How Does Ad Fraud Work: Key Types and Its Real Impact on Digital Advertising

Denis K

Author

Ad fraud refers to deceptive practices in the digital advertising ecosystem, where fraudsters manipulate various aspects of online advertising to generate fake revenue or mislead advertisers. It’s essentially a scheme that prevents ads from reaching their intended audience and instead generates artificial interactions, such as fake clicks, impressions, installs, or conversions.

Understanding how does ad fraud work is essential for advertisers seeking to protect their budgets and optimize campaign performance.

Fraudsters use increasingly sophisticated methods to exploit vulnerabilities in ad platforms, leading to significant financial and reputational damage.

• Fake clicks: Bots or automated scripts are programmed to click on ads, artificially inflating click-through rates.
• Fake impressions: Fraudsters create fake ad views, where an ad is technically loaded but never actually seen by a real user. This can be achieved through techniques like ad stacking (multiple ads placed in the same spot, only one visible) or pixel stuffing (ads compressed into a single, invisible pixel).
• Fake conversions: Fraudsters may also attempt to simulate conversions like app installations or purchases to claim credit for actions they didn’t facilitate

How Does Ad Fraud Work

Ad fraud often involves the use of sophisticated bots or botnets that mimic human behavior to interact with ads and exploit advertising platforms. These fraudulent interactions can happen across various devices, including desktops, mobile devices, and Connected TV (CTV).

At its core, ad fraud manipulates the digital ad system to generate fake engagement. This can happen in several ways:

• Spoofed Data: fraudsters manipulate data such as location or user agent to make fake traffic look genuine.
• Automated Bots and Scripts: fraudsters deploy bots or click farms (groups of low-paid workers) to create fake clicks, impressions, or installs.
• Deceptive Placement: ads may be hidden or stacked so that they’re technically “viewed” or “clicked,” but never actually seen by a human.

These tactics not only waste ad spend, but also corrupt campaign data, making it difficult for marketers to measure real performance and optimize their strategies.

Main Types of Ad Fraud

You run advertising online to get to your ideal customer, but online ad fraud makes it difficult to do so. If you know about common scams, your reputation and funds are less at risk.

Ad fraud includes things like fake clicks and impressions, complex bots, and domain spoofing. These dishonest approaches not only waste your money, but they also affect the KPIs for your campaign, which makes it harder to tell how well it’s going.

Knowing the many types of ad fraud will help you protect your campaigns, get the most out of your money, and make sure your message reaches real people.

Domain Spoofing

• How it works: Fraudsters manipulate domain information to make it appear as though ads are being served on reputable, high-quality websites. In reality, these ads are placed on low-quality, irrelevant, or non-existent sites, or sometimes not shown at all. The fraudulent domain might have a slightly altered URL or use a different extension to resemble a legitimate publisher.
• Impact: Advertisers pay premium rates for ad placements on fraudulent sites, damaging brand reputation and wasting ad spend. 

Real-world example – Forbes Ad Scandal

In April 2024, it was revealed that Forbes had been serving ads on a hidden subdomain, www3.forbes.com, flagged as a “made-for-advertising” (MFA) site. The subdomain hosted reformatted articles in slideshow and listicle formats with excessive ads, and was not accessible from Forbes.com or search engines—only promoted via platforms like Outbrain and Taboola.

Advertisers believed their ads were running on Forbes.com, but instead, some appeared on this low-value subdomain without their knowledge. Estimates suggested up to 28% of ad spend was misdirected. Forbes blamed a coding error by Media.net, shut down the subdomain, and initially called the findings misleading. The scandal also exposed failures in ad verification tools like DoubleVerify, sparking industry-wide calls for greater transparency and stronger standards.

Click Fraud and Bots/Non-human Traffic

How it works: Automated bots or malicious software simulate clicks on advertisements, artificially inflating click-through rates and draining advertiser budgets. Fraudsters use techniques like:

• Click bots: Automated programs designed to click on ads, often programmed to mimic human behavior to evade detection.
• Botnets: Networks of compromised devices that are controlled by fraudsters to generate large-scale fake traffic and clicks.
• Click farms: Groups of individuals or automated systems hired to repeatedly click on ads, artificially inflating engagement statistics.

Impact: Advertisers pay for clicks that don’t originate from real users, leading to wasted ad spend and inaccurate performance metrics. 

Cookie Stuffing

• How it works: Fraudsters implant affiliate tracking cookies on a user’s device without their knowledge or consent, typically through pop-ups, hidden iframes, or other deceptive methods. This allows the fraudster to claim commission for sales that the user may have made later, even if the user didn’t click on their specific affiliate link.
• Impact: Advertisers pay commissions to fraudsters for sales they didn’t generate, losing revenue and undermining the integrity of affiliate programs. 

Click Injection

• How it works: Malicious apps or software detect when a legitimate app is being installed on a mobile device and then inject a fake click event just before the installation is complete. This makes it appear as though the fraudster’s ad triggered the installation, allowing them to claim attribution and receive cost per install (CPI) payouts.
• Impact: Advertisers pay for app installs that are not driven by their campaigns, leading to wasted ad spend and skewed data on user acquisition efforts. 

Pixel Stuffing

• How it works: Ads are shrunk to a minuscule size, often a 1×1 pixel, and crammed into a webpage. While technically present and registering as impressions, these ads are invisible to the human eye, thus creating fake impressions.
• Impact: Advertisers pay for ad views that never actually reach a user, resulting in wasted ad spend and distorted analytics. 

Ad Stacking

• How it works: Multiple ads are placed on top of each other within a single ad slot. Only the top-most ad is visible to the user, but impressions and clicks are registered for all the stacked ads.
• Impact: Advertisers pay for impressions and clicks that are not genuinely seen or engaged with, leading to wasted ad spend and skewed performance data. 

Ad Injection

• How it works: Ad fraud encompasses various deceptive practices aimed at generating illegitimate advertising revenue. How does ad fraud work? One common technique is Ad Injection.Ad Injection works when malicious software or browser extensions insert unauthorized advertisements into webpages or apps, bypassing legitimate ad networks. These injected ads can appear over original ads or display on pages without ads, diverting revenue to fraudsters. The impact is twofold: publishers lose revenue from their authorized ad placements, and users may be exposed to unwanted or misleading advertisements. One common technique is Ad Injection.
• Impact: Publishers lose revenue from their authorized ad placements, and users may be exposed to unwanted advertisements. 

Geo-Masking

• How it works: Fraudsters manipulate a user’s perceived geographic location to appear as if they are from a desirable region. This can be done using proxy servers, VPNs, spoofing GPS or IP data, and changing device parameters.
• Impact: Advertisers pay higher rates for traffic from what they believe are valuable regions, but the ads reach irrelevant audiences. 

Forced Redirects

• How it works: Malicious code within ads automatically redirects users to a different website, often without their interaction. These redirects can lead users to phishing sites or malware downloads.
• Impact: Users face security risks and unwanted content, while advertisers experience disruptions and potential brand damage. 

In some cases, fraudsters utilize chains of redirects, sending a user through multiple sites before reaching the final malicious destination. This can make it harder for detection systems to track the origin of the attack. One study found over 100,000 redirects across 776 websites, with a significant number occurring after users clicked on an ad

Hidden Ads

• How it works: Ads are served and registered as impressions but are not visible to the user. This occurs by placing them outside the display area, hiding them, or making them tiny.
• Impact: Advertisers pay for impressions that don’t reach their audience, resulting in wasted ad spend and misleading data. 

Click Hijacking

• How it works: Fraudsters intercept legitimate user clicks on ads and redirect them to a different ad or website. Techniques include using hidden iframes, invisible buttons, or manipulating app interactions.
• Impact: Advertisers lose revenue, experience distorted analytics, and see a decrease in campaign effectiveness. 

User Agent and SDK Spoofing

• How it works: Fraudsters manipulate device or application data to appear as legitimate users and exploit attribution systems. This involves presenting false user agent strings or generating fake app install data.
• Impact: Advertisers pay for fake installs and engagement, leading to wasted ad spend and inaccurate performance evaluation

How Ad Fraud Impacts the Advertising Industry

Ad fraud has significant negative consequences for various stakeholders in the digital advertising industry:

Advertisers:

• Wasted ad spend: Advertisers pay for clicks, impressions, and conversions that are not generated by real users, leading to a waste of their marketing budget. Studies suggest a significant portion of ad spend, like 15% according to Doppel Inc., and even potentially reaching $172 billion by 2028 according to Forbes, can be lost to ad fraud.
• Distorted analytics and skewed metrics: Ad fraud can make it difficult to accurately measure campaign performance, leading to misinformed decisions about future advertising strategies.
• Brand safety risks: Ads may appear on fraudulent or inappropriate websites, damaging brand reputation.

Publishers:

• Reduced earnings: Fraudulent traffic can devalue a publisher’s ad inventory, leading to lower earnings.
• Damaged credibility: Advertisers may lose trust in publishers whose ad placements are found to be fraudulent.

Users:

• Unwanted or harmful content: Users may be exposed to malware, phishing attempts, or irrelevant ads due to fraudulent activities.
• Diminished experience: The overall user experience can suffer when websites are filled with fraudulent ads or compromised by malicious redirects. 

How the Industry Fights Ad Fraud

Combating ad fraud requires a multi-faceted approach, including:

• Utilizing ad fraud detection tools and technologies: These tools can help identify and mitigate fraudulent activities.
• Working with reputable ad networks and platforms: Choosing advertising partners with robust anti-fraud measures in place is crucial.
• Monitoring user behavior and traffic: Analyzing real-time user behavior for anomalies and suspicious activity can help detect fraud early on.
• Staying informed about emerging fraud tactics: Fraudsters constantly evolve their methods, so staying updated on new threats like click farms and botnets is essential for effective prevention

By understanding the complexities of ad fraud and implementing effective prevention strategies, businesses can better safeguard their advertising investments and contribute to a healthier and more transparent digital advertising ecosystem.

How to Avoid Advertising fraud?

Publishers can maintain revenue and reputation by preventing ad fraud. How does ad fraud work? It often involves tactics like invalid clicks, impression laundering, or ad injection that distort metrics and steal ad spend. Ad and marketing fraud prevention are essential for publishers to preserve revenue, reputations, and business models. Learn more in this guide on how to detect and stop invalid clicks.

Examine Ad Networks

Ad fraud risk reduction begins with knowing your business partners. Find an ad network with a transparent, stringent platform and fraud detection and prevention.

Track Traffic

You should know what “normal” traffic is. Traffic monitoring reveals aberrant activity like:

• Sudden traffic surge.
• Exceeding industry standards click-through rates.
• Geographic outliers.

Convert Rates

Digital ad fraud can be detected by tracking conversion rates. Low conversion with peak traffic may be problematic. Low average click-to-install time (CTIT) in mobile apps may indicate install hijacking. Conversely, a high CTIT may suggest click spam.

Target Audience Specifically

You can discover anomalous activity faster if you target your audience precisely. If you just want German clients, you can spot ad fraudsters trying to use a different location.

Use ads.txt.

Ad networks, exchanges, and SSPs that resell inventory are listed in ads.txt. Your partners should have legitimate sellers.JSON files validate inventory origin and impressions.

Publishers can also include comments in their ads.txt file for their own reference. These are ignored by crawlers:

The ads.txt file must be uploaded to the root directory of your website (e.g., https://yourdomain.com/ads.txt).

Competitor Watch

Set exact match warnings to prevent digital ad fraud from using plagiarized material. Affiliates may compete on keywords and commit click fraud to increase business. Sometimes scraper bots grab content to repost it on other sites for fraudsters.

Examine Infrastructure Costs and Performance

Bots used by fraudsters slow websites. This means you buy extra bandwidth to maintain SEO-friendly performance. Bot traffic causes unanticipated peaks and service outages, thus monitoring infrastructure expenses and website performance might help you spot it. Learn more about why websites check the IP of their visitors to identify suspicious activity and reduce fraud risks.

Watch for Spoofed Domains

Searches that add or remove URL characters can prevent fraudsters from creating a bogus site. Search for Th1sIsMySite instead of ThisIsMySite.

Collect End-User Device Data

Mobile ad fraud prevention differs from desktop. To prevent SDK spoofing, look for client-side signals such events tied to:

• Contact Events
• Typing Speed
• Check Sensor Signals

FYI: Mobile SDKs can access and transmit data from these sensors in real-time or near real-time. According to SEON, sensor data is part of the thousands of real-time device signals collected to identify suspicious setups and settings.

Review Signature Signals

You can gather this data for yourself and your users. By watching this data, you can see if interactions match human behavior. Some signatures to check:

• HTTP header fingerprints.
• TLS handshake metadata
• Browser fingerprints: Browser, device, and OS data.
• Mobile fingerprints: OS and device.

Have Site Testers

You may not detect ad injections and forced redirects. You can find out if someone has issues with your ads by having them utilize your website.

They can identify:

• Subtle redirects: Being involuntarily sent to a different website after clicking an ad or even just landing on a page.
• Unexpected ad placements: Ads appearing in unusual locations or formats not typically used by the site.
• Ad injections: Ads appearing on pages where no ads should be displayed, or ads replacing legitimate ones. This can be caused by malicious browser extensions or malware on the user’s device.

Examine Ad Fraud

Fraudsters vary tactics, especially with bots. Following industry organizations provides the latest research to protect you. How does ad fraud work? It typically involves automated scripts or deceptive methods that mimic legitimate user behavior to generate fake impressions, clicks, or conversions, undermining the integrity of your advertising efforts.

Block Unsafe IPs

Check your reports for dangerous IP addresses and stop them from accessing your website by using tools that help evaluate IP reputation — for example, IP quality scoring to maintain a trusted online presence. 

Bot Management System

No matter how hard you try, hostile bots will outperform manual management. A bot management solution can distinguish bots from humans on your site using AI and ML.

Bot management solutions differentiate between good bots, bad bots, and humans using a multi-layered approach, heavily relying on Artificial Intelligence (AI) and Machine Learning (ML). 

Bot Detection: This is the foundational step, focused on identifying automated traffic.

• Behavioral Analysis: ML algorithms analyze user interactions (mouse movements, keystroke patterns, navigation paths, scroll speed, device orientation) to detect anomalies that distinguish bots from humans.
• Device Fingerprinting: Unique “fingerprints” of browsers and devices are created and analyzed for inconsistencies or patterns known to be associated with bots or emulators.
• IP Address and Network Analysis: Checking IP reputation, identifying traffic from known botnets or data centers, and analyzing network signatures.
• Static Analysis: Inspecting HTTP requests for known bot signatures or user-agent strings.
• Challenge-Based Mechanisms: Deploying CAPTCHAs, JavaScript challenges, or invisible checks to verify human presence. Advanced solutions use adaptive challenges or CAPTCHA-less methods to minimize user friction.
• Threat Intelligence: Leveraging constantly updated databases of known bot patterns and emerging threats, often powered by vast datasets and global intelligence feeds.

Bot Management Systems Overview

Anti-malvertising software

Malware digital signatures can be detected by anti-malvertising software and plugins. This provides real-time protection against forced redirect malware.

Frequently Asked Questions