By Bernardo Tinti – Measurement & Impact Lead at Winclap

This article is part of the Marketing Efficiencies Playbook, a joint effort from Winclap and Softbank Latin America Fund to bring experts’ knowledge to leading startups and marketers to increase their efficiency and transform how they grow.

The challenge of Ad Fraud

Pedro de Arteaga, COO and VP USA (left), Gonzalo Varela, VP of Growth at Winclap (right) along with Amanda Ferracini, Marketing Leader at Softbank Latin America Fund (far right) at the Marketing Efficiency Workshop Sao Paulo edition, discussing with leading startups in Brazil how to diversify paid media effectively.

In general terms, advertising fraud can be defined as a false promise of marketing value. Advertisers pay their media partners (CPM, CPC, CPI, CPA) in exchange for providing user interactions with their ads that could lead to app installs, purchases, logins, or any other kind of user engagement with the advertiser’s product.
Ad fraud occurs when a media partner deceives or exploits any part of this process in order to make a profit out of false marketing results.

Although ad fraud is developed in many ways (and it’s constantly evolving), two broad fraud categories can be recognized: attribution hijacking and fake users.:

1. Attribution Hijacking 

Since payments to media partners are often based on the results tracked through an attribution model (most of the times implemented by an analytics tool or an MMP), a very common technique used by fraudsters is to exploit the attribution model to attribute themselves installs which were originally driven by organic traffic or by other media. This is accomplished by inserting fake clicks (generated by malware software) in the event attribution model, in order to exploit the rule which attributes the event only to the media that generated the last click before the event (“last touch attribution” or LTA). Two common variants of this fraud type are “install hijacking” and “click spamming/flooding”.

Click Flooding

Install hijacking is a class of mobile fraud that uses mobile malware to hijack attribution for an install. Install hijacking is a broad term which includes “click injection”, “referrer hijacking” and click hijacking.

2. Fake Users

Another way in which fraudsters deceive advertisers is by generating fake user activity, usually through “device farms”(devices programmed to perform certain activities without a real user behind) or bots (malware designed to emulate user activity).
Using these tools, fraudsters can charge advertisers for events which weren’t performed by real users, and consequently do not generate any value. These methods, although more complex, are highly scalable since they don’t rely on user activity generated by other channels.

Device farms are a type of mobile ad fraud where fraudsters manually perform actions (such as clicks, installs, and other forms of engagement) to create the illusion of legitimate activity, draining advertising budgets. 

As we can see, all kinds of advertising fraud share one thing in common: they generate results that are not incremental. This means that fraudulent medias may show good results within the attribution model, but in the end they don’t deliver real business value to the advertisers who are paying them (more about incrementality here).

Why is it important for companies, what are the benefits

Advertising fraud poses a major threat to any growth strategy because its negative effects can be traced down to many levels, in ways in which its “victims” do not always fully understand or perceive. More precisely, ad fraud harms growth initiatives on three different levels:

1. Economic

The most direct way in which fraud affects growth is by charging advertisers for marketing actions that don’t generate any value, thus draining their scarce marketing budgets (AppsFlyer estimates that during 2021,over $2.1B in advertising budgets were exposed to fraud). But that’s not all. If the budgets drained by fraudsters would had been allocated to other initiatives, real value (in terms of revenue and growth) would have been generated. This potential value lost constitutes the opportunity cost or indirect effect of fraud.

2. Analytical

3. Organizational

Besides biased decision making, distorted data also presents anomalies which causes analytics and marketing teams to spend countless hours in data cleaning, analysis and reconciliation. Those efforts also have an opportunity cost in terms of alternative initiatives with real business value.

Maturity Level

How – best practices, mistakes to avoid, Step by step

Ad fraudsters do not make any distinction across company sizes or verticals, but depending on your company’s growth stage, the risks you are exposed to may differ. Here is a simple questionnaire to determine your maturity level.

• Basic Level

In this stage you have probably just started running your first user acquisition campaigns in paid media channels. The most common and recommended way to do this is with popular and trustworthy networks such as Google or Meta. As long as you’re only using these self-attributed networks, fraud shouldn’t be a major issue. Google does three types of fraud detection (live at the moment of the click, a periodic proactive review of your account, and a reactive review every time you see suspicious activity) and Meta’s traffic is well known. Basic protection solutions integrated within most MMPs or other third-party providers is recommended, but not a top priority.

• Intermediate Level

After you have substantially grown your user base advertising on popular networks, you will probably try to explore some new medias in programmatic advertising, on-device traffic, offerwalls, etc. This is the point where fraud becomes a potential threat, since you start exposing your advertising budget to untrusted medias. 

Whether you’re already running campaigns in programmatic or other medias or planning to do so, you should carefully check how medias operate in order to select transparent partners. Non-transparent (and potentially fraudulent medias) usually show any of the following characteristics:

• Do not track impressions
• Do not share the site/app names where they place the ads
• May significantly change the trend of organic events when turned on
• Offer fixed CPA (Cost Per Acquisition) pricing
• Show abnormally low CPAs (when compared to popular and reliable medias)

Avoiding medias with such characteristics will help ensure transparency across your whole media buying process.

One important sanity check you can do when you start running new medias is analyzing the consistency and understanding the medias’ business models, especially when dealing with medias which offer fixed CPA pricing.

At Winclap we work together with several clients to help them SAFELY diversify their media strategy when we see in our predicted media saturation curves that the channels they are currently using are becoming too saturated. We’ve worked with +30 medias, and continue actively working with the most incremental ones, making sure that each one of the media that we propose for testing has gone through all our anti-fraud controls, in addition to the tools that we also contribute the MMPs.

• Advanced Level

In this final stage you are probably running campaigns in multiple channels, since the popular and trusted medias you began with are now already saturated. Fraud detection and prevention is a critical issue at this point, since an important part of your budget is probably exposed to potentially fraudulent medias.

The transparency analysis mentioned above should be carried out for all medias, but, since fraudulent medias have very low or even null incrementality, the right and accurate way to decide whether to keep or to stop running campaigns in a media that doesn’t look transparent is to measure its incrementality. So, a good way to start your incrementality measurement practice is to perform incrementality tests on non transparent medias.

Although there are few different methodologies available to measure incrementality (PSA, ghost bidding, geo tests, etc), non transparent medias usually don’t offer any internal measurement framework (and even if they did, their results should not be taken at face value). However, this mustn’t stop you from measuring them. There are testing methodologies that can be implemented 100% from your side (such as geo tests, synthetic control groups or intent-to-treat tests), and open source tools that can be used to build the counterfactual scenarios required for incrementality testing (like Facebook’s Neural Prophet or Google’s CausalImpact). Please feel free to contact Winclap if you want to learn more about incrementality measurement for fraud prevention!

Case study

A company has been running campaigns in five different medias (A, B, C, D and E) for the last 13 weeks. However, the marketing team has been analyzing media A’s transparency, and they have noticed that the media is charging them based on a fixed CPA, that the media doesn’t track impressions, and that neither shares the site id names where it publishes the ads. The team suspects that the media may be incurring in fraud, so they decide to run an incrementality test to corroborate their suspicions.

The test is performed by turning off media A for three weeks, and comparing the change in total events versus a counterfactual scenario in which the media was turned on (see graph below). The counterfactual scenario was built using Facebook’s forecast tool NeuralProphet. After the three week testing period, the results showed that the real scenario (media turned off) and the counterfactual scenario (media turned on) were very similar in terms of total events. This means that media A wasn’t generating a significant amount of incremental events, and therefore wasn’t worthy to keep spending on it.

As we have mentioned in this post, fraud poses a major threat to any growth strategy, since its implications exceed occasional budget losses and may lead to a “bleeding cash cycle” quite difficult to escape from. Although the exposure to this threat may be different according to the company’s growth stage, there’s almost no way to be completely exempt from this hazard. In this context, choosing the right media partners based on transparency and measuring their incrementality are two fundamental tasks that no marketer should avoid.

In case you are suspicious that any of your paid media partners may be incurring in fraud, or you want to start building a fraud prevention and incrementality measurement practice within your marketing team, please contact Winclap for customized support and solution building.

If you enjoyed this post be sure to check other articles of the Marketing Efficiency Playbook, where we talk about LTV Optimization, Channel Diversification, Incrementality and more.