In 2021 some marketers are still asking whether ad fraud is real and whether it is pervasive. This serves as a simple reminder of some of the evidence collected over the years.

1. 31 August 2021 / Page 0
FouAnalytics.com
STILL, NOTHING
BUT AD FRAUD
Augustine Fou, PhD.
acfou [at] mktsci.com

2. 31 August 2021 / Page 1
FouAnalytics.com
Digital media budgets to reach
$455B per year worldwide
https://www.emarketer.com/content/worldwide-digital-
ad-spending-2021
How much money is at stake?

3. 31 August 2021 / Page 2
FouAnalytics.com
Categories of digital ad fraud
Expanding the definition to include fraud in major digital buckets
Impression Fraud
(CPM) Fraud
(Marketers buy ad impressions on a cost-
per-thousand (CPM) basis, includes
mobile display, video ads)
Click Fraud
(CPC) Fraud
(Marketers buy ads based on a desired
action – like cost per click (CPC), includes
mobile and search ads)
Lead Fraud
(CPL) Fraud
(Marketers pay for leads on a cost-per-
lead (CPL) basis; but leads are entirely
faked by bots completing lead forms
Affiliate Fraud
(CPA) Fraud
(Marketers pay for “performance” – a
share of revenue on successful
transactions; but fraudsters falsely claim
credit for sales they didn’t cause)

4. 31 August 2021 / Page 3
FouAnalytics.com
Advertisers Turned Off
Digital, no change

5. 31 August 2021 / Page 4
FouAnalytics.com
P&G: cut $200M, no impact
“Once we got transparency, it
illuminated what reality was,” said
Mr. Pritchard. P&G then took matters
into its owns hands and voted with
its dollars, he said.”
“As we all chased the Holy Grail of
digital, self-included, we were
relinquishing too much control—
blinded by shiny objects,
overwhelmed by big data, and ceding
power to algorithms,” Mr. Pritchard
said.
Source: WSJ, March 2018

6. 31 August 2021 / Page 5
FouAnalytics.com
Chase: -99% reach, no impact
“JPMorgan had already decided
last year to oversee its own
programmatic buying operation.
Advertisements for JPMorgan
Chase were appearing on about
400,000 websites a month. [But]
only 12,000, or 3 percent, led to
activity beyond an impression.
[Then, Chase] limited its display
ads to about 5,000 websites. We
haven’t seen any deterioration on
our performance metrics,” Ms.
Lemkau said.”
“99% reduction in ‘reach’ … Same Results.”
Source: NYTimes, March 29, 2017
(because it wasn’t real, human reach)

7. 31 August 2021 / Page 6
FouAnalytics.com
Uber: cut 80%, no change
• Uber cut $120M from $150M, signups remained steady; paid
signups dropped, and organic signups increased to replace it.
• Uber sued 100 mobile exchanges for falsifying placement
reports and fabricating transparency reports.

8. 31 August 2021 / Page 7
FouAnalytics.com
Other Similar Fraud Cases
Ad fraud looks the same, because it is the same
Criteo vs Steelhouse
• “Criteo sued SteelHouse for a "counterfeit click fraud scheme" that “counterfeited clicks
to trick e-tailers into attributing sales to SteelHouse that should have been attributed to
Criteo, other competitors and partners, or direct traffic.
Outcome Health settles with OIG
• “Outcome executives inflated patient engagement metrics regarding how frequently
patients engaged with Outcome’s devices. Outcome further admitted that its under-
delivery on advertising campaigns resulted in a material overstatement of its revenue for
the years 2015 and 2016. The company’s executives fabricated data to conceal the
under-deliveries from the outside auditor.“
Facebook Sues LionMobi, JediMobi
• "The app developers LionMobi in Hong Kong and JediMobi in Singapore released apps --
which make it appear as if users clicked on Facebook ads when they didn’t. LionMobi
released "Power Clean - Antivirus and Phone Cleaner App“ (100 million downloads) and
JediMobi created "Calculator Plus" (5 million downloads).”

9. 31 August 2021 / Page 8
FouAnalytics.com
Not Single-Digits Ad
Fraud, Nearly 100%

10. 31 August 2021 / Page 9
FouAnalytics.com
(2015) AppNexus purged 92% of ads
Increased CPM prices
by 800%
Decreased
impression volume
by 92%
Source: http://adexchanger.com/ad-exchange-news/6-months-after-fraud-cleanup-appnexus-shares-effect-on-its-exchange/
260 billion
20 billion
> $1.60
< 20
cents

11. 31 August 2021 / Page 10
FouAnalytics.com
Mobile app install fraud … some 100%
Source: May 2017, Tune
23% had over 20% fraud
100% fraud
24 billion clicks on
700 mobile networks

12. 31 August 2021 / Page 11
FouAnalytics.com
Lotame purges 400M bot profiles
“[LOTAME] purged 400
million of its over 4
billion profiles after
identifying them as
bots or otherwise
fraudulent accounts.
Lotame CEO Andy
Monfried estimated
that 40 percent of all
web traffic is fictional.”
Adweek, Feb 2018

13. 31 August 2021 / Page 12
FouAnalytics.com
monarch
ctv fraud
CTV Fraud Cases: 2020-21
https://www.buzzfeednews.com/article/craigsilverman/grindr-roku-apps-ad-fraud-scheme
https://www.adweek.com/programmatic/pixalate-ad-fraud-scheme-roku-murkiness-ctv/
https://www.marketingdive.com/news/recent-ctv-ad-fraud-scheme-could-be-biggest-ever/576226/
https://www.axios.com/multiterra-ad-fraud-scheme-911438e5-4a9d-4f2f-9284-e523bbe779f5.html
https://adage.com/article/digital/how-streamscam-made-145-million-no-streaming-content-and-ads-were-served-no-one/2302241
Dec 2020
“StreamScam”
Sep 2020
“MultiTerra”
Apr 2020
“IceBucket”
Mar 2020
“Monarch”
Jan 2020
“DiCaprio”

14. 31 August 2021 / Page 13
FouAnalytics.com
CTV Fraud Cases: 2020-21
https://www.adexchanger.com/digital-tv/doubleverify-uncovers-largest-ctv-ad-fraud-scheme-to-date/
https://www.mediapost.com/publications/article/361143/ctv-ad-fraud-scheme-sneakyterra-discovered.html
https://www.forbes.com/sites/thomasbrewster/2021/04/21/1-million-android-mobiles-hacked-by-fraudsters-to-watch-smart-tv-ads/
https://which-50.com/octobot-is-an-unprecedented-ctv-focused-fraud-scheme-with-multiple-tentacles-warns-doubleverify/
https://www.tvtechnology.com/news/doubleverify-ids-new-ctv-ad-fraud-scheme
Jan 2021
“ParrotTerra” Mar 2021
“SneakyTerra” Apr 2021
“Pareto” Apr 2021
“Octobot” August 2021
“SmokeScreen”

15. 31 August 2021 / Page 14
FouAnalytics.com
Enormous Quantities

16. 31 August 2021 / Page 15
FouAnalytics.com
(2017) Pop-Unders / Redirects
These forms of fraud typically get by current fraud detection tech
a.k.a. “zero-click” “pop-under”
“forced-view” “auto-nav”
Source: https://www.buzzfeed.com/craigsilverman/remember-tom

17. 31 August 2021 / Page 16
FouAnalytics.com
Many Times More Faked Bids
Flooding exchanges with faked bid requests, some are not caught
42X more “unpermissioned” yahoo than real
Even if a small percentage of the 609 billion got
through, that is still billions of fake ads

18. 31 August 2021 / Page 17
FouAnalytics.com
Massive daily ad volumes
Unknown sites sell more “inventory” than large, well-known sites
Highlighted
domains are
interspersed with
large sites that
you know many
humans go to.
These are DAILY
quantities of
impressions.
Notice the large
quantities; some
are larger than
mainstream sites.

19. 31 August 2021 / Page 18
FouAnalytics.com
Bad guys optimized efficiency
They have saved bandwidth and processing, and maximized revenues/profitability of fraud
fake sites
(2015)
sites auto-generated
by template to run ads
naked ad calls
(2017)
load just the ad to
save time and
bandwidth
faked bid requests
(2019)
no device or
browser needed

20. 31 August 2021 / Page 19
FouAnalytics.com
Why So Pervasive?

21. 31 August 2021 / Page 20
FouAnalytics.com
Easy to Do, Get Away With
DIY Criminal Trade-Off Matrix
Rob a Bank Sell Cocaine Digital Ad Fraud
Value of the
proceeds
$$$ $$$$$$$
Cost and materials
needed to attempt
$$ $$$ ¢
Probability of
success
low low
on my way to the
bank already
Likelihood of
getting caught
medium high 0.000000001%
Severity of injury
if caught
gunshot wound death
spilled soda on
self
$$$$$$$$$$$$$$$$$$$$$$$$

22. 31 August 2021 / Page 21
FouAnalytics.com
Most lucrative use of botnets
All bits and bytes, all stolen content – high profit margins selling ads
Source: https://hbr.org/2015/10/why-
fraudulent-ad-networks-continue-to-thrive
“the profit margin is 99% …
[especially with pay-for-use
cloud services ]…”
Source: Digital Citizens Alliance Study, Feb 2014
“highly lucrative, and
profitable… with margins
from 80% to 94%…”
Source: MIT Tech Review, May 2018

23. 31 August 2021 / Page 22
FouAnalytics.com
Famous botnets, primary use
Their primary use shifted increasingly to ad fraud (green)
2019 2020
2017 2018
2015 2016
2013 2014
2011 2012
2010
IceBucket
CTV fraud,
2B imps /day
Coreflood
DDoS, web
scraping,
credential
stealing
Grum
40B spam
emails /day
ZeroAccess
Click fraud
Bitcoin
mining 488
TB traffic
/day
Avalanche
Ransomewar
e, RATs,
banking
trojans
Mirai
IoT malware,
665 Gbps
DDoS
Methbot
Video ad
fraud, 300M
/day
Hyphbot
Ad fraud, 34k
websites
3ve
Ad fraud
1.7M devices,
12B ad req
/day
Conficker
DDoS,10M
computers
Judy
Ad fraud, 41
apps, 37M
devices
Fireball
Ad fraud
browser
hijack, 250M
devices
SndApps
IMEI/person
al info
stealing,
adware
Chameleon
Click fraud,
fake mouse
moves, ad
fraud
Rustock
Email spam,
2,000
/second
RottenSys
Android
adware,
malware
WannaCry
Kelihos
Necurs
Zeus
Dridex
Emotet
Spam,
banking
trojans
Ransomware
WePurchaseApps
127 apps,
millions of
downloads
Cheetah
600 apps, 4+
billion
downloads
DO Global
6 apps, 50M
downloads,
ad fraud
VidMate
500M installs,
ad fraud
iHandy
46 apps,
100M installs,
ad fraud
DiCaprio
CTV fraud
Grindr faking
Roku
streams
CooTek
60 apps, 50M
downloads,
ad fraud
ClearSkins
Fake Sites,
80M video
views /day
Adap.tv
Video ad
fraud
(unnamed)
5,000 mobile
apps, display
ad fraud
Boris
Network for
sites for ad
fraud
FreeStreams
Network of
sites,
audience
overlap ad
fraud
DDoS
Spam, banking, ransomware
Ad fraud
Most botnets are used
for ad fraud now (green)
Monarch
“7-figure
scheme”
MultiTerra
“$1 million
per day”
StreamScam
“$145M
spoofing 30
million”

24. 31 August 2021 / Page 23
FouAnalytics.com
Not humans, something else
Humans’ usage of the Internet, social, and mobile all plateaued; but digital ads shot upward

25. 31 August 2021 / Page 24
FouAnalytics.com
“It’s easier to fool people than
to convince them that they have
been fooled.”
Mark Twain