How can Businesses Detect and Block Click Fraud?
Kerry Coppinger
|Marketing | September 08, 2022
There are many different types of digital threats on the internet today that impact businesses in a variety of ways. From data breaches causing privileged client information to be exposed to invalid traffic impacting business intelligence and decision-making in negative ways, and everything in between – there is no wonder why teams are increasingly investigating potentially harmful web traffic. One piece of the go-to-market puzzle that is frequently disrupted by bots and fake users is the paid marketing space.
A term that is frequently discussed in relation to harmful paid marketing traffic is click fraud. Click fraud, sometimes used interchangeably with “ad fraud,” is the malicious act of purposefully and repeatedly clicking on a business’s advertisements with the intent to drain budgets, disrupt key metrics, or otherwise damage the business’s online presence. The issue of click fraud has long been a concern for organizations looking to optimize their advertising campaigns and budgets and maintain their ability to attract visitors who have the intent to convert. Throughout this article, we will discuss how click fraud is committed, what damage it causes, and how organizations can begin to detect and block it.
What are some ways click fraud is committed?
The act of click fraud is plain in theory – clicking on an advertisement with malicious intent. However, the ways click fraud is committed are varied and range from very simple to a bit complicated. Below we outline three common ways bots and bad actors take fraudulent actions against legitimate ads.
Click farms
These large operations have workers who are hired to repeatedly click on internet content. In some cases, a single worker is paid to rapidly click on advertisements, posts, modules, and more at a high rate in order to drive up clicks and drain budgets. Click farms are one of the internet’s worst-kept secrets since, with a quick search query, multiple click farms for hire can be easily found and utilized by malicious users.
Competitors
In competitive industries, having the top spot on a search engine results page can be the difference between a brand going mostly unnoticed and winning a new book of business. Organizations know this, and sometimes, if they notice their competitor is climbing the ranks of paid search results, they may choose to continually click on those ads until budgets run out. This can increase their likelihood of taking over that top spot and stealing business from their rivals.
Malicious bots
On the internet, not all bots are created equal. While some robots exist simply to scan websites for content or index site pages, other automation tools are built with malicious intent. These bots may also commit ad fraud in order to access a website, disrupt large organizations, cause confusion, or redirect innocent users to malicious sites.
How does this affect paid marketing teams?
While click fraud starts by skewing click-through rates on ads, the damage does not stop there. Below are some of the residual effects of click fraud that can damage the effectiveness of entire marketing operations.
Drained budgets
When malicious bots or other kinds of harmful users click on advertisements, valuable budgets are used on actors that provide no value. The first and most obvious problem this causes is that the cost of that click is lost to an invalid user. So, for example, if the typical CPC for that campaign is $5, that means $5 just went down the drain. But the damage doesn’t stop there because that budget could have been used on an interested customer if it wasn’t stolen by the bass actor. In this case, not only is the organization losing the $5, they are also losing the lifetime customer value of that potential valid user.
Skewed optimizations
Advertising campaigns are typically optimized toward the users that appear to be most engaged. For example, if a certain type of user profile appears to be clicking on advertisements, converting on top-of-funnel content, arriving on the organization’s website, and showing interest in other ways – the campaign will automatically ingest this information so that it can be used to better optimize the campaign to more users who show similar levels of engagement. The problem is if a company falls victim to click fraud, the campaign could inadvertently identify malicious users to be highly engaged and optimize campaigns toward additional harmful traffic.
Polluted audience segments
Many campaigns are built based on audience segments from previous campaigns and look-a-like audiences. The idea behind this strategy is to continue to increase the reach of advertising campaigns to additional relevant users. However, if these segments become polluted with bots and fake users who committed click fraud on previous campaigns, the organization could end up building multiple audiences on multiple platforms that are designed to attract bots rather than interested customers.
What are some signs of click fraud?
There are many red flags that marketers can look out for when trying to determine if click fraud and other malicious acts are impacting their ad campaigns. Below, we outline 4 common scenarios.
Sudden spikes in traffic
When new campaigns are launched, it is not uncommon to see increases in site traffic from those sources. However, marketers should measure traffic increases against standard industry benchmarks and previous campaigns to see if the traffic they are seeing is within a typical range. Additionally, if, for example, traffic to a site increases randomly on a day that does not typically see a lot of activity during an unusual time frame, this could be an indicator of click fraud.
Repeated visits from a single IP
Sometimes, legitimate visitors might visit a single webpage on a site multiple times in order to make purchase decisions or compare against similar offerings elsewhere on the web. But if a single IP appears to be arriving on a website from paid advertising multiple times in a row at an atypically fast pace, there is a chance that the user could actually be a bot.
Increased traffic from un-targeted sources
When marketers launch campaigns, it is common for them to target particular attributes, commonalities, and locations. For example, if a brand is launching a new baby product in the UK, it might want to target mothers in their 30s who reside in London. This can help drive relevant traffic to their website rather than wasting ad spend on users who will not find a particular product useful. With this in mind, if that same organization started to see traffic come to their site from their advertisements but it was seemingly from a small town in Italy – that should raise some concerns. Increases in traffic from non-targeted areas can sometimes be a sign of fraud.
Drops in campaign performance
When campaigns are driving traffic but not conversions or sales. Marketing teams may revisit the way the campaign is set up. Maybe they will choose to update the copy, ad creative, or links they are promoting. Perhaps they will also adjust their audience targeting or move budgets from lower-performing campaigns to higher-performing ones. However, oftentimes, many of these decisions are made without first considering instances of click fraud. Click fraud can be a driver of irrelevant site traffic that decreases performance metrics and paints an inaccurate picture of how valid users are responding to ads.
When click fraudsters arrive on a website, what other problems can they cause?
The damage that click fraud causes does not simply stop on the advertising platform. When a fraudster or bot clicks on an ad and arrives on a website, the amount of chaos that ensues can only increase. First, traffic and on-site engagement metrics are skewed because they are accounting for invalid users. Next, if these bots decide to fill out forms or convert on content pages, CRMs can become flooded with fake leads which can both drive up technology costs and waste valuable sales time and resources on fake contacts that can never convert. Furthermore, since nearly all business decisions today are made based on data, bots can cause business intelligence tools and sources of truth to become ultimately unreliable. Needless to say, clicking on an ad is only the beginning for malicious actors on the internet.
What should businesses do when they suspect a click fraud attack?
Anyone who has made it this far through this article already has a clear picture of why click fraud can be so harmful, as well as some key indicators of click fraud. But if an organization is privy to these signs and suspects an attack is currently occurring – or occurred recently – what can they actually do? One step is excluding any IPs that are interacting with campaigns suspiciously. Marketers can also fine-tune their campaigns to exclude certain locations if they suspect the attack is coming from a particular area. Additionally, a team might choose to only have certain ads run at certain times to limit the chances of overnight attacks.
How can businesses actively prevent these things from happening?
Malicious traffic and click fraud will, unfortunately, continue to exist as long as users with harmful intentions use the internet. However, businesses can proactively protect themselves from these malicious activities so that their business doesn’t suffer collateral damage. While the tactics mentioned in the previous paragraph can be helpful, they are largely reactive and can result in false positives and inaccuracies. Instead, many organizations are turning to go-to-market security solutions to stop click fraud and other forms of fake traffic before it infects their sites.
Author
Kerry Coppinger
Senior Manager, Brand Marketing
As head of the brand marketing department at CHEQ, Kerry manages all things content and brand including: research reports, public relations, content marketing, copywriting, press, and other editorial features. Prior to her work at CHEQ, Kerry worked for several tech companies in New York.
