TRAFFIC FRAUD. i n V i d e o A d v e r t i s i n g

Transcription

1 TRAFFIC FRAUD i n V i d e o A d v e r t i s i n g

2 Why Should You Read This Report? Every year, traffic fraud visits to a publisher s site without the knowledge of a legitimate user, or driven by non-human actors costs marketers billions of dollars in wasted ad spend. 1 While traffic fraud is a serious problem that shouldn t be dismissed, the ad industry has the power to minimize our collective risk. In this paper, we ll narrow our lens on traffic fraud in the digital video industry, and explore the ways in which buyers, sellers, and intermediaries of video advertising can identify and prevent traffic fraud. Questions this brief will answer: What is traffic fraud, and how does it impact the growth of the video ad industry? How widespread is the problem? What are the types of video traffic fraud, and who are the perpetrators? What is the real cost of video traffic fraud to advertisers? What can buyers, sellers, and intermediaries of video advertising do to protect themselves from traffic fraud? 1 Source: Solve Media, January 2014

3 What is Traffic Fraud? Traffic fraud refers to false views, clicks, and/or visits to a publisher s desktop or mobile site, driven either by non-human actors called bots, or by humans. This illegitimate traffic can be initiated by a compensated person manually, by an unknowing human user through an infected personal computer, or fully controlled by a bot or botnet. Fraud in the advertising industry is not a new problem; the open nature of digital media and the considerable potential for profit make our industry susceptible to bad actors. Search advertising offers a good historical lens on the problem Google, Yahoo, and other search engines have faced significant click fraud within their marketplaces. 2,3 As the search advertising market matured, these companies deployed tools and policies to make click fraud less attractive for bad actors. As more dollars flow into digital video US marketers will spend nearly $6 billion on video ads in 2014 and nearly $13 billion in fraudulent traffic dealers will follow those dollars. Both advertisers and publishers are vulnerable to this issue. Advertisers reasonably expect the ads they purchase to be viewed by real people with real potential to buy. For advertisers, traffic fraud results in wasted ad spend. A massive shift in consumer Bots: Non-human or automated systems that produce illegitimate traffic to publishers sites. Botnet: A network of personal computers that have been infected with malicious software that turns them into slave computers (aka bots) managed by a botnet controller. Non-Human Traffic: Digital advertising traffic that is artificially generated from computers. video consumption to mobile devices, computers, and connected TVs has made digital video a crucial channel for engagement. Brands, concerned that their video ads aren t being seen by real people, may limit their digital video investment. For publishers, traffic fraud is also a concern. This problem muddles campaign metrics and dilutes the value of legitimate inventory. Fraud erodes trust in the video ad industry, causing publishers to ultimately lose out on a portion of advertisers digital ad spend. How do bots generate false traffic? Generating ad views while consumers browse unaware. Hijacking user controls to generate fake clicks when the computer is dormant. Running invisibly behind the scenes to simulate consumer activity. Compromising cookie data to simulate high-value consumers. Source: Interactive Advertising Bureau, Traffic Fraud: Best Practices for Reducing Risk to Exposure 2 Source: Search Engine Watch, March Source: CNET, October Source: emarketer, June 2014

4 Two Ways Brand Advertisers Can Experience Traffic Fraud A retail brand asks its ad agency to place an online video spot targeted to women aged who are likely to be shopping for winter coats. The brand asks the ad agency to reach as many of these women as possible, working within a predefined budget. The agency then turns to a host of options. They might go through an ad network or ad exchange, or they might buy directly from a publisher. SCENARIO 1 SCENARIO 2 The agency buys from an ad network or ad exchange. The network/exchange aggregates a large amount of supply, which makes the buying and selling process more efficient. The agency buys inventory for the winter coat ad directly from a publisher. That publisher is supply constrained, and has turned to traffic affiliates to help increase the size of their audience and the potential video ad inventory that can be sold. Fraudsters exploit this system by setting up websites that appear legitimate in order to sell fake viewers that meet the target of the retail brand. The traffic affiliates in turn create a reward system for fraudsters who send illegitimate traffic to the publisher s site. Fraudsters direct robots (or bots ) that can pass for actual viewers to visit each fake site over and over. These illegitimate impressions are sold alongside legitimate impressions within ad exchanges making it harder to detect. The more times the bots visit the fake site, the more ads the fraudsters can sell on the exchanges. CONCLUSION The fraudster makes money because the advertiser pays real money to the fraudster's website, in return for the fake views the fraudster created on that website. In both scenarios, reporting shows that impressions have reached their target audience and clicks have occurred. The retail brand is billed for the fraudulent traffic, never knowing how much of their investment wasted.

5 History of Traffic Fraud Traffic fraud dates back to the late 1990s, when the pay-per-click (PPC) model of advertising emerged. Publishers displayed clickable ads, charging marketers each time someone clicked. Legitimate middlemen, such as ad networks, were formed to manage ad buying and selling between advertisers and publishers, collecting a share of the money in the process. Unfortunately, illegitimate dealers realized they could hijack some of this traffic, along with the associated payments and traffic fraud was born. At first, fraudsters hired actual humans who repeatedly clicked on search and display ads either working alone, or with other lowpaid workers in a click farm. Real or bogus publishers (sometimes the distinction is fluid) were paid for each click on ads running on their pages, whether these clicks were real or fraudulent. This human-generated click fraud was expensive to scale, so criminals began building scripts that simulated humans clicking on ads. Criminals also began redirecting real human traffic to fake publisher sites. Legitimate publishers sold these fake clicks to advertisers, usually unwittingly, but sometimes with complicitly, generating revenue in the process. Soon, the perpetrators expanded beyond search to interactive display and video ads. Publishers sold this inventory by the impression (when a user views an ad) rather than by the click. Because publishers of highly trafficked sites generate more impressions, and can charge higher CPM rates, some publishers began buying traffic, which became a commonplace strategy. Hidden Ad Impressions: Ad impressions that aren t actually seen by humans. These are hidden behind other ads or content, displayed in tiny windows within web pages called iframes, or served in ways that prevent the ad from being seen. Laundered Ad Impressions: Ad impressions with intentionally obfuscated, altered, or misrepresented traffic sources and delivery characteristics. Click farms Scripts Buying traffic Bots Sophisticated criminal networks then presented analytics reports showing increased page visits and views, prompting the publishers to buy more and more fake traffic. Today, the fake impressions business has grown ever more complex, with hidden and laundered impressions being sold to unsuspecting advertisers through sophisticated technology.

6 How Does Video Traffic Fraud Work? Video traffic fraud is attractive for two major reasons. Video ad spend is growing quickly in 2018, US advertisers are predicted to spend nearly $13 billion on video ads. Additionally, the cost of a video ad (measured as CPM or cost per thousand impressions) is much higher than the price for a display ad. As a result, fraudulent traffic dealers stand to make more for each fake impression in video than in display. Because video ads commonly run within Flash environments and are inserted into video players, video ad traffic fraud is harder to commit than display ad fraud but video ad CPMs are commonly 8-10 times greater than in display advertising. Also, it is easier to detect fraud in the direct-response world, because direct-response advertisers have a common performance metric: cost-per-click. Because brand advertising campaigns are awareness oriented, and there s rarely a common performance metrics, it s harder to know when the results are suspicious. All of this means that invalid traffic dealers have ample incentive to create technology that mimics human traffic in video. Common scripts on bogus publisher sites stack multiple video players on top of each other (so multiple ads run at once without being seen), run video ads in tiny invisible players, or run video ads behind a banner without sound. WHAT IS DRIVING TRAFFIC FRAUD? 5 Digital ads are getting a larger share of marketing budgets and brand dollars. This attracts cyber criminals who target the easiest and largest profit opportunities. More companies are involved in serving video ads to consumers than ever before. This complexity enables cyber criminals to hide invalid traffic and make it difficult to detect. Advances in malware technology give cyber criminals access to millions of computers from unsuspecting consumers. Traffic fraud can be difficult to detect when it looks a lot like real traffic from real people. Types of Video Traffic Fraud There are generally two kinds of traffic fraud: bot-driven and human-driven. Whenever a video ad buyer or seller identifies suspicious-looking traffic, the first question they should ask is: Is this traffic being generated by humans, or by machines? SITE-BASED FRAUD Site-based fraud includes hidden ads, and falsely represented referrers (sometimes called referer spoofing ). Hidden ads are Fraudulent Bot Traffic: Fake visits to websites from computer bots, or the use of machines to generate fake ad impressions or clicks. Sometimes, through complicated shell companies, criminals sell fake visitors and impressions to publishers, who then use these traffic metrics to sell ad inventory to advertisers. In other situations, publishers themselves are engaged in generating and monetizing fraudulent traffic. The IAB estimates that 36% of online traffic is being fraudulently driven by bots which means that only 64% of page views are legitimate. 6 Illegitimate Human Traffic: This traffic is generated by actual humans, but has the same intent as fraudulent bot traffic. These humans are employed by criminal click farms to visit websites and/or click on ads. Click farm companies sell this traffic to publishers as legitimate, saying it comes from real people. Fraudulent human traffic makes up only a small part of traffic fraud today, as it s now easier for criminals to simulate site visits and ad clicks with non-human bots. 5 Source: We all need to be worried about online traffic fraud, April Source: Digiday, February, 2014

7 intentionally obscured stacked in layers of other ads, set to zero opacity or a 1x1 pixel iframe, or otherwise hidden but still register traffic when the site is visited. One of the simplest ways to detect false traffic is by monitoring referrals to a site, looking for large volumes of traffic referred by a single site, or a site that doesn t match a publisher s websites. Unfortunately, fraudulent players can use falsely represented referrers (or referer spoofing ) to elude detection. Traffic to a site is hidden among multiple referrers, simulating traffic from multiple individuals. USER-BASED FRAUD User-based fraud typically occurs when users unknowingly download malware through compromised s, software, or links, turning their computer into a host (or bot node ) on a botnet. Once a personal computer has been infected with the malicious software, bots now run in the background on their computers, continually visiting bogus sites without the user s knowledge. Impressions may be generated when a screensaver is running, or clone versions of browsers may run in invisible windows. Fraud follows the money. Given the higher costs associated with video advertising, it s a natural breeding ground for fraudulent activity to occur, both at the site level and user level (i.e., non-human bot traffic). Additionally, the fraudsters are becoming increasingly sophisticated in their tactics, making them harder to detect. - Mark Pearlstein, SVP Sales and Marketing, DoubleVerify Who Perpetrates Fraud? The criminals involved in traffic fraud run the gamut from small-time players to large, organized crime networks. On the small-time side, these fraudulent traffic dealers create and monetize hundreds of low-level but legitimate publisher sites. Larger networks, on the other hand, have become very sophisticated in building wide-scale botnets. For example, in June 2014, anti-fraud tracking company DoubleVerify identified a digital ad fraud crime ring, involving over 500 sites and affecting about 1% of all video ad traffic on the internet. During that same month, online security firm Telemetry uncovered a fraud operation hiding video ads in banner ads on legitimate publisher sites, undetected by multiple anti-fraud tools, and skimming tens of millions of dollars. 7 7 Source: Ad Age, June 2014

8 Protecting Yourself from Traffic Fraud Both advertisers and publishers can take concrete steps to protect themselves from traffic fraud. While no methods are foolproof, taking a systematic approach to identifying and avoiding fraudulent traffic dealers works to significantly reduce risk. Anti-Fraud Technology For as long as traffic fraud has existed, technology companies have sought to identify it. Many third-party companies are working to stop traffic fraudsters, including WhiteOps, Spider.IO (acquired by Google), Moat, DoubleVerify, Integral Ad Science, Forensiq, MdotLabs (acquired by comscore), and Pixalate. BrightRoll deploys its own anti-fraud technologies in addition to working with independent companies to identify and eliminate fraudulent traffic. Like the antivirus industry, the anti-fraud industry must continually evolve its methods and technology because traffic fraud perpetrators are sophisticated, continually evolving their methods to avoid detection. Independent measurement and verification services are critical to addressing traffic fraud, because they re impartial and have no financial incentive to let fraud persist. Additionally, independent measurement vendors are laser focused on developing the technology to fight fraud. - Scott Knoll, CEO of Integral Ad Science

9 Five Things Advertisers Can do to Protect Themselves Use accredited, third-party verification services to complement the tools most media sellers develop in-house. Note that this is a necessary addition to any fraud protection services your media seller provides. Look for a third party who is not a media seller your referee shouldn t also be playing the game. If a media seller s numbers can t be verified, or are dramatically different than those reported by a third party, consider that a red flag. Establish your target audience, and verify that it s been reached. Define your goals in terms of audiences rather than only numbers of impressions. Work with your media seller to make sure these audiences are being specifically targeted. Verify that your ad has been shown to your target demographics. Use an impartial, independent third-party such as comscore or Nielsen to verify that your target audience was actually reached. Use Demand Side Platforms (DSPs) that are certified compliant with IAB Quality Assurance Guidelines. Your buying software should comply with industry best practices around transparency, and using IAB certified partners is a key step in the collective effort required to mitigate the problem. Your DSP should also be integrated with accredited IQ (Inventory Quality) vendors, and enable you to act on data provided by those vendors programmatically. Sophisticated DSPs enable you to filter the inventory you buy based on the IAB s QA guidelines. You can see a list of QAG certified companies here. 4 Review the site URLs your ads run on on. Your brand is accountable for its ad placement, so you need to know where your impressions are running. Get specifics on URLs before your ads run and ensure your third-party verifier is continually reviewing and verify those URLs. 5 Determine up front what recourse your supplier provides for fraudulently-served impressions. Should you confirm that your traffic has been affected by fraud, you and your supplier will need an agreed-upon plan of recourse. Will the supplier refund money you ve paid for fraudulent impressions, or make good with legitimate impressions?

10 Five Things Publishers Can do to Protect Themselves 1 Minimize purchasing traffic. Nothing can replace the quality of the audience you develop organically. If you can, avoid purchasing traffic for your website purchased traffic increases your risk of exposure to fraud. If you must, minimize your risk by adhering to these guidelines, recommended by the Interactive Advertising Bureau: You get what you pay for be prepared to pay higher prices for quality traffic. Fit matters look for a natural affinity between your content and the traffic you re purchasing. Test the traffic use technology to detect non-human traffic on all of the traffic you are buying. Stay on track don t lower your standards when performance slips below your goals. Use trusted sellers know your consultants, and know where they are sourcing traffic. 2 Come to an agreed-upon definition of quality traffic with your partners. Work with your partners to determine the quality of traffic they re looking for, and the ways both parties will measure that quality. Be sure to document your terms of agreement Incentivize quality, not quantity of traffic. Generating traffic for traffic s sake is never a good move, so work with your partners (and internal organization members) to incentivize high quality traffic. Set goals around reaching targeted audiences, rather than generating certain numbers of impressions. Evaluate the quality of your traffic. Suspicious traffic should be monitored and, if verified as fraudulent, blocked. Use an independent vendor to measure your traffic, which you can then use as a benchmark against your own measurements. But don t rely on technology alone to monitor and evaluate your traffic leverage human resources to detect fraudulent traffic to your site as well. Protect your partners from malware. Maintain a safe, trusted space for advertisers. Continuously monitor and screen all sources of traffic to your website. If, for example, your ad is generating anomalous results, proactively investigate them for fraudulent activity.

11 Conclusion Traffic fraud is not a new problem, but with the rapid rise of digital video, the stakes are higher today than ever before brands have increased spend on high-quality video ads to engage today s consumers, and fraudulent traffic dealers have become more sophisticated in turn. With billions of dollars in digital video ad spend at stake, these dealers will continue to innovate new ways to divert traffic to fraudulent sites and bogus ad inventory. BrightRoll believes the way forward is via collective action between advertisers, technology platforms, and publishers. Advertisers must be aware of the problem and take action to avoid fraudulent inventory, publishers must work to ensure the quality and legitimacy of their traffic, and technology platforms must provide the tools to help both buyers and sellers transact in a trusted manner. We urge you to join us in taking collective action to solve this problem in our industry. To get involved, we recommend you consult the Trustworthy Digital Supply Chain Initiative, a joint effort of the IAB (Interactive Advertising Bureau), the ANA (Association of National Advertisers) and the 4A s (American Association of Advertising Agencies). No party wins with ad fraud, except, of course, the perpetrators. For this reason, advertisers and publishers must protect themselves from fraudulent traffic, educating themselves on best practices and new technologies, and ensuring that money spent on video advertising goes to legitimate, impactful impressions.

12 What is BrightRoll Doing to Stop Traffic Fraud? In the eight years since our founding, BrightRoll has focused exclusively on building technology to automate and improve digital video advertising. Today, we operate the single largest digital video marketplace and advertising platform in the industry, which gives us a unique and powerful view of the selling and buying behaviors. While no single company can solve the problem unilaterally, we believe that platforms like ours are strategically vital in the fight against fraud. While the industry works to create mechanisms to solve this problem, BrightRoll is taking proactive steps to identify invalid traffic and reduce financial incentives for malicious actors, protecting the ecosystem from abuse. We built our traffic fraud defense strategy on four guiding principles: Independent, accredited measurement and validation To assure brands that their campaigns are not impacted by non-human, BrightRoll has partnerships with leading fraud detection, verification, and measurement companies including DoubleVerify, Integral Ad Science, and Moat. Proprietary technology We develop and employ our own technology to identify fraudulent sites and impressions, and we actively block tens of millions of fraudulent impressions daily from running on campaigns. In 2011, BrightRoll launched VideoRank, the video industry s first fraud avoidance technology, and we have continued to innovate upon this proprietary solution. Human curation We maintain a team of more than 25 inventoryfocused analysts and data scientists who proactively review and monitor the quality of traffic on the BrightRoll platform, and are responsible for investigating any claims of illegitimate activity. BrightRoll also has an executive committee on inventory quality. Industry Leadership and Certification We are a founding member of the IAB Trustworthy Digital Supply Chain Initiative (formerly TOGI), strategizing tangible, industry-wide collective actions to mitigate fraud. We are also compliant with IAB s Quality Assurance Guidelines. Our industry certifications include NAI, DAA, and TRUSTe. Given the higher costs and strong demand for video advertising, it s an attractive target for fraudulent activity. We re committed to working with BrightRoll and the industry to root out fraud from the digital video advertising ecosystem. - Wayne Gattinella, CEO, DoubleVerify

13 BrightRoll is the only independent and unified programmatic video advertising platform for reaching audiences across the web, mobile and connected TV. The company powers digital video advertising for the world s largest brands, including 85 of the top 100 US advertisers and 18 of the top 20 advertising technology companies. The platform enables advertisers to reach 4 in 5 video viewers online and consistently ranks among the top two video ad platforms in ads served. As a result, BrightRoll technology collects and analyzes hundreds of billions of data points monthly enabling real-time decisions that drive ROI for advertisers. 85 of AdAge of 20 top ad networks Top 15 agencies ADVERTISERS BRANDS ATDs AD NETWORKS AGENCIES PRIVATE MARKETPLACE DESKTOP MOBILE WEB & APPS SSPs EXCHANGES PUBLISHERS 25/50 of top publishers 15,000 websites 10 largest DSPs PARTNERS 6,000 mobile web & apps 100+ leading video service partners in data, research, creative services, and technology and infrastructure. For more case studies, whitepapers and videos about BrightRoll and the programmatic advertising space, please visit our resources page. BrightRoll.com United States Europe Canada Copyright 2014 BrightRoll, Inc.