Understanding Ad Fraud: What It Is and How It Impacts Your Advertising

Since it was first detected in 1999, ad fraud has been an ongoing issue, increasing at a fast rate alongside digital ad budgets. In 2016, advertisers spent $72.5 billion on digital advertising, with roughly 10% or $7.2 billion of ad spend lost to fraud that year. Last year, marketers spent $567.49 billion in digital advertising, with a projected loss of approximately $100 billion, almost 12%, due to ad fraud in both mobile and desktop platforms. What is digital ad fraud? How does ad fraud work? And what have we learned in the past six years?

It’s obvious that online advertising fraud has a negative impact on budgets, but there are hidden costs as well: fewer genuine leads coming into your pipeline, lower employee morale, damaged brand reputation, and financial losses due to TCPA non-compliance. You can’t beat ad fraud if you don’t know what it is or what to look for, so let’s start with the basics.

Uncover the Truth About Ad Fraud and How to Stop It

At Anura, we define ad fraud as the practice of viewing, clicking, converting, or generating false interactions with any web asset for the sole purpose of earning money directly or indirectly. Fraud can involve bots, malware, humans, or a combination, depending on the end goals of the fraudsters.

Given all the players in the digital advertising space, it’s not surprising that ad fraud can happen anywhere in the digital advertising chain. Available ad inventory may be inflated so that advertisers are buying space that doesn’t exist. Ads may be placed but merely stacked on one page where they’re unlikely to be seen. Invalid traffic—whether by bots or humans, intentional or accidental—inflates the number of impressions or clicks advertisers pay for.

Not only can ad fraud happen almost anywhere in the digital advertising loop,  but it also occurs in many forms. Many are similar and may even overlap; all of them increase advertising costs while lowering campaign performance.

Types of Ad Fraud

Click Fraud

Click fraud occurs when fraudsters artificially inflate the number of clicks on an ad to generate revenue for publishers or to deplete a competitor’s ad budget.

How It Works:

• Automated bots, scripts, or even click farms (real people paid to click ads) generate fake clicks.
• Pay-per-click (PPC) advertisers waste money on non-existent engagement.
• Fraudsters collect ad revenue from advertisers without delivering real visitors.

Example: A competitor clicks repeatedly on a company’s PPC ad to exhaust their budget early in the day, reducing their visibility.

Cookie Stuffing

This tactic involves injecting unauthorized cookies into a visitor’s browser to manipulate ad attribution and commissions.

How It Works:

• A fraudster places hidden cookies on a visitor’s browser.
• If the visitor makes a purchase later, the fraudster falsely claims credit for the referral.
• Advertisers pay commissions for conversions that didn’t come from a legitimate source.

Example:

A fraudulent affiliate marketer stuffs cookies from multiple brands onto a visitor’s browser, falsely claiming commission for any future purchases.

Domain Spoofing

Fraudsters disguise low-quality or fake websites to appear as premium, high-value domains. This tricks advertisers into paying higher rates for ad placements that never reach the expected audience.

How It Works:

• A fraudster creates a fake website and manipulates data to make it look like a premium domain.
• Advertisers bid for ad placements, thinking their ads will appear on reputable sites.
• In reality, the ads are displayed on low-quality or completely fake sites, draining budgets with no real engagement.

Example: An ad buyer thinks their campaign is running on a major news website, but it’s actually being shown on a fraudulent site filled with bots.

Click Injection

Click injection is an advanced form of click fraud that allows fraudsters to claim credit for app installs they didn’t generate.

How It Works:

• Fraudsters use malware-infected apps to detect when a user is about to install a new app.
• The fraudulent app fires a last-minute click, making it look like the install came from the fraudster’s ad.
• The fraudster gets paid for the install, even though they had no real influence over it.

Example: A mobile user downloads a fitness app. Meanwhile, a malicious app running in the background injects a fake click, tricking advertisers into crediting the fraudster with the install.

Pixel Stuffing

In pixel stuffing, multiple ads are hidden within a single, tiny pixel that is invisible to human users, yet counted as an impression.

How It Works:

• Fraudsters embed multiple ads into a single pixel on a webpage.
• Advertisers are charged for impressions even though visitors can’t see the ads.
• Bots may simulate engagement, further deceiving advertisers.

Example: A website claims to serve thousands of impressions per day, but all the ads are crammed into invisible 1x1-pixel areas, making them useless.

Ad Stacking

Fraudsters layer multiple ads on top of each other in a single ad slot, so only one ad is visible but all are counted as impressions.

How It Works:

• Multiple ads are placed in a single ad space.
• Users see only the top ad, but impressions and clicks register for all stacked ads.
• Advertisers pay for hidden ads that don’t reach their audience.

Example: A mobile game app loads five ads in one placement, but only the top ad is visible while advertisers for the other four still pay for the impression.

Ad Injection

Ad injection manipulates web pages by inserting or replacing ads without the website owner’s consent.

How It Works:

• Fraudsters inject unauthorized ads into web pages.
• This often occurs through browser extensions, malware, or compromised ad networks.
• Legitimate publishers lose revenue as fraudsters hijack their ad space.

Example: A user visits a major retailer’s website, but instead of seeing the retailer’s ads, injected ads from fraudsters appear, diverting traffic to competitors or scams.

Geo Masking

Geo masking misrepresents a visitor’s location to manipulate ad targeting.

How It Works:

• Fraudsters use proxies or VPNs to make traffic appear as though it’s coming from premium locations.
• Advertisers pay higher rates for geo-targeted impressions, but the actual audience is outside the intended region.

Example: An U.S.-based company runs a campaign targeting American consumers, but fraudsters route traffic from low-cost regions, making it look like U.S. traffic.

Bot Traffic

Bots are automated scripts designed to mimic human behavior and generate fake impressions, clicks, and conversions.

How It Works:

• Fraudsters deploy bot networks (botnets) to visit websites and interact with ads.
• Bots artificially inflate engagement metrics, tricking advertisers into spending more.

Example: A fashion brand sees a spike in traffic on their latest ad campaign, but all engagement comes from bot traffic, leading to zero actual conversions.

User Agent Spoofing

Fraudsters manipulate browser or device headers to disguise bot activity and evade detection.

How It Works:

• Fake user agents make bots appear as legitimate visitors.
• This allows fraudsters to bypass ad fraud detection filters.

Example: A bot pretends to be a visitor using an iPhone to interact with a mobile ad, tricking advertisers into thinking they reached their target audience.

SDK Spoofing

SDK spoofing occurs when fraudsters manipulate mobile analytics to generate fake app installs.

How It Works:

• Fraudsters intercept and replay in-app events to make it look like real installs and user interactions occurred.
• Advertisers pay for installs that never happened

Example: An advertiser pays for 10,000 app installs, but a fraudster uses SDK spoofing to fake these installs, wasting the ad budget.

Install Farms

Fraudsters use real devices or emulators to fake app installs and earn money from install-based campaigns.

How It Works:

• Fraudsters operate “install farms” where real people or automated scripts repeatedly install and uninstall apps.
• The fraudster collects ad revenue from fake installs.

Example: A company running a CPI (Cost Per Install) campaign pays fraudsters who manually install and uninstall apps to generate fake installs.

Forced Redirects

Fraudsters use malicious ads to force users onto unwanted websites, often leading to scams or malware infections.

How It Works:

• A user clicks on a legitimate ad but is redirected to a fraudulent website.
• These ads are often loaded with malware that can steal personal data.

Example: A visitor clicks on a travel ad expecting a flight deal but is redirected to a phishing site trying to steal their credit card information.

What’s New in Ad Fraud?

One form of ad fraud that is getting a lot of attention is connected TV (CTV) ad fraud. CTV fraud, which seems to be driven mainly by bots, has increased as more streaming services accept ads to lower consumer costs and increase revenue. In some cases, fraudsters use screensavers that generate impressions even when the screen is turned off. Fraudsters have also created false CTV traffic by impersonating other connected devices, including smart refrigerators.

How to Protect Yourself

Ad fraud affects advertisers, publishers, and consumers. It is illegal, and when caught and prosecuted, fraudsters face imprisonment. The challenge is that these fraudsters are hard to catch, so the best defense is to know what to look for and take action to detect ad fraud and prevent it from happening to you. Some strategies to consider:

Be Informed

Stay up to date on the latest fraud trends and tactics that fraudsters are using, as well as the best ways to detect and prevent fraud from happening to you.

Monitor Traffic Quality

Watch for unusual patterns or suspicious activity in your campaigns and on your website. 

Know Your Publishers

Programmatic advertising offers a convenient way to buy ads, get them in front of your intended audience, and measure campaign results. But it’s also rife with ad fraud; we’ve seen as much as half of programmatic ad spend lost to fraud. When possible, place your ads with reputable publishers and ad networks, preferably those that are TAG Certified or accredited by the Media Rating Council (MRC).

Implement an Ad Fraud Solution

An ad fraud detection and prevention platform can not only detect and block fraudulent traffic, but it also should identify where your good traffic is coming from so you can invest more of your advertising dollars in those channels.

While no ad fraud solutions are 100% fail-proof, Anura marks fraud with 99.999% accuracy. When it comes to evaluating traffic, we don’t rely on any one data point but instead examine and assess hundreds of data points to learn about your site’s visitors. Our tools for ad fraud protection enable you to analyze traffic in real time and provide valuable insight so we can work together to identify fraud and develop an action plan to prevent invalid traffic.

Anura’s accuracy, thoroughness, and analytics set us apart from other ad fraud detection solutions. Sign up for our fully functional 15-day trial and see for yourself why more and more companies are switching to Anura as their ad fraud prevention partner.