need eyeballs on websites There are many ways to achieve that goal some legitimate some not Paid traffic acquisition can be perfectly kosher Content discovery companies like Taboola and Outbrain help publishers attract users to relevant content on their sites But then there are traffic brokers that sell users to publishers at outrageously low prices less than a penny per visit In that range it becomes increasingly likely that the users are either not human or not intentionally visiting The advertiser Not to point the nger at advertisers but they often do seek cheap inventory and that may encourage others in the ecosystem to engage in fraud The agency Agencies typically are paid to spend their own income depends on it But when they lower standards to achieve scale they may put their clients at risk of being cheated Agencies also sometimes try to maximize margin through opaque trading desks at sister companies The pressure to drive margin can result in buying poor or even fake inventory Ad tech Finally there is the role of ad tech platforms like DSPs and SSPs which can either help eliminate the problem or contribute to it The fact is that ad tech companies make money when fraudulent traffic passes through We believe ad platforms must ultimately take an ethical stand against fraud and be willing to sacri ce some potential spend in the interest of doing the right thing Both DSPs and SSPs can implement traffic ltration They can do human auditing to look for fraudulent activity They can use measurement technologies from companies like Pixalate Integral Ad Sciences IAS or DoubleVerify And SSPs can more carefully scrutinize the inventory partners and require direct relationships with the publishers _____________________ 4 http www bloomberg com features 2015 click fraud 8
WHO IS RESPONSIBLE     Fake traffic has become a commodity. There   s malware for generating it and brokers who sell it. S...
BEST PRACTICES TO COUNTER AD FRAUD Keep your eyes open Audit bought media for indicators of fraud Re examine detailed reporting Look at your campaigns and benchmark your fraud risk Work with a measurement or a veri cation partner or insist that your DSP does so For example on Centro DSP we measure all traffic using Pixalate for fraud detection You can also use whitelists of trusted sites utilize trusted private marketplaces and apply a number of technological countermeasures Leverage technology Most DSPs offer pre bid fraud prevention segments available from companies like IAS DoubleVerify and ComScore Veri cation services like ComScore Pixalate DoubleVerify and IAS can tell you how much fraud is being observed in your campaigns Private marketplaces also help reduce risk by dealing only with known sellers Some DSPs rank inventory by trustworthiness or expected quality This sort of tiered inventory will help you nd higher quality placements Choose the right metrics Always turn off click based optimizations Clicks are very easy to fake So are other simple metrics like completion rates for video Instead try to nd proxy engagement metrics such as time on site or key interactions on site This will help you distinguish the righteous from the bogus Buy defensively Finally embrace defensive buying tactics The digital ad world is in constant ux New sites with fraudulent activity appear all the time Fraud prevention is an ongoing process that demands your attention every step of the way 9
BEST PRACTICES TO COUNTER AD FRAUD Keep your eyes open. Audit bought media for indicators of fraud. Re-examine detailed re...
ABOUT CENTRO Centro is a leading developer of digital advertising and media management software Centro software and services make digital advertising easier for more than 2 000 customers More than 400 million is processed through Centro s software annually Founded in 2001 Centro is headquartered in Chicago with 37 offices in the U S and Canada ABOUT 3T To support the thirst for education in the ad tech industry Centro launched 3T Tips Trends and Techniques for dominating digital The 3T series includes a national roadshow known as 3TLive in addition to a monthly webinar series called 3Ton30 Both programs feature Centro experts covering the latest topics in digital media to help get you up to speed and ahead of the curve To learn more about 3T visit 3t centro net To learn more about ad fraud and all things digital visit www centro net or email us at info centro net Copyright 2016 Centro Inc All Rights Reserved 10
ABOUT CENTRO Centro is a leading developer of digital advertising and media management software. Centro software and servi...