Digital Ad Fraud: Fighting Malware, Online Piracy & Invalid Traffic

April 5, 2016

Part 3 of AAM’s Guide to Media Transparency looks closer at the industry’s game plan for fighting back against digital ad fraud, how the various initiatives fit together and what you should know about them.

Susan Kantor, Director, Marketing and Communications

For AAM’s Guide to Media Transparency, we talked to leaders from all sides of the industry to answer one key question:

How do we build more accountability and transparency between marketers, media agencies, technology vendors and publishers for the long-term success of the media industry?

Part 1 gave an overview of how to build more accountability and transparency. In Part 2 we looked behind the scenes to understand the complexity of programmatic advertising.

This is Part 3, which looks closer at the industry’s game plan for fighting back against digital ad fraud, how the various initiatives fit together and what you should know about them.



advertiser trust

Imagine you are a marketer, early twentieth century. You advertise in newspapers and magazines. But because publishers disclose their own circulation, you’re not sure whether their unverified claims are legitimate or include circulation that actually ended up dumped in a river. In short, you’re not confident in how your media budgets are spent.

Fast forward 100 years. The media channels are different, but marketers, ad agencies, publishers and now tech vendors face the same issues of making sure media measurements are reliable in an even more complex environment. The IAB and EY recently released a study that detailed the cost of corruption to the digital ad industry at $8.2 billion per year.

In 1914 advertisers united with advertising agencies and publishers to found what is now the Alliance for Audited Media to stop print fraud and wasted ad dollars. What’s the road map to a digital ad fraud solution for media today?

“I think we have a long way to go to address digital ad fraud the same way we addressed circulation fraud in the early 1900s,” explained Jeff Holecko, senior brand managerfor Kimberly-Clark North America. “Digital ad fraud is a much bigger issue.”


The Types of Digital Ad Fraud

Digital ad fraud is a broad term that encompasses many different things—piracy, malware, invalid traffic.

Steve Guenther, vice president of digital services at AAM, notes that the industry has made good progress within the past few years to address the $8.2 billion digital ad fraud issue. The stage was set with the 2015 release of the MRC’s Invalid Traffic Guidelines, which tech companies are required to implement by the end of April 2016. The Trustworthy Accountability Group also has a number of initiatives, all of which require registration with TAG as a critical first step.

“We have a lot of the pieces to the puzzle in place, but now they need to be implemented by the vendors in the digital advertising supply chain to move forward,” Guenther said. “All companies need to be part of TAG to demonstrate they are legitimate companies that are part of the solution and not the problem. Ad tech vendors need to adopt and implement the IVT guidelines and use the TAG tools to start squeezing out the bad actors in the digital advertising supply chain.”

Many industry organizations are working together to address digital ad fraud such as piracy, curb malware and fight invalid traffic for a healthier media ecosystem.

$8.2 billion lost annually to online fraud

Invalid Traffic 

Invalid traffic accounted for $4.6 billion in digital ad fraud last year, or more than half of the $8.2 billion total. Invalid traffic, as defined by the MRC guidelines, should not be included in measurement counts because it doesn’t meet certain ad serving quality standards. This means that invalid traffic varies in types and sophistication. There are, for example, good bots like the ones that crawl for Google to make searches more accurate but are still considered invalid, non-human traffic. And there are bad bots—botnets, malware, zombie bots—that impersonate users, generate false impressions, and visit some sites and click on ads to manipulate CTR.


What is Sourced Traffic?

Ever see those sponsored content stories at the bottom of a news story page that doesn’t quite align with the rest of the site content? Chances are they’re part of sourced traffic, which is when publishers acquire visitors through third parties. A 2015 ANA study found that sourced traffic was more than three times more likely to contain bots than unsourced traffic. While some sourced traffic is legitimate, it’s important to know the dangers around it. Read on for tips on how you can stay safe in the next section.

2015 ANA study found that sourced traffic was more than three times more likely to contain bots than unsourced traffic. While some sourced traffic is legitimate, it’s important to know the dangers around it. Read on for tips on how you can stay safe in the next section.


In fall 2015, the MRC released its Invalid Traffic Detection and Filtration Guidelines Addendum that requires every accredited digital measurement system to filter fraudulent traffic before reporting metrics to the marketplace. The IVT guidelines include two categories: general and sophisticated. The general guidelines address basic filtering using lists and data analytics to detect and filter invalid traffic, while the sophisticated guidelines focus more on real-time detection techniques to “sniff out” invalid traffic.

“As companies are going through the accreditation process, it’s important for them to understand the differences between general versus sophisticated techniques,” Guenther said. “AAM works with companies to help them prepare for their MRC accreditation and can explain the differences.”

“We also need to measure properly on mobile,” explained Preethy Vaidyanathan, senior vice president of product management for Medialets. “It doesn’t matter what you’re doing, you need to eliminate invalid traffic first.”

Of the $4.6 billion lost to fraudulent traffic, 72% is from desktops and 28% is from mobile.


Another type of digital ad fraud, “malvertising,” accounted for $1.1 billion in lost revenue and costs in 2015, per the IAB study. When users interact with infected content—links, websites, email attachments, pirated content—they become susceptible to infecting their computers with malware. This malicious software takes control of the users’ computers to create “botnets” that mimic human behavior, generate non-human traffic and create digital ad fraud in the media industry.

Combatting malware is one of the four pillars of TAG, which established an Anti-Malware Working Group to create a more secure, trusted ecosystem for advertisers and consumers. Look for more from TAG and the working group coming later in 2016.

67% of bot traffic comes from residential IP addresses.


Online content—videos, music, editorial—that is stolen accounted for $2.4 billion in 2015. Pirated content hurts content creators, advertisers and legitimate publishers because it drives revenue to deceptive sites.

In spring 2016 AAM worked with Sovrn to become certified as a Digital Advertising Assurance Provider. Read more about Sovrn’s story

The Trustworthy Accountability Group’s Brand Integrity Program Against Piracy helps advertisers and agencies avoid sites with pirated and counterfeit content. As part of the program, approved third-party validators—including AAM—certify ad tech companies as Digital Advertising Assurance Providers if they meet criteria to help other advertising companies limit interactions with these pirated sites.

GroupM, a charter member of TAG, announced in the fall of 2015 that it requires its media partners to use TAG-certified providers of anti-piracy services.

“That’s part of the value,” said Joe Barone, managing partner of GroupM. “Third-party audits helps us break it down into those who have been certified and those who haven’t.”

GroupM also works with major content-producing clients to identify 200,000 domains that pirate content to create a blacklist.

“We have to constantly keep this up to date and make sure the API is working so that data is available in real time as we’re bidding,” Barone explained. “We’ve been in this space a lot longer than TAG has, but to have a comprehensive approach, we need contributions of multiple players. TAG helps facilitate that approach and will also help manage the blacklist.”  


The Roadmap to a Transparent Media Environment

With billions of dollars and brand reputations at stake, everyone in the media ecosystem needs to take responsibility and contribute to digital ad fraud solutions. True partnership between publishers, agencies, vendors and marketers is the only way to address the issue.

“The more conversations that are had in public, the more it encourages people to shine a light on places in the ecosystem that are unknown,” said Boyd. “I really like to think that we’re going to have an ecosystem where, unless you’re certified or are known to be of character, you’re not going to be able to participate or, at a minimum, advertisers and their agencies will be able to make an informed choice. The more that we expand that circle of trust, the less room there is for the untrustworthy.”

“The thought of purchasing non-human and non-viewable impressions is untenable,” Holecko said. “Unfortunately, we’ve been slow to coordinate a proactive, progressive effort to holistically address the situation. We need to aggressively address bot fraud, human fraud and the black market of sourced traffic at an industry level.”

Barone agreed that all sides of the industry need to come together to coordinate a real digital ad fraud solution.

“This should not be something that becomes a point of difference from one player to another,” Barone said. “We should all be doing this together as an industry solution. Those pirates can survive without our money, but not without everybody’s money.”

Here are a few pointers for an industrywide approach to tackling fraud.


Combat Ad Fraud: Tips for Publishers, Ad Tech Providers and Media Buyers

Digital Ad Fraud Tips for Advertisers

  • Work with your agency to establish clear goals and objectives for each campaign, articulate them in the media plan, and be sure to analyze performance to established KPIs.
  • Insist that your partners and vendors only use third-party technology that has been independently audited to industry guidelines and best practices that address issues such as transparent measurement, brand safety and supply chain efficiency.
  • Inform agencies and vendors upfront that you will not pay for non-human traffic and agree on which tools to use to measure viewability and remove fraudulent traffic.
  • Ask to receive a post-campaign reconciliation for every engagement to ensure you understand where your ads ran (on what sites, next to brand friendly content).
  • Assign an accountability steward from your team to work closely with your agency and participate in industry groups to make sure you are up-to-date on best practices.
  • Become involved with TAG to promote working with verified, registered media partners.

Jeff Holecko, Kimberly-Clark

Digital Ad Fraud Tips for Ad Agencies

  • Follow the Interactive Advertising Bureau (IAB) best practices for workflow and guidelines for ad campaign measurement processes.
  • Ensure complete, detailed insertion orders that include placement details, concise billing language, delivery requirements and targeting purchased. 
  • Require technology vendors to be certified or accredited to industry standards.
  • Avoid websites and networks that rely on buying traffic from third-party sources. Include language in RFPs and insertion orders that requires publishers to disclose sourced traffic.
  • Ask publishers whether they are audited or work with certified companies.
  • Maintain a master reconciliation system to track campaign dates, invoices and revisions.
  • Email publishers a report of third-party numbers at the end of every month.
  • If you run a trading desk, provide transparent reporting about fees and costs.

Joe Barone, GroupM

Digital Ad Fraud Tips for Ad Tech Vendors

  • Learn about the options for ad tech verification and then get certified to industry guidelines, which now includes the MRC’s Invalid Traffic Detection and Filtration Guidelines.
  • Register with the Trustworthy Accountability Group to show your commitment as a quality company in the digital advertising supply chain.
  • Learn about training options from TAG and AAM, including new compliance officer training.
  • Provide transparent reporting at the site level for your media partners.

Preethy Vaidyanathan, Medialets

Digital Ad Fraud Tips for Publishers

  • Understand implications of invalid traffic on your site and work with a third party to audit those metrics.
  • Work with vendors that are certified to industry guidelines.
  • Be more transparent about sourced traffic, monitor the traffic and eliminate sources with high bot percentages.
  • Analyze your website traffic and share that information with your media buyer partners.
  • Work with your buyers to understand what they want out of their campaign and how you can help provide it.

Cynthia Young, The Globe and Mail

In the next white paper, we’ll look at how each side of the industry can help bring more clarity to viewability measurements.

Previous Article
How Have Advertisers Acted on Media Transparency, Ad Blocking and Viewability?
How Have Advertisers Acted on Media Transparency, Ad Blocking and Viewability?

L’Oréal Canada’s Khoi Truong talks about his concerns with ad blocking and viewability and why advertisers ...

Next Article
How Sovrn Is Fighting Ad Fraud And Piracy With AAM Verification
How Sovrn Is Fighting Ad Fraud And Piracy With AAM Verification

AAM completed an audit for Sovrn certifying them as a Digital Advertising Assurance Provider (DAAP).


Navigate your way through the media landscape with AAM's Buy/Sell Connection.

First Name
Last Name
Company Name
Thank you!
Error - something went wrong!