The Challenge of Advertising Fraud
 
Retailer John Wannamaker was quoted as saying “I know that half the money I spend on advertising is wasted.  I just don’t know which half.”  In today’s world of on-line digital advertising, it’s clear that the money lost to “click fraud” and other scams is a big part of that wasted half.

To appreciate the seriousness of the problem, just consider the dollars involved.  Global on-line advertising has grown from $60 billion in 2010 to an estimated $140 billion in 2017.  About $32 billion of that was allocated to so-called programmatic advertising.  Programmatic advertising uses machine learning algorithms to target consumers with advertisements across thousands of sites based on a swath of personal information, including browsing history, shopping habits, age, gender and more.
 
With fraudulent companies using ‘clickbots’ to generate illicit advertising traffic to bring in revenue, advertisers are paying billions for ads that never reach customers.  Recent reports in MarketingTechNews make clear that the advertising fraud problem is widespread, and so-called “click farms” are fast becoming professional, large-scale operations. For instance, authorities in Thailand raided a click farm at a house and confiscated nine computers, 500 mobile phones, 350,000 SIM cards and 21 SIM card readers, in June of 2017. And, as with marijuana farms, each one shut down is quickly replaced by new ones.

These click farms are highly adaptable and are used to influence all manner of things on the Internet, from the number of followers on a social media account to the amount of plays a song has received on Spotify.  But using these farms for advertising fraud purposes has caused a serious rift in the industry, with the cost of such fraud totaling billions of dollars a year.

In May of this year, Dr Augustine Fou a researcher who previously work as Senior Vice President of Digital Strategy for McCann Worldwide, produced an astounding article that really puts the bot-fueled ad fraud problem into perspective.  In it, he explains that Google recently took down 40 apps from its Google Play Store, which had been downloaded more than 26 million times combined.  But these were not regular downloads.

As Dr Fou explains, “security firm Check Point discovered that these apps carried an illegitimate ad clicking function which Forbes said ‘might be the biggest Android ad fraud ever’.”  Just like any huge global technology company should, Google does have a solution in place for this problem; it’s called ‘Bouncer’ and it is designed to protect against such fraudulent instances. But, as is often the case, the bad guys were one step ahead, and so their advertising fraud malware ? codenamed ‘Judy’ went undetected.

According to Dr. Fou, Judy is capable of creating 1 billion fraudulent ad impressions a minute. Since it went undetected for a year, it doesn’t take a mathematician to calculate the damage this can cause.
 
However, this pales in comparison to ‘Fireball,’ a piece of advertising fraud malware uncovered by Check Point. Whereas Judy is capable of 1 billion fraudulent impressions a minute, Fireball creates 30 billion in the same time. This amounts to a level of advertising fraud that is beyond comprehension.

The financial implications of such activity are substantial. According to the 2017 joint study by White Ops and the Association of National Advertisers (or ANA), bot-driven advertising fraud will cost brands an estimated $6.3 billion this year, down from $7.2 billion last year.  Key findings from the study include these six:

1. Traffic sourcing is the major risk factor for fraud. Traffic sourcing, or the process of purchasing traffic from outside sources, was a large source of fraudulent activity. The report said 3.6 times as much ad fraud came from sourced than non-sourced traffic.

2. Nine percent of desktop display and 22 percent of video spending was fraudulent. This was a decline from the previous year when display advertising fraud was reported at 11 percent and the fraud rate for desktop video was 23 percent.

3. Mobile fraud was found to be considerably lower than expected. Overall, participants saw less than two percent of fraudulent activity in app environments and mobile web display buys. However, this does not include fraud in mobile web video and pay-per-click fraud which remain high and problematic.

 
4. Fraud in so-called “programmatic media buys” is no longer greater than general market buys as media agencies have improved filtration processes and controls.

5. Fraud is seasonal. Fraud levels jump at key holiday periods, especially Black Friday and Cyber Monday.  Fraud levels dropped and stayed pretty consistent for flat spenders over the remainder of the holiday season, while fraud levels for seasonal spenders continued spiking throughout the entire holiday period. Fraud was also found to spike at the end of a quarter. And,

6. Sites with nothing but bot visitors make up about a fifth of all the world’s websites, across the entire ad buying universe. Study participants that spent much less money on the long-tail where these sites concentrate saw a stark decline in the so-called “cash-out domains” that appeared in their spending.

Significantly, ad fraud is so hard to detect that the ANA estimate of $6.3 billion in 2017, probably represent a low-ball estimate of the real cost of ad fraud.

Given this trend, we offer the following forecasts for your consideration.

First, the most successful advertisers will adopt campaign planning practices proven to minimize fraud.

The 2017 ANA study found that the best performing 25% of participants incurred only 10% as much ad fraud as the average company. A closer look revealed that those companies adhered to eight campaign planning practices that set them apart.

1. Demand transparency from all vendors. Fraud tends to thrive in areas of opacity. Seek out specifics about pricing, traffic sourcing, and the extent of audiences being delivered via owned and operated domains vs. audience extension. Buyers need to demand this transparency, and if it’s not offered, reconsider the relationship.

2. Demand transparency about traffic sources.  While there are plenty of legitimate third-party sources of traffic ? for instance, paid search ? traffic sourcing is the most common way in which bot masters make money, by selling visits to publishers. Bot masters sell visitors on a cost-per-click basis. Advertisers must be aware of sourced traffic and work with their media agency to clearly understand its use in the media schedule. Buyers should demand transparency from publishers about traffic sources and build language into their RFPs and insertion orders that requires publishers to identify all third-party sources of traffic. An illustration of one approach, developed by Reed Smith, the ANA’s outside legal counsel, is: “Media Company shall disclose to Advertiser and Agency in writing (and update on an ongoing basis) its practices for sourcing third-party traffic.” You should consult with your own counsel to develop the specific provisions that best serve your company’s individual interests.

3. Demand transparency for audience extension practices. Audience extension by publishers can introduce high bot percentages by extending content to providers that source traffic. It’s recommended that buyers demand transparency from publishers around audience extension and require publishers to identify audience extension practices. Buyers should have the option of rejecting audience extension and running advertising only on a publisher’s owned and operated site.

4. Implement proper tracking to collect the data needed to make correct decisions.  Require, robust third-party invalid traffic measurement from all of your supplier and publisher partners. This can get pretty technical; so you need to do your homework regarding terms like SIVT and GIVT.

5. Include language regarding non-human traffic in your terms and conditions when buying advertising. Insertion orders should include language that the company will only pay for non-bot impressions and valid traffic. Additional language should be added to your terms and conditions to address the issues discussed in the ANA study.

6. Look skeptically at narrow targeting and cheap reach.  In any situation where supply does not meet demand for a target audience, fraud will follow. Avoid too many actions that restrict potential supply (e.g., using too many targeting parameters at once). Furthermore, fraud protection isn’t free, so the lowest CPM rates may not include sophisticated protection measures letting even the simplest and cheapest bots go unnoticed. The top performers in the ANA study spent little on bargain inventory and thus were spared from this concentration of fraud.

7. Set the correct metrics for success.   Media Rating Council (or MRC) is the industry body that accredits third-party companies for their measurement processes. And,

8. Encourage MRC-accredited third-party fraud detection on walled gardens.  The large digital media companies referred to as “walled gardens” are strongly encouraged to work with MRC-accredited third-party fraud detection companies to support invalid traffic detection. Marketers should be able to hold every publisher and platform accountable in a consistent and trustworthy way. While some large digital media companies have taken steps toward seeking MRC accreditation, others have not done so yet.  And,

Second, the most successful companies will also adopt anti-fraud “best practices” during ad campaigns.

ANA has identified six “active engagement” practices that reduce fraud.

1. Use audience anti-targeting to cut fraudulent audiences. New computers are getting infected every day, and bots frequently refresh cookies. But regularly updating anti-targeting segments to exclude known click-bot IP addresses, User IDs, and Device IDs can be effective if refreshed frequently.

2. Use domain anti-targeting or exclusion lists to cut fraudulent domains. 20% of all the websites domains ANA examined were dedicated to fraud. New domains are registered all the time for this purpose. But regularly updating domain exclusion lists to exclude known “cash-out sites” can be effective if refreshed frequently.

3. Use your DMP as a fraud-fighting tool.  If possible, stream log-level data directly from your data management platform (or DMP) into your programmatic platforms to avoid serving ads to fraudulent user IDs and Device IDs. Regular or real-time updates are crucial: if traffic buyers can iterate through click-bot traffic sources until they find the one that you don’t catch, they will.

4. Confront partners when they’re not meeting your goals.  Set a goal for fraud levels at the campaign start and confront partners when their fraud levels are not meeting your standards. Good partners are transparent and active partners.

5. Understand your activity. Study placements, campaigns, tactics, publishers, and seasonality to identify trends you can apply to future campaigns to help you avoid fraud. Understand the types of fraud you encounter and where you can best reach your human-concentrated audiences. And,

6. Dis-incentivize bad behavior. Develop and communicate consequences for bad actors. Each brand has different needs and solutions, but should develop and communicate consequences for bad actors (domains, placements, partners, etc.) that consistently attract fraud. Some players will never steal from you. Some will always steal from you. The rest look at how you treat those two categories.

References
1. Marketingtechnews.net; 31 October 2017.  Jim Surguy; Advertising fraud: the monster in the room By Jim Surguy

https://www.marketingtechnews.net/news/?user=31746

2. Forbes, May 26, 2017, Thomas Fox-Brewster.  Google Just Killed What Might Be The Biggest Android Ad Fraud Ever.

https://www.forbes.com/sites/thomasbrewster/2017/05/26/google-shuts-down-massive-ad-fraud-on-play-store/#4c61b8967807

3. ANA.Com, 2017, WhiteOps. The Bot Baseline: Fraud in Digital Advertising 2017 Report.

http://www.ana.net/getfile/25093