State of Digital Ad Fraud Q1 2015 Update by Augustine Fou

The
State of Digital Ad Fraud
Q1 2015 Update
May 2015
Augustine Fou, PhD.
acfou [at] mktsci. com
212. 203. 7239

May 2015 / Page 2marketing.scienceconsulting group, inc.
Dr. Augustine Fou
UPDATED: Full Year 2014 Digital Ad Spend – $50B
Impressions
(CPM/CPV)
Clicks
(CPC)
Leads
(CPL)
Sales
(CPA)
Search 38%
$18.8B
Video 7%
$3.5B
Lead Gen 4%
$2.0B
10% Other
$5.0B
Source: IAB, FY 2014 Internet Advertising Report, May 2015
$42.5B
Display 16%
$7.9B
Mobile 25%
$6.2B$6.2B
CPM Performance
• classifieds
• sponsorship
• rich media
$7.0B

Dr. Augustine Fou
Impressions and clicks remain the biggest targets
Impressions
(CPM/CPV)
Clicks
(CPC)
Search
$18.8B
86% digital spend
Display
$7.9B
Video
$3.5B
Mobile
$6.2B$6.2B
Leads
(CPL)
Sales
(CPA)
Lead Gen
$2.0B
Other
$5.0B
• classifieds
• sponsorship
• rich media
estimated fraud
not at risk
(84% in 2013)

Dr. Augustine Fou
Two main types of fraud and how each is generated
Impression
(CPM) Fraud
(includes mobile display, video ads)
1. Put up fake websites and load
tons of ads on the pages
Search Click
(CPC) Fraud
(includes mobile search ads)
2. Use bots to repeatedly load
pages to generate fake ad
impressions (launder the origins
of the ads to avoid detection)
1. Put up fake websites and
participate in search networks
2a. Use bots to type keywords to
cause search ads to load
2b. Use bots to click on the ad to
generate the CPC revenue

Dr. Augustine Fou
Fraud goes up as digital ad spend continues upward
Digital ad fraud
High / Low Estimates
plus best-guess (36%)
Published estimates
Digital ad spend
Source: IAB Annual Reports
$ billions
E

Dr. Augustine Fou
Digital ad fraud is larger than many other types of fraud
$24 billion
Counterfeit
goods
5,000 robberies in 2011
$18 billion
Somali
pirates
39% of
global digital
ad spend
($171B 2015E)
Source:
eMarketer
March 2015
$5 billion
Tax
fraud
Bank
robberies
$38 million
$67 billion
globally
“A third of traffic is bogus”
WSJ, March 2014
$1 billion
ATM
Malware
U.S Credit Card
Fraud 2014
$32 billion
$21 billion
U.S.

Dr. Augustine Fou
Estimates of fraud vary widely; which is right?
3%
Dstillery, Oct 9, 2014_
“findings from two independent third parties, Integral Ad
Science and White Ops”
3.7%
Rocket Fuel, Sep 22, 2014
“Forensiq results confirmed that ... only 3.72% of impressions
categorized as high risk.”
57%
Telemetry, May 26, 2014
“Telemetry found that 57 per cent were “viewed” by automated
computer programs rather than real people.”
25 - 50%
WhiteOps, Jul 14, 2014
“digital ad fraud outbreak – one that gobbles up roughly $14 billion in
advertising spend and between 25 and 50% of ad spend per campaign”
45%
Solve Media, Sep 19, 2014
“suspicious web activity dropped to 45% – still a high figure, but an
improvement nonetheless from the high of 61% in Q4 2013”
“Whatever the number, there is no refuting that there is
ad fraud... and job one is to find the fraud impacting
your business and extinguish it....” -- Dr. Augustine Fou
2 - 3%
comScore, Sep 26, 2014
“most campaigns have far less; more in the 2% to 3% range.”

Dr. Augustine Fou
0
10
20
30
40
50
60
70
80
90
100
retail finance automotive telecom CPG entertainment pharma travel cons.
electronics
indexed spend share
indexed fraud rate
Ad fraud impacts every industry vertical
High CPC
industries
Source: Ad spend share data from IAB, May 2015 | Fraud rate data from Integral Ad Science Q2 2014 Fraud Report

Dr. Augustine Fou
Fraud siphons 1/3 of dollars out of ad ecosystem
Advertisers
“ad spend” in digital
is $56B in 2015
Publishers
are left with only
2/3 of the dollars
Bad Guys
siphon 1/3 of ad spend
OUT of the ecosystem
• Ad dollars are being siphoned OUT of the ecosystem into the pockets of the bad guys
• Advertisers have lower ROI due to fraud (fake impressions, non-humans)
• Publishers have lower revenues (ad dollars stolen by bad guys)
2/3
1/3
Users
use ad blocking and
need to protect privacy

Dr. Augustine Fou
Motive & Opportunity – More programmatic, more fraud
As more digital ads are
placed entirely
programmatically, the
opportunity for fraud
continues to increase.
Bad guys also fully
automate their digital ad
fraud operations, using
programmatic tools.

Dr. Augustine Fou
Viewability is not fraud; but often mentioned together
Viewability (or lack thereof) is not fraud; but it is often mentioned together with ad
fraud because early forms of fraud involved bad guys overloading ads on the page
Bad Guys Publishers

Dr. Augustine Fou
Bad guys have already “defeated” viewability
In fact, bad guys’ sites may even have 100% viewability (even while the industry
continues to debate its definition) by arraying all the ads above the fold to trick
tracking technology to appear to be 100% viewable
Source: Spider.io May 2, 2013
AD
Ad Stacking

How Impression (CPM) Fraud Works

Dr. Augustine Fou
The two main ingredients of programmatic fraud
Fake Sites Fake Users
1
2
3
4
5
6
7
8
9
10
Designed with no real content;
exists only to carry ads
Bots are automated browsers
which load webpages to load ads

Dr. Augustine Fou
19 blocked ads on page
1. Bad guys put up fake sites
site = analyzecanceradvice .com
site = missomoms.com

Dr. Augustine Fou
2. Load tons of ads (Display, Video) on pages
http://interiorcom plex.com/
http://modernbab y.com/

Dr. Augustine Fou
3. Use bots to repeatly load pages and cause impressions
Current forms of ad fraud involve virtual browsers spun up by the millions in data
centers to load webpages to create ad impressions or to make fake clicks
Source: Google Digital Attack Map

Dr. Augustine Fou
Sites can be grouped into three “strata”
Sites, networks and exchanges
that cheat or look the other way
• Stacked ads, auto-refresh
• High ad-load, low viewability
• Purchased traffic, audience expansion
Sites created solely for ad fraud
• Created by template/algo
• Enormous quantity of ads
• All traffic/impressions from bots
Mainstream publishers with human + bot traffic
• Legitimate publishers with real content that humans
engage with, interact, read and watch
• An unknown percentage of malicious bot traffic designed to
enrich their cookie-profiles for later high-value re-targeting
FRAUDSITE
bot
bot
bot
bot
bot
bot
PUBLISHERuser
bot
user
crawler
user
bot
2/3 1/3

Dr. Augustine Fou
Examples of Fake/Fraud Websites
• Algo generated using
templates (e.g. The
same wordpress
template)
• No content or
plagiarized content
• Stuffed with
keywords ands ads
• Uses keyword
domains or domains
with lots of numbers
in them
• Sends large
quantities of ad
impressions and
search clicks

Dr. Augustine Fou
Examples of Known/Observed Bots (User Agents)
Headless Browsers
Selenium
PhantomJS
Mobile Simulators
35 listed

Dr. Augustine Fou
1. Bad guys choose expensive keywords
homemadesimple.comolay.com
“cosmetic face lift”
$10.84 CPC
“residential home cleaning”
$9.95 CPC
> 100,000 monthly searches
avg position 1 – 10
sort by highest avg CPC
Source: iSpionage

Dr. Augustine Fou
2. Their bots type keywords on sites they control
buy eye cream online
healthsiteproduc tionalways.com

Dr. Augustine Fou
3. Bots click on search ad to create CPC revenue
Olay.com ad
in #1 position

Dr. Augustine Fou
4. Pass fake URL trackers to hide the origin of the clicks
Click thru URL
passing fake source
“utm_source=msn”
http://www.olay.com/skin-care-
products/OlayPro-
X?utm_source=msn&utm_medium=
cpc&utm_campaign=Olay_Search_D
esktop_Category+Interest+Product.P
hrase&utm_term=eye%20cream&ut
m_content=TZsrSzFz_eye%20cream_
p_2990456911

Dr. Augustine Fou
Examples of search fraud domains observed
http://analyzecanceradvice .com
http://analyzecancerhelp .com
http://bestcanceropinion .com
http://bestcancerproducts .com
http://bestcancerresults .com
http://besthealthopinion .com
http://bettercanceradvice .com
http://bettercancerhelp .com
http://betterhealthopinion .com
http://findcanceropinion .com
http://findcancerresource .com
http://findcancertopics .com
http://findhealthopinion .com
http://finestcanceradvice .com
http://finestcancerhelp .com
http://finestcancerresults .com
http://getcancerproducts .com
36,000+ more
sites like these,
designed to show
search ads and
self-click on them
to siphon CPC
revenue

Bots Are the Main Cause of Ad Fraud

Dr. Augustine Fou
Bad bots are the primary tool for stealing ad dollars
Retargeting fraud
• Bots come to advertisers site to collect cookie
• Bots visit other sites owned by bad guys
• Retargeting follows them around to show ads
• When ad impression is served on bad guys sites, they
earn the CPM revenue
Diverting ad dollars
• CTR manipulation: bots go to premium site to
generate pageviews without clicks (lowers the
sitewide CTR ); optimizers divert dollars to sites with
higher sitewide CTR (bad guy sites)
• Fake viewability: bad guys stack all ads behind each
other so they are all viewable; optimizers divert
dollars to sites with higher viewability (bad guy sites)
Source: ANA / White Ops Study
Published December 2014 [PDF]
Generate fake ad impressions and clicks
• Bots repeatedly load pages or ads to make impressions
• Bots can also “type” search keywords and click on
search ads to create fake clicks

Dr. Augustine Fou
Different kinds of bots generate fake impressions/clicks
Malware (on PCs)Botnets (from datacenters)
Toolbars (in-browser)Javascript (on webpages)

CONFIDENTIAL
Bad guys’ bots are not in ANY official bot list
10,000
bots observed
in the wild
user-agents.org
bad guys’ bots
3%
Dstillery, Oct 9, 2014_
“findings from two independent third parties,
Integral Ad Science and White Ops”
3.7%
Rocket Fuel, Sep 22, 2014
“Forensiq results confirmed that ... only 3.72% of
impressions categorized as high risk.”
2 - 3%
comScore, Sep 26, 2014
“most campaigns have far less; more in the
2% to 3% range.”
industry bot list “not on any list”
disguised as normal browsers –
Internet Explorer; constantly
adapting to avoid detection”

Dr. Augustine Fou
Humans vs “honest” bots vs fraudulent bots
Confirmed humans
• found page via search
• observed events (mouse click
with coordinates)
“Honest” (declared) bots
• search engine crawlers
• declare user agent honestly
• observed to be 1 – 5% of
websites’ traffic
Fraud bots
• come from data centers
• malware compromised PCs
• deliberately disguise user
agent as human users

Dr. Augustine Fou
Bot fraud and activity observed as high as 100%
Source: ANA / White Ops Study Published December 2014 [PDF]
display ads
11%
25%
video ads
23%
50%
sourced traffic
52%
100%
ANA/WhiteOps Study
What We’ve Seen
Case 1 Case 2

Dr. Augustine Fou
“bad bots are about 1/3rd”
Multiple sources comfirm levels of bot activity and traffic
Source: Incapsula 2014
http://www.incapsula.com/blog/bot-traffic-report-2014.html
Source: Solve media 2013

Dr. Augustine Fou
Bots morph to target verticals with highest ad spend
Source: DataXu/DoubleVerify Webinar, April 2015

Dr. Augustine Fou
Even “good” bots still cost advertisers money
iSpionage (harvest search ads)Moat (harvest display ads)

Techniques for Committing Fraud

Dr. Augustine Fou
Techniques to generate more impressions
AD
Ad stacking (dozens in one call) Pixel Stuffing (hiding more ads)
Source: DoubleVerify Case Study
Sourced Traffic (more pageviews) Ad Injection (replace ads)
Image Source: BenEdelman.org
The ANA/WhiteOps study also found rampant injection fraud,
including one publisher whose site was hit with 500,000 injected ads
every day for the duration of the two-month study.

Dr. Augustine Fou
Techniques to hide fraudulent activity
Domain / IP Spoofing Impression Laundering
Source: Whiteops/ANA Study Dec 2014
Stacked Redirects Passing fake variables
Known blackhat
technique to hide
real referrer and
replace with faked
referrer.
Example how-to:
http://www.blackhatworld.co
m/blackhat-seo/cloaking-
content-generators/36830-
cloaking-redirect-referer.html
Make it appear that
the impression came
from legit site
http://www.olay.com/skin-care-
products/OlayPro-
X?utm_source=msn&utm_medium=cpc&
utm_campaign=Olay_Search_Desktop_Ca
tegory+Interest+Product.Phrase&utm_ter
m=eye%20cream&utm_content=TZsrSzFz
_eye%20cream_p_2990456911
Easily trick analytics platforms to think the
impression came from legit source

How The Industry is Fighting Fraud

Dr. Augustine Fou
Industry associations are leading the charge
“We must create an all-inclusive program
that identifies qualified participants, and
commits them to good actions,
guaranteed by continual monitoring and
sanctions for non-compliance,” said
Randall Rothenberg, IAB.
“Together we can continue to rebuild
the trust that is necessary for the
interactive marketing industry to
thrive,” said Nancy Hill, President and
CEO, 4A’s
“We’ve invested [heavily] in data
and data technology and [have]
been very much at the forefront of
fraud verification,” said John
Montgomery, GroupM
Bob Liodice, President and CEO of the ANA
said, “It is imperative that the ecosystem
addresses online fraud and improves media
measurement and transparency.”
September 30, 2014 - IAB, 4A’s, and ANA
announce cross-industry organization to fight
ad fraud, malware, and piracy.

June 2015 / Page 41marketing.scienceconsulting group, inc.
CONFIDENTIAL
Comparison matrix of anti-fraud solutions
Vendors Description Mitigation
WhiteOps
Forensiq
Pixalate
On-site • Typically javascript code installed on
websites (like analytics)
• Detect parameters about the user
and computing environment
• blacklist sites
that send traffic
that is mostly
bots
DoubleVerify
Integral Ad Science
In-ad
exchange
• Real-time decisioning in the bid-
stream using rules and blacklists (e.g.
if a site is on a blacklist, don’t serve
the ad)
• reject users and
reject sites in
real-time based
on blacklists
SolveMedia
AreYouAHuman
reCaptcha
Challenge
based
• Using captchas and other challenges
which ask humans to verify
themselves as humans
• identify and
whitelist humans
for use in RTB
decisioning
Incapsula
Distil Networks
Spider.io
Network
analysis
• Analysis of network traffic and
technical analysis of visitors to
prevent scraping, content theft,
fraudulent JS execution
• deflect traffic
from known
sources of bots,
reject individual
visits

Dr. Augustine Fou
Recommendations for reducing fraud
Move beyond just viewability; tackle NHT/bot fraud
• Even if viewability was solved, if the impression was caused to load by a bot, it is
still fraud and money wasted for the advertiser
Allocate budget toward mainstream, premium publishers
• Allocate ad spend away from long-tail sites in ad exchanges that have the most
fraud; the more direct way to reduce bot fraud is to buy mainstream sites
Demand full transparency and independently verify
• If they can’t show you where each ad impression was served, don’t buy it; put in
place your own checks and balances
Focus less on impressions served or traffic, more on observable actions
• If we focus on actions that can be observed rather than tonnage of ads served, and
incentivize our agencies differently, we avoid the temptation of buying lower cost
(lower quality) ad inventory

Dr. Augustine Fou
Humanness ScoreTM
- Peer-Reviewed, Open-Standard
Definitions: J9NGT6H3 = client/entity identifier; 65 = humanness score - 0
(bots) to 100 (human); i = in-ad | o = on-site; ^9 indicates the order of
magnitude of the data set - e.g. billions.
Score Syntax: < J9NGT6H3 | 65 (i^9) >
A higher Humanness Score means a higher proportion of confirmed humans and
good policies and disclosures that go along with ensuring a human audience. A
higher Humanness Score should also lead to higher premium CPM or CPC -- this
rewards premium publishers for their good work and "playing by the rules" and
rewards advertisers with better performance for their ad spending.
https://www.linkedin.com/pulse/humanness-score-open-standard-peer-reviewed-digital

Dr. Augustine Fou
Humanness ScoreTM
– How it is Calculated
Three Ingredients Used to Calculate
Policies - 20% of score
• does the entity purchase or source traffic of any kind?
• does the entity have published policies protecting users' privacy and does it consistently act
according to these policies (see the EFF's Privacy Badger Initiative)
• does the entity sell data -- e.g. cookie matching, cookie profile, collected or derived data
Data - 50% of score
• continuously measured data points on ad impressions and visits to websites - a minimum of 1 billion
in-ad data points required for certification; and X million on-site data points for websites (depending
on natural traffic volumes).
• how often data like website and cookie blacklists are updated
• whether the appropriate anti-fraud vendors are used and how the technology is deployed
Disclosures - 30% of score
• whether the entity provides full transparency to peers by providing access to visit level data so that
peer can verify parameters like placement, viewability, and other metrics
• whether the entity provides access to auditors of the sites on which the ads were run, the sources of
traffic, and the recipients of media payments.
• whether the entity generates and shares threat data with peers

Dr. Augustine Fou
Humanness ScoreTM
– Ad Network Comparison
Ad Network AAd Network B Ad Network C
< 7N20D7NC | 69 (i^6) >
< NXDK1MWR | 52 (i^9) >
< MQ3K5VWT | 100 (i^7) >
< MC8RNDY7 | 79 (i^6) >
Ad Network D

Fraud Mitigation Success Stories

Dr. Augustine Fou
Success stories of advertisers reducing ad fraud
Impressions / Traffic
(CPM/CPV)
Clicks
(CPC)
[ pharma ]
18%
Shifted paid search
budgets away from
fraud websites that
carried search ads
and sent fake clicks
[ skincare ]
10%
[ haircare ]
1%
[ cosmetics ]
6%
• Blacklisted hundreds-of-thousands more sites
• Set up more frequent blacklist / whitelist update intervals
• Adjusted parameters to proactively discard suspicious bids
• Updated ROI measures to focus on human actions
• Cut off spending in certain categories, ad types, vendors
[ franchise ]
47%
[ technology ]
9%
[ non-profit ]
39%
[ med device ]
11%

Dr. Augustine Fou
Click fraud case study: allocating away from fraud sites
18% of spend shifted from fraudulent websites to “top 5” good guys
BEFORE
Top 2 “good guys” = 76%
AFTER
Top 5 “good guys” = 94%

Dr. Augustine Fou
Display ad case study: allocate to better ad networks
Period 1 Period 2 Period 3
20% confirmed humans
190k
5k
220k
6k
280k
7k
total goal events
average daily goals

Dr. Augustine Fou
Dr. Augustine Fou – Independent Ad Fraud Researcher
“I advise advertisers and their agencies on
the technical aspects of fighting digital ad
fraud. Using forensic technologies and
techniques I help to assess the threat and
the current countermeasures in order to
recommend additional steps that can be
taken to combat fraud and improve ROI.”
FORMER CHIEF DIGITAL OFFICER, HCG (OMNICOM)
MCKINSEY CONSULTANT
CLIENT SIDE / AGENCY SIDE EXPERIENCE
PROFESSOR AND COLUMNIST
ENTREPRENEUR / SMALL BUSINESS OWNER
PHD MATERIALS SCIENCE (MIT '95) AT AGE 23
Articles: https://www.linkedin.com/today/author/84444-augustinefou
Slideshares: http://bit.ly/augustine-fou-slideshares
Bio: http://linkd.in/augustinefou acfou@mktsci.com | 212.203.7239

State of Digital Ad Fraud Q1 2015 Update by Augustine Fou

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to State of Digital Ad Fraud Q1 2015 Update by Augustine Fou

Similar to State of Digital Ad Fraud Q1 2015 Update by Augustine Fou (20)

More from Dr. Augustine Fou - Independent Ad Fraud Researcher

More from Dr. Augustine Fou - Independent Ad Fraud Researcher (20)

Recently uploaded

Recently uploaded (20)

State of Digital Ad Fraud Q1 2015 Update by Augustine Fou