A campaign report shows plenty of clicks and almost no sales. What is ad fraud? It is the use of deceptive practices that manipulate ad metrics to steal advertising budgets, and it is often labelled invalid traffic.
For the wider mechanics of buying and selling media, start with what is ad tech. Fraud inflates the counts explained in what is an ad impression. Spoofed sites also pose as premium publishers, which matters for anyone reading what is display advertising.
Fraud and invalid traffic: related, not interchangeable
Ad fraud is often referred to as invalid traffic, or IVT, meaning fake impressions, clicks, conversions or events, according to MindK’s ad fraud detection guide. The shortcut hides a useful difference. Invalid traffic also includes automatic traffic from crawlers, legitimate bots and proxy traffic, and that traffic is not always trying to deceive anyone.
A practical way to hold the two ideas apart is to treat IVT as the measurement label for traffic that should not count as real audience. Fraud is the deliberate, deceptive part of it. The table below tests four common assumptions against that distinction.
| Common belief | Supported picture | Planning use |
|---|---|---|
| Fraud means bots clicking | Click fraud occurs when automated bots or individuals repeatedly click on ads with no intention of engaging with the content. | Review click patterns and engagement, not only bot flags. |
| Basic filtering catches everything | Standard list filtering or parameter validation detects general invalid traffic, while advanced bots are sophisticated enough to bypass basic detection methods. | Add deeper analytics for traffic that imitates people. |
| Premium-looking sites are safe | Fraudsters disguise low-quality or non-existent websites as premium publishers. | Check who is authorized to sell the inventory, not only the site name. |
| A detection report is a final verdict | Almost all the methodologies companies use to detect ad fraud are not 100% accurate. | Read flagged and unflagged counts as estimates, not exact totals. |
Definitions and detection details above draw on NEXD’s ad fraud explainer and MindK’s detection guide.
General and sophisticated invalid traffic
Invalid traffic splits into a general and a sophisticated category, and the split decides which control can catch it. The difference is whether the traffic tries to look human.
- General invalid traffic (GIVT). This is automatic traffic generated by crawlers, legitimate bots and proxy traffic, and it does not simulate human behavior. Standard list filtering or parameter validation can detect it, according to MindK.
- Sophisticated invalid traffic (SIVT). This traffic is much more difficult to deal with because it mimics human behavior. It behaves like an audience, so a simple list of known bad sources does not remove it.
Bot farms show why the sophisticated end is hard. NEXD describes them as data centers with devices programmed to mimic real user behavior. A buyer should expect any verification vendor to handle the general category, so the vendor’s approach to the sophisticated category is the better test.
Common ad fraud types and the control that fits each
Each common fraud type breaks a different assumption in the buying chain, so each is best met by a different control. The groups below pair the tactic with the check that addresses it.
Spoofed and unauthorized inventory
Domain spoofing is when fraudsters pass off low-quality inventory as high-quality inventory. NEXD adds that the disguised sites can be low-quality or non-existent. The matching control is ads.txt, a file that lets publishers declare who is authorized to sell their inventory. A buyer can then check a seller against that declaration instead of trusting a name.
Hidden and stacked ads
Ad stacking means displaying a number of ads on top of each other. Only the top ad is visible, but all are reported as viewed, which creates false impression counts. Pixel stuffing is a related trick in which tiny, often invisible ads of 1×1 pixels are placed on web pages. Both produce impressions nobody could see, so viewability checks are the natural control. One vendor method counts an ad as viewed only when all five key pixels (four corners and the center) are visible.
Fake clicks and bot networks
Click fraud is repeated clicking by automated bots or individuals with no intention of engaging. Botnets are networks of infected devices, while bot farms concentrate devices in data centers. These sources feed the sophisticated category described above, so deep analytics rather than simple filters is the control to look for.
How ad verification detects fraud
Ad verification detects fraud by layering checks, with simple filters for obvious traffic and deeper analysis for traffic that imitates people. No single check covers every fraud type.
- Filter against lists and validate parameters. This is the standard route for general invalid traffic, as MindK explains.
- Test visibility. The five-pixel viewability method described by NEXD discounts ads that are not actually on screen.
- Apply deep analytics. Detecting sophisticated traffic requires deep analytics and a reliable tech vendor with good experience in the field.
The pitfall is stopping at the first step. Because advanced bots can bypass basic detection methods, a verification set-up built only on list filtering can report clean traffic while the harder category passes through. When comparing vendors, ask how each one detects sophisticated traffic, and who can see the underlying analytics behind a flag.
Who is responsible in the ad chain
Responsibility for fraud prevention is shared, because each control sits with a different party in the chain.
- Publishers. They declare authorized sellers in ads.txt and should keep the file updated and accurate to prevent unauthorized sales of their inventory.
- Advertisers and buyers. They choose the verification vendor and decide how much traffic scrutiny a campaign needs, since the general category is cheap to filter and the sophisticated one is not.
- Verification vendors. They run the detection layers and supply the analytics that buyers rely on.
The publisher control is the easiest to inspect, because the ads.txt declaration describes who may sell the inventory. An out-of-date file weakens that protection for both sides.
Reading fraud loss estimates
Published estimates of fraud losses differ from one report to the next. MindK notes that most tech companies and vendors do not want to share this data even for research purposes, so any headline total rests on partial information. When quoting a loss figure, name the organization that published it and the year, and avoid blending figures that use different methods.
Frequently asked questions
| Question | Answer |
|---|---|
| How does location fraud work? | Location fraud happens when the user’s actual location does not match the geotargeting. Geo masking is a tactic behind it, in which fraudsters disguise the geographical location of traffic so it appears to come from a desired region. |
| What is cookie stuffing? | Cookie stuffing means loading a user’s browser with several third-party cookies in order to generate commission. |
| Does ads.txt stop every kind of fraud? | No. Ads.txt addresses unauthorized sales of inventory by declaring who may sell it. Tactics such as click fraud or hidden ads need other detection controls. |
