Biggest ad fraud cases in 2020
Jonathan Marciano
|Marketing | October 01, 2021
Mobile, display, OTT, and click fraud all seeing rises in 2020
With cybercrime up across the board as a result of COVID-19, it is no surprise that the gateway of ad fraud has seen rising attacks. With the FBI seeing a 75% spike in daily cybercrimes since the start of the pandemic, it would be extremely strange if we did not see a rise in attacks against the $333 billion set to be spent by brands on digital advertising in 2020. The enforcement cases, whether prosecutions from Facebook, or Google, competitor click frauds or new attacks, have only kept rising across the digital ecosystem.
Mobile ad fraud
In 2020, the Google Play Store has had regular challenges. In February 2020, apps — mostly camera utilities and children’s games were laced with a malware strain dubbed Haken, stealing data and signs victims up for expensive premium services. In February, announcing the banning of 100 apps from the Google Play Store, Per Bjorke, Senior Product Manager, Ad Traffic Quality at Google confirmed the scale of the problem: “Mobile ad fraud is an industry-wide challenge that can appear in many different forms with a variety of methods, and it has the potential to harm users, advertisers and publishers.” In March, the Google Play store also removed 50 Android apps compromised by the Tekya auto-clicker-malware. In June 2020, popular barcode apps producing ads that instantly vanish were removed after being downloaded 1 million times. In April, 29 apps were identified and removed, but had collected 3.5 million total downloads. In many cases, users can not even remove the app or close it down, because it is also removed from the smartphone screen (only removable by going into phone settings). User reviews of such apps began with bot-driven five-star reviews. This followed by genuine human reviews confirming that such apps are barely functional.
Publisher ad fraud
Publishers have faced severe economic challenges from ad fraud alongside a separate $3.2 billion hit from keyword brand safety implementation by brands in 2020. The Indian edition of the International Business Times has been caught three times using deceptive ad practices to inflate views, blamed on a “rogue employee”. Showing the economic incentives of such fraud, the publication said the employee sought to ” boost his performance metrics…[employing] shortcut methods to reach monthly targets”.
In one fantastic investigation, Megan Graham, a CNBC reporter showed the ease of setting up an illegitimate news website and monetizing with online ads. The fake site attracted ads from top brands including Kohl’s, Wayfair, Overstock and Chewy”. [In a statement, Overstock said that as an advertiser it is negatively impacted by this fraud and does “everything in [its] power to prevent it.”] It has been estimated that such fake news site can make $100,000 a month from inflating traffic with bots, and attracting online ads. UK brand Virgin Media, one of dozens of brands advertising on such sites, said: “We hope more can be done across the industry to clamp down on these instances of pay-per-con advertising fraud.”
Even when affirmative action has been taken where brands sought to prevent their ads appearing on Breitbart, so called “dark pooling” (sharing of ads.txt identification) effectively mislabeled inventory and funneled ad dollars back to such sites.
In setting out its views on the market problems of online advertising, the UK’s competition watchdog, the Competition Markets Authority wrote in July 2020: “If problems in the digital advertising market mean that [publishers] receive a lower share of advertising revenues than they should, this is likely to reduce their incentives and ability to invest in news and other online content, to the detriment of those who use and value such content and to broader society.”
OTT Ad Fraud
Marketers are expected to lose $4 billion in 2020 due to streaming or OTT ad fraud. Brands are projected to spend $23.8 billion in 2020 to show ads on connected devices, like Roku, and over-the-top media services, which are streaming platforms like Hulu. Advertisers increasingly invest in fast-growing ad-supported streaming platforms globally. However, at least a quarter of that money will be stolen by fraudsters, according to almost all ad fraud services.
OTT ad fraud cases brought to light in the past year include the so-called IceBucket botnet, in which fraudsters discovered weaknesses in the SSAI server communications mechanism used in OTT ads. In another case involving Grindr (January 2020), “ad spoofing” saw cheap banner ads used to resell more expensive video ads. In another case (March 2020), an alleged ad fraud scheme ran on Roku, was said to cost “seven figures”. Marketers from brands including Jaguar, Geico, and Lexus, had purchased what they believed to be ad space alongside popular content; however, it emerged that these brands’ ads were being displayed in spots such as alongside screensaver and pet entertainment apps and not the viewers they had hoped to reach.
Display
In a world of its own for ad fraud challenges, display fraud rates can read around 30% in 2020. Duane Brown, Founder and Head of Strategy at Take Some Risks, says: “We don’t tend to do much on display as it is pretty trash traffic. I am sure we have ads and videos that appear on sites we don’t want them to appear on, but we take what precautions we can.”
Paid Search and paid social
Paid search spending, according to industry estimates, will grow over the next couple of years as the environment continues to change, with 5% growth in paid search advertising this year, followed by 13% in 2021. Based on empirical research, we found that 14% of PPC spending is invalid across paid search and paid social based on platforms attracting PPC dollars, including Google, Facebook, Bing, Yahoo, Baidu, Snap, Twitter, LinkedIn, and Amazon. Click fraud is driven by many different sources, from standard web crawlers to malicious bots, click farms, ad-fraud schemes, and even competitor clicks, fake accounts, data centers, and the challenges of Facebook’s Audience Network. The highest sector for loss in paid search and paid social includes eCommerce sites (set to lose $3.8 billion to click fraud in 2020), followed by travel ($2.6 billion) and education spending ($830 million).
Other types of ad fraud
Fake ads on social media platforms, which are disguising a credit card scam, also hit brands including Patagonia, Microsoft, and Ralph Lauren. This involves leveraging Facebook’s powerful advertising tools to target people with fake promotions for products, and then directing them to other websites siphoning credit card details or selling counterfeit versions of premium brand products product. Between February and July, Patagonia says it received more than 1,500 reports of fake Facebook ads for its products. In addition there have been cases of email-based extortion with bot-runners threatening to flood websites with fake traffic unless payment was made, at a cost of a $5000 to avoid this eventuality. The UK government has also asked for more action on scam ads online, while TikTok has banned certain classes of ads, promising miracle weight loss.
Greater sophistication and ease of ad fraud
In every way ad fraud has become easier for bad actors and harder to detect through greater sophistication. For instance, data center-dwelling bots have been replaced by fraudsters using harder to detect residential Windows systems running a Remote Desktop Protocol (RDP) connection exposed to the Internet. Unlike normal fraud schemes which are using bot/automation tools (Selenium, Puppeteer) in this this case, the attack used a legitimate environment (for instance an updated Chrome, Windows, and residential IP). Leading criminal lawyer Arkady Bukh, a New York-based attorney with a history of representing suspected hackers and ad fraud perpetrators from Eastern Europe, including those involved in the “Methbot” case, says the growth in sophistication by bad actors has been marked. “There is widespread fraud from huge amounts of traffic getting directed through botnets. Before, it was boys and girls in Russia sitting in boiler rooms clicking manual clicks in order to get apparent traffic to defraud affiliates. Now it’s done by bots.”
P.S.
Want to protect your sites and ads? Click here to Request a Demo.
