State of Digital Ad Fraud Q2 2017 by Augustine Fou

State of Digital Ad Fraud
Q2 2017 Update
May 2017
Augustine Fou, PhD.
acfou@mktsci.com
212. 203 .7239

“just because you can’t
detect it (fraud), doesn’t
mean it’s not there.”

May 2017 / Page 2marketing.scienceconsulting group, inc.
linkedin.com/in/augustinefou
Fraud diverts ad spend to fake sites
Good Publishers “sites that carry ads”
• No content
• No humans
• Low CPMS
Search Spend
$40 $40
Display Spend Other
$21$30
$3
Google Search FB+Google Display$29
(outside Google/Facebook)
Source: eMarketer March 2017

$29
There’s 15X more “sites with ads”
Good Publishers “sites with ads”
Source: Verisign, Q4 2016
329M
domains
159 million
“sites that carry ads”
11 million
“sites you’ve heard of”
WSJ
ESPN
NYTimes
Economist
Reuters
Elle
3%
no ads
ads
15X more

Mobile fraud steals ad dollars too
159 million
“sites that carry ads”
11 milion
“sites you’ve heard of”
WSJ
ESPN
NYTimes
Economist
Reuters
Elle
3%
no ads
7M
apps
Source: Statista, March 2017
96%
“apps that carry ads”
Search Spend
$40 $40
Display Spend Other
$21$30
$3
Google Search FB+Google Display$29
Source: eMarketer March 2017
Source: Verisign, Q4 2016
329M
domains
10,000
“apps you’ve heard of”
Facebook
Spotify
Pandora
Zynga
Pokemon
YouTube

Fake sites, fake apps -- no humans
Fake Sites
Source: Sadbottrue.com
Fake Apps
… they can sell ad
“inventory” at low prices

Display ads …
Increased CPM prices
by 800%
Decreased impression
volume by 92%
Source: http://adexchanger.com/ad-exchange-news/6-months-after-fraud-cleanup-appnexus-shares-effect-on-its-exchange/
260 billion
20 billion
> $1.60
< 20 cents

Video ads …
Source: Dec 2016 WhiteOps Discloses Methbot Research
“Methbot, steals $2 billion annualized;
and it avoided detection for years.”
1. Targeted video ad inventory
$13 average CPM, 10X
higher than display ads
2. Disguised as good publishers
Pretending to be good
publishers to cover tracks
3. Simulated human actions
Actively faked clicks, mouse
movements, page scrolling
4. Obfuscated data center origins
Data center bots pretended to
be from residential IP addresses

Mobile ads …
Source: May 2017, Tune
average 20% fraud
100% fraud
24 billion clicks on
700 mobile networks

Where is Ad Fraud
Concentrated?

CPM and CPC spend are primary targets
Leads
(CPL)
Sales
(CPA)
Lead Gen
$2.0B
Other
$5.0B
• classifieds
• sponsorship
• rich media
Impressions
(CPM/CPV)
Clicks
(CPC)
Search 27%Display 10%
Video 7%
60% fraud
40% fraud
80% fraud
Mobile 47%
50% fraud
91% digital ad spend Source: IAB FY2016 Report
mobile display mobile search

0
10
20
30
40
50
60
70
80
90
100
retail finance automotive telecom CPG entertainment pharma travel cons.
electronics
indexed spend share
indexed fraud rate
Every industry is affected, CPC vs CPM
High CPC industries
targeted with CPC Fraud
Source: Ad spend share data from IAB, May 2015 | Fraud rate data from Integral Ad Science Q2 2014 Fraud Report
High Spend industries
targeted with CPM Fraud

Two key ingredients of CPM and CPC Fraud
Impression
(CPM) Fraud
(includes mobile display, video ads)
1. Put up fake websites and
load tons of ads on the pages
Search Click
(CPC) Fraud
(includes mobile search ads)
2. Use fake users (bots) to
repeatedly load pages to
generate fake ad impressions
1. Put up fake websites to
participate in search networks
2. Use fake users (bots) to type
keywords and click on them to
generate the CPC revenue
screen shots
of fake sites

Fake sites have no content, no humans
Identical sites
made by template
Alphanumeric
domains
So they can sell ad
“inventory” at low prices
Source: Sadbottrue.com

Fake users made from automated browsers
Headless Browsers
Selenium
PhantomJS
Zombie.js
SlimerJS
Mobile Simulators
35 listed

Fake sites successfully sell ads… how?
100% viewability
(fake)
AD
Stack ads all
above the fold to
trick detection
0% NHT
(fake)
Buy traffic that is
guaranteed to
pass fraud filters
clean placement
(fake)
Pass fake source
or forge fake
placement details
http://www.olay.co
m/skin-care-
products/OlayPro-
X?utm_source=elle
&utm_medium=dis
play
+ +
“by tricking measurement and reporting”

Fake inventory sold on exchanges
publisherA.com
… but, PublisherA
does NOT sell ads
on open exchanges!
“Dark Revenue” is ad revenue diverted away from
publishers, so they don’t even see it’s missing.
• Large pubs – “dark” is 1-2X ad revenue
• Medium pubs - “dark” is 5-10X ad revenue
• Small pubs - “dark” is 20-100X ad revenue

Case in point… Chase
“JPMorgan had already decided
last year to oversee its own
programmatic buying operation.
Advertisements for JPMorgan
Chase were appearing on about
400,000 websites a month. [But]
only 12,000, or 3 percent, led to
activity beyond an impression.
[Then, Chase] limited its display
ads to about 5,000 websites. We
haven’t seen any deterioration on
our performance metrics,” Ms.
Lemkau said.”
“99% reduction in ‘reach’ … Same Results.”
Source: NYTimes, March 29, 2017
(because it wasn’t real, human reach)

Bad guys take advantage of
limitations in detection

Current detection is severely limited
In-Ad
(billions of ads)
• Limitations –
tag is in foreign
iframe, cannot look
outside itself
ad tag / pixel
(in-ad measurement)
In-Network
(trillions of bids)
On-Site
(millions of pageviews)
javascript embed
(on-site measurement)
• Limitations –
most detailed and
complete analysis
of visitors
• Limitations –
relies on blacklists
or probabilistic
algorithms, least info
ad
served
bot
human
fraud site
good site

Resulting in bad measurements
Incorrect IVT
Measurement
Sources 1 and 2
corroborate
Source 3
completely off
1x1 pixel
incorrectly reported as
100% viewable
Incorrect
Viewability

Tag placement matters .. A LOT
Tag
(in tag manager)
Tag
(in <DIV> on page)
window sizes detected
as 0x0 or 0x8 pixels correct window sizes
for ads detected
0% humans
60% bots
60% humans
3% bots

Fraud is Even More
Rampant in Mobile

Mobile is >50% of digital ad spend

MORE rampant fraud, LESS measurable
Bad apps
load ads in background
Source: Forensiq
Fake mobile devices
install apps; interact w/ them
Download and Install
Launch and Interact

Case File: 3 bad apps eat most of budget
com.jiubang com.flashlight com.latininput
75% of the
dark red

Mobile ad productivity waterfall
ad request
ad rendered
total clicks
net clicks
arrivals
apps opened
26%
NOT viewable
23%
fraudulent
48%
never arrived
2.8% CTR
66%
never used
1.77 billion
impressions
49.5 million
clicks
25.7 million
arrivals
34% install rate
8.7 million
apps used
Source: Mobile Marketing Magazine
0.5% productivity

Actively review and scrub campaigns
Period 1 Period 3Period 2
Initial baseline
measurement
Measurement after
first optimization
After eliminating several
“problematic” networks

Focus on conversions that humans do
Organic sources
have more humans
(dark blue)
Conversion actions (calls)
are well correlated to
humans; bots don’t call

Buy high quality, more humans
Lower quality paid sources
mean higher cost per human
acquired – like 11X the cost.
Sources of different quality send
widely different amounts of
humans to landing pages.

Allocate budget to productive sources
Measure
Ads
Measure
Arrivals
Measure
Conversions
346
1743
5
156
A
B
30X more human
conversion events
• More arrivals
• Better quality
more humans (blue)
good publishers
low-cost media,
ad exchanges

Verify analytics, look for anomalies
pages/visit
“bad guys’ bots are advanced enough to fake most metrics”
Demographics : Age Groups

Insist on line-item details from vendors
Line item details
Overall average
9.4% CTR
“fraud hides easily
in averages”
“line item details
reveal obvious fraud”

Don’t get fooled by common myths
1. Fraud is 2% and ‘on the wane’
No. It’s because you’re catching less of it; bots are getting
better at hiding (think Methbot, stayed hidden for years)
2. Fraud is ‘priced in’
No. You may be paying 1/10th the CPM, but you’re buying
10x more impressions; an ad shown to a bot is useless.
3. We’ve got fraud-free guarantees
Nice. But this assumes the detection tech can detect it;
what if it can’t detect it, or it gets tricked? Is it fraud free?

Good publishers act to reduce bots
Publisher 1 – stopped buying traffic
Publisher 2 – filtered data center traffic

Good publishers protect advertisers
On-Site measurement,
bots are still coming
In-Ad measurement, bots
and data centers filtered
11% red
-9% (filtered GIVT
and data centers)
2% red
“Filter data center traffic and not call the ads”

Good publishers protect their users
42 trackers
24.3s load time
8 trackers
1.3s load time
“minimize 3rd party javascript trackers on pages”

Good publishers reduce data leakage
specialized audience:
oncologists
Journal of Clinical Oncology
specialized audience can
be targeted elsewhere
“cookie matching”
(by placing javascript on your site)
ad revenue diverted away

Good publishers have good practices
“good business practices lead to good looking data”
Good Publishers “sites that carry ads”
• source traffic
• audience extension
• auto-refresh
• traffic laundering
• don‘t source traffic
• protect advertisers
• protect consumers

How can we tell “good” from “other?”
“Business practice review by independent 3rd party
provides the trust and assurance that distinguishes
good publishers from ‘sites that carry ads’.”

About the Author
May 2017
Augustine Fou, PhD.
acfou [@] mktsci.com
212. 203 .7239

Dr. Augustine Fou – Independent Ad Fraud Researcher
2013
2014
Follow me on LinkedIn (click) and on Twitter
@acfou (click)
Further reading:
http://www.slideshare.net/augustinefou/presentations
https://www.linkedin.com/today/author/augustinefou
2016
2015

Harvard Business Review
Excerpt:
Hunting the Bots
Fou, a prodigy who earned a Ph.D. from MIT at
23, belongs to the generation that witnessed
the rise of digital marketers, having crafted his
trade at American Express, one of the most
successful American consumer brands, and at
Omnicom, one of the largest global advertising
agencies. Eventually stepping away from
corporate life, Fou started his own practice,
focusing on digital marketing fraud
investigation.
Fou’s experiment proved that fake traffic is
unproductive traffic. The fake visitors inflated
the traffic statistics but contributed nothing to
conversions, which stayed steady even after the
traffic plummeted (bottom chart). Fake traffic is
generated by “bad-guy bots.” A bot is computer
code that runs automated tasks.

State of Digital Ad Fraud Q2 2017 by Augustine Fou

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie State of Digital Ad Fraud Q2 2017 by Augustine Fou

Ähnlich wie State of Digital Ad Fraud Q2 2017 by Augustine Fou (20)

Mehr von Dr. Augustine Fou - Independent Ad Fraud Researcher

Mehr von Dr. Augustine Fou - Independent Ad Fraud Researcher (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

State of Digital Ad Fraud Q2 2017 by Augustine Fou