Ad fraud is the deliberate generation of fake ad impressions, clicks, installs or conversions to steal money from advertisers in digital advertising.
How ad fraud works
Online advertising pays per impression, click or action, which creates an incentive to fake them. Common techniques include:
- Bot traffic – botnets of infected computers, smartphones or IoT devices visit sites and click ads in the background.
- Click farms – low-paid workers or racks of phones generate “human” activity.
- Domain spoofing – low-quality inventory is sold as premium publishers’ ad space.
- Ad stacking and pixel stuffing – many ads are placed on top of each other or shrunk to a single invisible pixel, yet counted as viewed.
- Mobile app fraud – apps or adware load hidden ads, fake installs or hijack attribution for clicks they did not generate.
Why ad fraud matters
Ad fraud is one of the most profitable forms of cybercrime with comparatively low risk. The Methbot operation, exposed in 2016, used data centre servers to simulate users watching video ads on spoofed premium sites. Its successor 3ve combined botnets and hijacked IP addresses; it was dismantled in 2018 by the FBI and industry partners, and the US Department of Justice charged eight people. For ordinary users, ad fraud malware means slow devices, higher data and battery use and a foothold for further infections, while related malvertising spreads malware through ads.
How to fight ad fraud
- Advertisers should use independent verification and invalid traffic (IVT) detection and buy only from authorised sellers listed in ads.txt and app-ads.txt.
- Monitor campaigns for anomalies such as extreme click rates or traffic from data centres.
- Users should install apps only from trusted stores and remove apps that drain battery or show ads outside the app.
- Keep devices and routers updated to avoid joining a botnet.
