How ad fraud actually works

The industry standard for a viewable display advertisement is that half its pixels sat inside the browser window for one continuous second. Video needs half the pixels for two seconds. For the very largest display units the threshold drops to thirty percent of pixels.

No eye required. No attention required. A fast scroll clears that bar comfortably, and a meaningful share of bought display impressions still fail to clear it.

Start there, because that is what an advertiser is buying: a geometric condition, briefly satisfied.

The unit of sale is a report

An impression is a line in a log file. Something requested an advertisement, an ad server sent one, and software on the far end reported back that it arrived. A click is the same species of object: a record that a request was made.

The advertiser does not own that software, cannot inspect the machine it runs on, and was not present for the event it describes. The market rests on an assumption that these reports track real people and real purchases closely enough that paying for the signal beats measuring the outcome.

Stretch that assumption and nothing visible changes, because every report still says success. It gets stretched in four broad ways, wildly different in size.

I have never bought a programmatic campaign. I run mobile proxy lines on carrier SIMs in Singapore and a rack of Android phones people rent by the hour, which is exactly the infrastructure that lights up as suspicious inside an invalid traffic model. A slice of my customers in that category are doing verification work, and that work has to look like an ordinary person on an ordinary network or it sees a different internet from the one being audited. The firms paid to catch fake traffic are among the larger buyers of the infrastructure fake traffic runs on.

Impressions nobody could see

The cheapest signal is an advertisement delivered honestly, somewhere no human eye can reach it.

There is the one pixel slot, tucked in a corner of a page, calling for full size creative all day. There is ad stacking, where one visible rectangle holds several advertisements layered on top of each other and every one counts as delivered. There is the slot that silently reloads itself every fifteen seconds while the reader sits in another tab.

None of this needs a bot. The audience can be real people reading real articles. What has been faked is the geometry of the page.

Traffic that was never a person

This is the category with the folklore, and it is real enough. Racks of handsets, rented servers running headless browsers, software that loads pages, plays video to completion and taps things. One operation dismantled in 2016 was reported to be clearing several million dollars a day by inventing video advertising slots with no audience behind them.

It is also the category the industry catches best, because it leaves evidence. A rented server sits on an address block registered to a hosting company. A headless browser renders differently from the phone it claims to be.

Which is why the invalid traffic rates you see quoted, typically between one and three percent, deserve a second look. They mostly describe this category, and mostly the easy half of it: known crawlers, addresses burned last year. The sophisticated half is measured with much less confidence, by parties whose commercial interest points one way.

Inventory sold under another site’s name

The third method fakes nothing about the audience. It rewrites the address on the envelope.

A real person loads a real page on a low value site. The bid request going out to the market describes that impression as inventory on a well known newspaper. The buyer pays newspaper prices. The newspaper never sees a cent and never knew the auction happened. For years this was the most profitable seat in the chain, because the gap between premium prices and the bottom of the market is enormous and buyers had no way to check.

The fix is the part of this story that plainly worked. In 2017 the industry’s technical standards body published a specification for a plain text file, ads.txt, that any publisher posts at the root of its own domain listing every company authorised to sell its inventory. Buying platforms read it before bidding, and anything offering that publisher’s name without appearing in the file gets refused.

Domain misrepresentation on the open web collapsed as a business within about two years.

The last click before a purchase that was already happening

The fourth category is the largest and the quietest, and almost never prosecuted, because from a distance it does not look like fraud.

The buyer had already decided. The tab was open, or the brand name was already typed into a search box. Then, in the last seconds before checkout, something steps into the path and gets recorded as the reason.

The forms vary. A search advertisement bought against a brand’s own name, so the company pays for a click it would have had free. A retargeting banner served to someone already sitting on the product page. An affiliate cookie written at checkout by a coupon extension the shopper installed, which is what a widely publicised investigation in late 2024 alleged about one very large shopping extension, with litigation following. In mobile, fabricated click reports fired just ahead of installs the network can already predict.

The experiments that expose this are old. Researchers working with eBay switched off its paid search advertising on its own brand terms across much of the United States, left it running elsewhere, and compared. Nearly all the traffic returned through free listings within days, and measured properly the return on that spend was negative. Procter and Gamble cut a nine figure sum from digital in one quarter of 2017 and reported no effect on sales.

Why the biggest category is the least policed

Because there is no victim inside the transaction who wants it stopped.

Follow the reporting around. The agency reports conversions. The affiliate network reports sales. The analytics dashboard, crediting last touch by default, records whoever stood nearest the buyer at the end. The brand manager reports a return on spend that justifies next year’s budget.

Every one of those numbers is accurate. The false part is the causal claim underneath them, and the causal claim is the one thing nobody in the chain is measured on. Catching a bot makes an agency look diligent. Demonstrating that half the conversions were arriving with or without the media makes the same agency look unnecessary.

The measurement problem

Verification vendors are paid on volume, usually a small fee per thousand impressions measured, so their revenue scales with the size of the market they audit. They sell to both ends of the chain: buyers pay for protection, and the platforms and publishers being measured pay for accreditation, integration and safety scoring. Inside the large closed platforms they measure only what the platform permits, on its own terms. Facebook disclosed in 2016 that it had spent two years overstating average video view time to advertisers because of how it had defined a view. That error was found internally. Nobody outside could have found it.

I am not accusing anyone of dishonesty. My position is narrower: design a system that reliably catches the cheap, visible, embarrassing category while leaving the expensive structural one untouched, and you would end up with something close to what exists.

The chain is the cause

Between an advertiser and a publisher sit five or six intermediaries. Agency, buying platform, exchange, selling platform, often a reseller between that platform and the site, sometimes two.

A study commissioned by British advertisers and run by one of the large accountancy firms tried to trace individual pounds end to end through that chain. Roughly half of what advertisers spent reached a publisher, and around fifteen percent could not be attributed to any identifiable party. The researchers called it the unknown delta. A rerun three years later found it much smaller, which is progress and which also tells you the first figure was real.

Every hop rewrites the description of the impression before passing it on, and each intermediary sees only its immediate neighbours. Nobody holds the whole record, which is the condition under which a claim made in the middle becomes very hard to check. A study by American advertisers of open web programmatic spending found the average campaign running across roughly 44,000 separate websites, with about a fifth of impressions landing on properties built for no purpose beyond carrying advertising. Nobody chose that. It is what a long chain of automated intermediaries optimising on cost per impression produces on its own.

What I had wrong

I assumed for years that ad fraud was fundamentally a bot problem. I sell infrastructure that gets classified as bot infrastructure, so I read the detection research, and that research is almost entirely about the second category. Fingerprints, timing regularity, address reputation, emulator artefacts. I took it to be the war. It is only the part of the war that leaves fingerprints.

I was also wrong about ads.txt. When it shipped I read it as cosmetic, a self certified list nobody would enforce. It worked, and the lesson runs opposite to what I expected. This industry can fix a problem inside two years when every party in the chain is losing money from it. Publishers hated being impersonated and buyers hated overpaying, so the fix stuck. Attribution capture survives precisely because it fails that test. No participant’s reported numbers get worse when it happens.

What actually shifts the number

The defences that work are dull, and they are one idea in different clothes: stop trusting the report and measure the outcome.

Hold out a region. Switch the spend off in one market, leave it running in a comparable one, and compare sales curves rather than dashboards. Shorten the chain: buy from fewer places, read the seller identifiers in the bid stream, cut the domain list from tens of thousands to hundreds. JPMorgan Chase did that in 2017, dropping from around 400,000 sites to 5,000, and reported no measurable loss in performance. Audit log level data instead of the summary somebody else prepared, and treat any measurement from a party that earns more when the number is bigger as an input rather than an answer.

None of that is exotic. It is work whose reward is a smaller number at the end of the quarter, which is why it stays rare.

What makes this economy strange is how little of it requires anyone to decide to be dishonest. A market that pays on reported signals instead of outcomes drifts toward whoever can manufacture the cheapest signal. Outright fraud is the far end of a slope the whole structure already sits on.

More on the machinery running underneath the ordinary internet at The Hidden Internet.

Get new guides and videos first — join the Telegram channel.