Ad fraud is any impression, click, install or lead an advertiser pays for that brought no real interest. Industry estimates vary, but fraud takes a noticeable share of global ad budgets, and in buying on open sources such as push, popunder, native and mobile networks the share can be even higher. The catch is that "fraud" is not one technique. It is a dozen different schemes, and a remedy against one is useless against another.
Below are the main types of ad fraud: how each works, what gives it away in the stats and what advertisers do about it. If you want the big picture of invalid traffic, start with the article on invalid traffic; this one goes into the details of each scheme.
Who makes money on fraud
Before taking the schemes apart, it helps to understand the motive. Fraud is almost always committed by those who get paid for volume:
- publishers and placements earn a share of impressions and clicks, so they inflate them;
- dishonest affiliates and sub-affiliates get paid per install or lead, so they fake them;
- botnet and click farm owners sell "traffic" to whoever needs to pump up the numbers;
- competitors burn someone else's budget; they are covered in detail in the article on competitors clicking your ads.
The motive tells you where to look: if you pay per impression, the fraud will be in impressions; if per install, in install attribution; if per lead, in the leads.
Click spam
How it works. Click spam (also called click flooding) means mass-sending clicks on behalf of users who never tapped anything. It is mostly a mobile story: an app or site with an ad SDK fires clicks in the background on the tracking links of dozens of offers. The logic is simple: some of these people will at some point install one of the apps on their own, organically, and the install will be credited to the fraudster by last click.
What it looks like in the stats:
- a huge number of clicks with a tiny click-to-install rate, hundreds or thousands of clicks per install;
- time from click to install spread over hours and days, with no typical peak in the first minutes;
- a source's install "growth" coincides with a drop in organic installs.
How advertisers defend. They shorten the click attribution window, switch off sources with an abnormal click-to-install ratio and demand placement transparency from the network. The mobile specifics matter here: the same schemes work differently inside apps than on the web.
Click injection
How it works. A subtler scheme for Android. A malicious app on the phone watches for the user starting to install another app and at the last moment sends a click in its own name. The install is genuine and the person is real, but the payout goes to a source that did not bring it.
What it looks like in the stats:
- implausibly short time from click to install, seconds, when downloading and launching physically takes longer;
- the click is recorded after the app download has already started;
- the source "brings" installs that otherwise look exactly like organic ones.
How advertisers defend. They compare the click time with the install start time, discard installs with an impossible interval and switch off sub-publishers with this pattern.
Domain spoofing
How it works. A low-quality placement passes itself off as a well-known site. The advertiser buys impressions "on a major news portal" through programmatic, while the real impression happens on a site nobody visits or inside a botnet. The fake domain is inserted into the bid request.
What it looks like in the stats:
- the volume of impressions "from a premium site" exceeds the traffic that site ever gets;
- CTR and engagement are sharply lower than on the same site bought directly;
- the referrer and page URL in analytics do not match the declared domain.
How advertisers defend. The industry responded with ads.txt and app-ads.txt files, where a site owner lists who is allowed to sell their inventory, and with the supply chain (sellers.json, SupplyChain object). The advertiser buys only from authorized sellers and checks the domains in reports against real referrers.
Ad stacking and pixel stuffing
Two impression-inflation schemes that often go together.
Ad stacking layers several ads on top of each other in a single ad slot. Only the top one is visible, but every one of them gets an impression. If someone clicks the stack, the click may also be credited to several advertisers at once.
Pixel stuffing squeezes an ad, or an entire ad frame, down to 1×1 pixel. Formally the impression happened, but nobody can possibly see the ad.
What it looks like in the stats:
- lots of impressions with near-zero CTR and zero viewability;
- clicks arriving "in bursts" at the same moment across different campaigns of one advertiser;
- the placement's viewability metrics are far below average.
How advertisers defend. They buy viewable impressions, track viewability and switch off placements that have impressions but no visibility. For those paying per click these schemes are less dangerous, but even there an ad stack produces clicks a person never made.
Bot traffic
How it works. Programs pretend to be visitors: they open pages, click ads, sometimes even scroll and fill in forms. The range is wide, from simple scripts that do not execute JavaScript to headless browsers with spoofed fingerprints routed through residential and mobile proxies.
What it looks like in the stats:
- a noticeable share of visits from hosting and data center networks;
- identical devices, browsers and screen resolutions across "different" visitors;
- zero or identical time on page, no scrolling or movement;
- night-time spikes in geos where everyone is asleep;
- clicks without a single conversion at noticeable volume.
How advertisers defend. Simple bots are cut off by network and request: hosting ASNs, VPN, proxies and data centers, IP reputation. Sophisticated ones by browser and behavior checks. The signs are covered in detail in bot traffic signs, and choosing a method in JS check or IP blocking.
Click farms
How it works. Real people or racks of real phones paid to perform actions: clicks, installs, sign-ups, likes. This is the most awkward type of fraud to defend against, because the devices are real, the browsers are real and a human finger is moving across the screen.
What it looks like in the stats:
- many visits from a single mobile carrier subnet or from a limited set of devices;
- recurring phone models and OS versions;
- actions done quickly and by the same script, without reading the page;
- activity during the working hours of the farm's country, not the target country;
- sign-ups happen, but no further activity or purchases follow.
How advertisers defend. They look at post-conversion quality: retention, repeat actions, approval rate. They cap clicks per address and subnet and analyze time zones. How farms work from the inside is covered in a separate article on click farm clicks.
Lead fraud
How it works. When you pay per lead (CPL, CPA), the leads themselves become fake. They are filled in by scripts, by incentivized users "for a bonus" or by farm operators. Resold old databases also happen: real but long-collected contacts are submitted through the form.
What it looks like in the stats:
- a normal or even high CR with an approval rate close to zero;
- identical formats of names, emails and phone numbers, sequential numbers;
- leads arrive in a series within a short time;
- the phone does not answer, or the person does not remember leaving a request;
- time from click to lead is too short for a human to fill in the form.
How advertisers defend. They track conversion statuses by source rather than CR alone, match every lead to its click by click ID and filter bots before the form. What to do about fake leads already coming in is covered in the article bots submitting leads.
Placement fraud in push, popunder and native
Fraud committed by the placements themselves inside ad networks deserves a separate mention. A publisher site earns a share of your spend and has every reason to want more clicks. Hence inflated zones, forced redirects, "clicks" on window close and push subscriptions collected by deception.
The main tool here is breaking down the stats by placement. Pass the zone or site ID into the campaign tag and look at results for each one. More in the article on push and popunder.
Summary table of ad fraud types
| Fraud type | Where it occurs | Main sign | Main defense |
|---|---|---|---|
| Click spam | mobile ads, CPI | thousands of clicks per install | short attribution window, switching the source off |
| Click injection | Android, CPI | seconds from click to install | checking the click-to-install interval |
| Domain spoofing | programmatic | more impressions than the site has traffic | ads.txt, sellers.json, domain matching |
| Ad stacking, pixel stuffing | impressions, CPM | impressions without viewability or clicks | paying for viewable impressions, viewability |
| Bot traffic | any source | data centers, uniformity, zero behavior | filtering by network, browser, behavior |
| Click farms | social, mobile, CPA | subnets, same models, no retention | per-address caps, post-conversion quality |
| Lead fraud | CPL, CPA | CR without approvals | conversion statuses by source, filtering before the form |
How advertisers protect themselves: the general approach
The specific measures differ for each type, but the general approach is the same.
- Tag your traffic. Without placement, campaign and click tags, fraud cannot be tied to a source. The minimum is a click ID and a placement ID in every link.
- Count money by source. Clicks and CR are not enough: you need spend, revenue and ROI for every campaign and placement. Without it you cannot see where fraud costs money and where it is harmless.
- Filter before the offer. Bots, data centers, VPNs and proxies are cut off before the landing page so they do not spoil your stats or reach ad accounts as conversions.
- Watch post-conversion quality. Approval, buyout and retention reveal the fraud that got past every entry filter.
- Switch sources off in the network itself. A filter on your side protects the landing page, but you have already paid for the click.
- Demand refunds. Platforms refund proven invalid traffic if you come with data: addresses, times, the share of filtered traffic.
How much all this costs in money and how to calculate bot losses is covered in a separate article, how much budget is lost to bots.
How it looks in ArtisanClo
ArtisanClo filters out bots, data center traffic, VPNs and proxies, and every click in the log shows the reason code behind the decision: why the visit was let through or filtered, which network it came from, what device it had and which checks it passed. This covers bot traffic and server-side inflation, the most widespread types of fraud in media buying.
The built-in tracker counts spend, conversions, profit and ROI by campaign and placement. So you see not only how much junk came in, but also how much money went on it and which placements are worth switching off in the ad network. For lead fraud, the link between click and lead helps: every conversion shows the original visit with all its signals.
Summary
Ad fraud is a family of schemes, not a single problem. Click spam and click injection steal install attribution; domain spoofing, ad stacking and pixel stuffing sell invisible or fake impressions; bots and click farms produce empty clicks; lead fraud produces empty leads. Each type leaves its own footprint: thousands of clicks per install, seconds to install, impressions without viewability, data centers and uniformity, farm subnets, CR without approvals. General protection rests on tagging traffic, counting money by source, filtering before the offer and controlling quality after conversion. There is no such thing as 100% protection, but fraud you can see by source can be switched off and refunded.
