How advertisers can protect themselves from ad fraud

Christmas sales have long since ceased to be the most important time of the year for retailers alone. Online retail is booming - especially in Corona times - and with it the advertising industry. That's because companies want to place their ads on the Internet in the best possible way. In 2019 alone, net sales for digital advertising amounted to EUR 3.61 billion, according to the German Digital Industry Association (BVDW). But as the Christmas season approaches, so does the risk of ad fraud: online advertising fraud worth billions at the expense of advertisers. In this case, an advertising service is either faked or provided inadequately or not at all by means of fake ads, websites, user identities or clicks with fraudulent intent.

How does the ad fraud work? 

Ad fraud is sophisticated and there are different types, whether by manipulating ad impressions or clicks. Classic click fraud, the manual click on an ad banner, for example, is professionally operated by means of click farms or bots. Low-paid employees click advertising banners, text ads and videos - or software programs suggest human click behavior and thus generate traffic and high click numbers. Bots can act together in a botnet via networked computers, with the click fraudsters using malware to gain access to other people's PCs. The result: the advertiser pays for nothing in return.

This also concerns manipulation of impressions, for which there are various methods. With ad stacking, several ads are sold on one placement, but only one is visible. This method is often found in combination with ad stuffing or pixel stuffing: the ads are placed, but the user cannot see them because they are invisible or only 1 x 1 pixel in size. Ad views are thus high, but click-through rates are low.

A fraudulent procedure is also the "hijacking" of other people's ads, ad hijacking. Advertisements are copied in their entirety in order to place the advertiser's own link instead of that of the brand. If a URL is faked in order to make the advertiser believe that he is advertising on a well-known website, this is domain spoofing, which is often combined with ad fraud in search engines. Internet scammers create fake websites with appropriate keyword coverage, which rank in the top positions in search engines and pretend to be well-known. However, advertisers only book places on these sites without customers and lose visibility.

What damage does ad fraud cause?

Internationally, the damage caused by ad fraud is in the billions. According to the security provider White Ops, it is around USD 7 million per year in the USA alone. The British Financial Times, itself a victim of domain spoofing, put the damage it and its advertising customers suffered at 1.1 million euros a month in 2017. The "Hyphbot" botnet, uncovered in the same year, spoofed 34,000 domain names and over half a million URLs. The estimated damage amounted to 500,000 euros per day.

The biggest ad fraud scandal to date cost the advertising industry $36 million. Police authorities and the FBI exposed two globally organized click fraud rings in 2018. Eight men operated this so-called 3ve Systen. From 2014 to 2018, they forged websites and user identities, among other things, and gained access to 1.7 million PCs of private users and companies via malware.

On the German market, ad fraud is also on the rise and had an increase of 30 percent in the second half of 2018 alone. With net sales of EUR 3.6 billion and an ad fraud rate of 4.2 percent, as informed by the BVDW, the damage amounted to around EUR 150 million in 2019.

Who benefits from ad fraud and who are the victims?

While criminals and fraudulent networks profit from ad fraud, the victims do not only include advertising marketers themselves who place ads. Large publishers are just as affected as small website operators, online retailers or bloggers who offer or buy advertising space. Not to be forgotten are Internet users whose PCs are hacked by click fraudsters and misused for illegally operating botnets.

How can advertisers protect themselves? 

Protection is already provided by the shortest possible supply chain for ad booking, which comprises no more than two steps: From the publisher to the ad network and from there to the ad exchange. Transparency, for example in the form of a whitelist, additionally creates more security in ad sales. The ads.txt script, initiated by the international advertising association Interactive Advertising Bureau (IAB), takes targeted action against domain spoofing. Google supports the initiative and insists on a file that, like robots.txt, is stored in the roots directory of a website. Publishers and advertising networks can list here official sales platforms and providers with whom they cooperate in the sale of advertisements. The ads.cert is a further development and addition. Publisher signs the "Bid Request" with which a seller or reseller authenticates himself in the ads.txt file. This means that even a subsequent change can be traced.

Quality is another criterion to protect against ad fraud by giving preference to trustworthy partners, such as premium publishers. This does require a higher investment. However, ads perform significantly better on websites that appear trustworthy to the user.

Furthermore, control is and remains an important factor. For example, Google now monitors the click figures of advertisements with an online filter. Google employees then check suspicious activities in connection with date, time and IP address. Users of Google Ads and Google Analytics can also check fluctuations in click numbers when monitoring their advertising campaigns and report them if necessary.

Conclusion: The fight is not hopeless

Ad fraud is a problem that poses new challenges for the advertising industry. Fraudsters and black sheep will always try to participate in the billion-dollar ad business. With every new technique against ad fraud, resourceful fraudsters develop new loopholes. The battle is therefore not hopeless, provided publishers and advertisers focus on quality and transparency - and trust in professional online marketing is not lost. This is guaranteed, for example, by the right selection and placement of suitable advertising media and cooperation with trustworthy websites and online partners in the premium environment. Professionally defined Google AdWords campaigns, target group-oriented advertising and bidding strategies, and conscientious monitoring and control of the click figures of advertising campaigns in Google Ads and Google Analytics create additional security.