Click fraud

Click fraud is a type of fraud that occurs on the Internet in pay-per-click (PPC) online advertising. In this type of advertising, the owners of websites that post the ads are paid an amount of money determined by how many visitors to the sites click on the ads. Fraud occurs when a person, automated script, or computer program imitates a legitimate user of a web browser, clicking on such an ad without having an actual interest in the target of the ad's link. Click fraud is the subject of some controversy and increasing litigation due to the advertising networks being a key beneficiary of the fraud.

Media entrepreneur and journalist John Battelle describes click fraud as the intentionally malicious, "decidedly black hat" practice of publishers gaming paid search advertising by employing robots or low-wage workers to click on ads on their sites repeatedly, thereby generating money to be paid by the advertiser to the publisher and to any agent the advertiser may be using.

Pay-per-click advertising
Main article: Pay-per-click

PPC advertising is an arrangement in which webmasters (operators of websites), acting as publishers, display clickable links from advertisers in exchange for a charge per click. As this industry evolved, a number of advertising networks developed, which acted as middlemen between these two groups (publishers and advertisers). Each time a (believed to be) valid Web user clicks on an ad, the advertiser pays the advertising network, which in turn pays the publisher a share of this money. This revenue-sharing system is seen as an incentive for click fraud.

The largest of the advertising networks, Google's AdWords/AdSense and Yahoo! Search Marketing, act in a dual role, since they are also publishers themselves (on their search engines).[1] According to critics, this complex relationship may create a conflict of interest. This is because these companies lose money to undetected click fraud when paying out to the publisher but make more money when collecting fees from the advertiser. Because of the spread between what they collect and pay out, unfettered click fraud would create short-term profits for these companies.

Non-contracting parties

A secondary source of click fraud is non-contracting parties, who are not part of any pay-per-click agreement. This type of fraud is even harder to police, because perpetrators generally cannot be sued for breach of contract or charged criminally with fraud. Examples of non-contracting parties are:

  • Competitors of advertisers: These parties may wish to harm a competitor who advertises in the same market by clicking on their ads. The perpetrators do not profit directly but force the advertiser to pay for irrelevant clicks, thus weakening or eliminating a source of competition.
  • Competitors of publishers: These persons may wish to frame a publisher. It is made to look as if the publisher is clicking on its own ads. The advertising network may then terminate the relationship. Many publishers rely exclusively on revenue from advertising and could be put out of business by such an attack.
  • Other malicious intent: As with vandalism, there are many motives for wishing to cause harm to either an advertiser or a publisher, even by people who have nothing to gain financially. Motives include political and personal vendettas. These cases are often the hardest to deal with, since it is difficult to track down the culprit, and if found, there is little legal action that can be taken against them.
  • Friends of the publisher: Sometimes upon learning a publisher profits from ads being clicked, a supporter of the publisher (like a fan, family member, political party supporter, charity patron or personal friend) will click on the ads to help. This can be considered patronage. However, this can backfire when the publisher (not the friend) is accused of click fraud.

Advertising networks may try to stop fraud by all parties but often do not know which clicks are legitimate. Unlike fraud committed by the publisher, it is difficult to know who should pay when past click fraud is found. Publishers resent having to pay refunds for something that is not their fault. However, advertisers are adamant that they should not have to pay for phony clicks.

Organization

Click fraud can be as simple as one person starting a small Web site, becoming a publisher of ads, and clicking on those ads to generate revenue. Often the number of clicks and their value is so small that the fraud goes undetected. Publishers may claim that small amounts of such clicking is an accident, which is often the case.

Much larger-scale fraud also occurs.[2] Those engaged in large-scale fraud will often run scripts which simulate a human clicking on ads in Web pages.[3] However, huge numbers of clicks appearing to come from just one, or a small number of computers, or a single geographic area, look highly suspicious to the advertising network and advertisers. Clicks coming from a computer known to be that of a publisher also look suspicious to those watching for click fraud. A person attempting large-scale fraud, from one computer, stands a good chance of being caught.

One type of fraud that circumvents detection based on IP patterns uses existing user traffic, turning this into clicks or impressions.[4] Such an attack can be camouflaged from users by using 0-size iframes to display advertisements that are programmatically retrieved using JavaScript. It could also be camouflaged from advertisers and portals by ensuring that so-called "reverse spiders" are presented with a legitimate page, while human visitors are presented with a page that commits click fraud. The use of 0-size iframes and other techniques involving human visitors may also be combined with the use of incentivized traffic, where members of "Paid to Read" (PTR) sites are paid small amounts of money (often a fraction of a cent) to visit a website and/or click on keywords and search results, sometimes hundreds or thousands of times every day[5] Some owners of PTR sites are members of PPC engines and may send many email ads to users who do search, while sending few ads to those who do not. They do this mainly because the charge per click on search results is often the only source of revenue to the site. This is known as forced searching, a practice that is frowned upon in the Get Paid To industry.

Organized crime can handle this by having many computers with their own Internet connections in different geographic locations. Often, scripts fail to mimic true human behavior, so organized crime networks use Trojan code to turn the average person's machines into zombie computers and use sporadic redirects or DNS cache poisoning to turn the oblivious user's actions into actions generating revenue for the scammer. It can be difficult for advertisers, advertising networks, and authorities to pursue cases against networks of people spread around multiple countries.

Impression fraud is when falsely generated ad impressions affect an advertiser's account. In the case of click-through rate based auction models, the advertiser may be penalized for having an unacceptably low click-through for a given keyword. This involves making numerous searches for a keyword without clicking of the ad. Such ads are disabled[6] automatically, enabling a competitor's lower-bid ad for the same keyword to continue, while several high bidders (on the first page of the search results) have been eliminated.

Hit inflation attack

A hit inflation attack is a kind of fraudulent method used by some advertisement publishers to earn unjustified revenue on the traffic they drive to the advertisers’ Web sites. It is more sophisticated and harder to detect than a simple inflation attack.

This process involves the collaboration of two counterparts, a dishonest publisher, P, and a dishonest Web site, S. Web pages on S contain a script that redirects the customer to P's Web site, and this process is hidden from the customer. So, when user U retrieves a page on S, it would simulate a click or request to a page on P's site. P's site has two kinds of webpages: a manipulated version, and an original version. The manipulated version simulates a click or request to the advertisement, causing P to be credited for the click-through. P selectively determines whether to load the manipulated (and thus fraudulent) script to U's browser by checking if it was from S. This can be done through the Referrer field, which specifies the site from which the link to P was obtained. All requests from S will be loaded with the manipulated script, and thus the automatic and hidden request will be sent.[7]

This attack will silently convert every innocent visit to S to a click on the advertisement on P's page. Even worse, P can be in collaboration with several dishonest Web sites, each of which can be in collaboration with several dishonest publishers. If the advertisement commissioner visits the Web site of P, the non-fraudulent page will be displayed, and thus P cannot be accused of being fraudulent. Without a reason for suspecting that such collaboration exists, the advertisement commissioner has to inspect all the Internet sites to detect such attacks, which is infeasible.[7]

Another proposed method for detection of this type of fraud is through use of association rules.[8]

Manipulation of organic search results

One major factor that affects the ranking of websites in organic search results is the CTR (Click-through Rate). That is the ratio of clicks to impressions, or in other words how many times a search result is clicked on, as compared to the number of times the listing appears in search results.

In contrast to PPC fraud, where a competitor leverages the services of a botnet, or low cost labour, to generate false clicks, in this case the objective is to beggar thy competitor by making their CTR rate as low as possible, thereby diminishing their ranking factor (position from the top of search results).

Bad actors will therefore generate false clicks on organic search results that they wish to promote, while avoiding search results they wish to demote. This technique can effectively create a cartel of business services controlled by the same bad actor, or be used to promote a certain political opinion etc. The scale of this issue is unknown, but is certainly evident to many website developers who pay close attention to the statistics in webmaster tools.

Google Search has been accused of using using so called zero-click search to prevent large part of the traffic leaving its page to third-party publishers. In 2015 Google introduces Knowledge Graph and Direct Answers feature which consist of a large box on the main results page, with the key information obtained from third-party sources such as Wikipedia, dictionaries, weather websites etc. As result 71% searches end on the Google search page. In case of one specific query out of 890'000 searches on Google, only 30'000 resulted in the user clicking on the results website.[9]

Lawsuits
  • Disputes over the issue have resulted in a number of lawsuits. In one case, Google (acting as both an advertiser and advertising network) won a lawsuit against a Texas company called Auction Experts (acting as a publisher), which Google accused of paying people to click on ads that appeared on Auction Experts' site, costing advertisers $50,000.[10] Despite networks' efforts to stop it, publishers are suspicious of the motives of the advertising networks, because the advertising network receives money for each click, even if it is fraudulent.
  • In July 2005, Yahoo settled a class-action lawsuit against it by plaintiffs alleging it did not do enough to prevent click fraud. Yahoo paid $4.5 million in legal bills for the plaintiffs and agreed to settle advertiser claims dating back to 2004[11] In July 2006, Google settled a similar suit for $90 million.[12][13]
  • On March 8, 2006, Google agreed to a $90 million settlement fund in the class-action lawsuit filed by Lane's Gifts & Collectibles.[14] The class-action lawsuit was filed in Miller County, Arkansas, by Dallas attorneys Steve Malouf, Joel Fineberg, and Dean Gresham.[15] The expert witness for the Plaintiffs in the case was Jessie Stricchiola, an internet search expert who first identified instances of PPC fraud in 2001.[16]

Michael Anthony Bradley

In 2004, California resident Michael Anthony Bradley created Google Clique, a software program that he claimed could let spammers defraud Google out of millions of dollars in fraudulent clicks, which ultimately led to his arrest and indictment.[17]

Bradley used technology that he created for his other companies that took him five years to develop. Using this technology, he was able to demonstrate that fraud was possible, and was impossible for Google to detect.

Bradley notified Google of this security flaw, and was willing to work with them to close up some of these holes. However, Bradley was offered $500,000 for his software and technology by some of the world's top spammers. With this information, Bradley thought he could put a price of $100,000 on his technology, and offered to sell Google all rights to his technology, and they could make the Internet a better and safer place.

When Bradley showed up to Google's offices, he demonstrated the software for them, and when they asked what he wanted, he had stated that he would consult for free if they wanted to purchase the rights to his technology. He explained the prior offer of $500,000 and said he knew he could get it, but would settle for $100,000 if they wanted to work together.

Bradley returned to Google's offices and was met by United States Secret Service officers who were undercover. They kept asking him what he wanted, and they even pushed a check for $100,000 to him. Bradley stated that this felt like blackmail and was not comfortable with this, and pushed the money away. Just then the Secret Service came in and arrested him.

Authorities said he was arrested while trying to extort $100,000 from Google in exchange for handing over the program.[18]

Charges were dropped without explanation on November 22, 2006; both the US Attorney's office and Google declined to comment. Business Week suggests that Google was unwilling to cooperate with the prosecution, as it would be forced to disclose its click fraud detection techniques publicly.[19]

Fabio Gasperini

On June 18, 2016, Fabio Gasperini, an Italian citizen, was extradited to the United States on click fraud charges.[20] An indictment charged Gasperini with:

According to the U.S. government, Gasperini set up and operated a botnet of over 140,000 computers around the world. This was the first click fraud trial in the United States. If convicted of all counts, Gasperini risked up to 70 years in jail.

Simone Bertollini, an Italian-American lawyer, represented Gasperini at trial. On August 9, 2017 a jury acquitted Gasperini of all the felony charges of the indictment. Gasperini was convicted of one misdemeanor count of obtaining information without a financial gain. Gasperini was sentenced to the statutory maximum of one year imprisonment, a $100,000 fine, and one year of supervised release following incarceration. Shortly after he was credited with time served and sent back to Italy. An appeal is currently pending.[21]

Solutions

Proving click fraud can be very difficult since it is hard to know who is behind a computer and what their intentions are. When it comes to mobile ad fraud detection, data analysis can give some reliable indications. Abnormal metrics can hint at the presence of different types of frauds. To detect click fraud in the ad campaign, advertisers can focus on the following attribution points[22]

  • IP Address: As bots run similar scripts from the same server, any click fraud on mobile ads will indicate a high density of clicks coming from the same IP address or a range of similar IP addresses. Advertisers can also run check on IP addresses to verify their history with another fraud.
  • Click Timestamp: Click timestamp maintains the time at which the click is made on the ad. The bot-based click fraud runs repeatedly to attempt clicking on the ads, which increases click frequency for that duration. A high range of clicks with almost similar timestamp points at the possibility of click fraud. A low duration and high frequency mean a high probability of fraud.
  • Action Timestamp: Action timestamp is the time at which the user takes action on (or engages with) the app or website. With a bot-based click attack, there can be a similarity with action timestamp. As bot clicks on the advertisement and then performs the action on app or website without any delay, the advertiser can notice a low or almost no action timestamp.

Often the best an advertising network can do is to identify which clicks are most likely fraudulent and not charge the account of the advertiser. Even more sophisticated means of detection are used,[23] but none are foolproof.

The Tuzhilin Report[24] produced as part of a click fraud lawsuit settlement, has a detailed and comprehensive discussion of these issues. In particular, it defines "the Fundamental Problem of invalid (fraudulent) clicks":

  • "There is no conceptual definition of invalid clicks that can be operationalized [except for certain obviously clear cases]."
  • "An operational definition cannot be fully disclosed to the general public because of the concerns that unethical users will take advantage of it, which may lead to a massive click fraud. However, if it is not disclosed, advertisers cannot verify or even dispute why they have been charged for certain clicks."

The PPC industry is lobbying for tighter laws on the issue. Many hope to have laws that will cover those not bound by contracts.

A number of companies are developing viable solutions for click fraud identification and are developing intermediary relationships with advertising networks. Such solutions fall into two categories:

  1. Forensic analysis of advertisers' web server log files.
    This analysis of the advertiser's web server data requires an in-depth look at the source and behavior of the traffic. As industry standard log files are used for the analysis, the data is verifiable by advertising networks. The problem with this approach is that it relies on the honesty of the middlemen in identifying fraud.
  2. Third-party corroboration.
    Third parties offer web-based solutions that might involve placement of single-pixel images or Javascript on the advertiser's web pages and suitable tagging of the ads. The visitor may be presented with a cookie. Visitor information is then collected in a third-party data store and made available for download. The better offerings make it easy to highlight suspicious clicks, and they show the reasons for such a conclusion. Since an advertiser's log files can be tampered with, their accompaniment with corroborating data from a third party forms a more convincing body of evidence to present to the advertising network. However, the problem with third-party solutions is that such solutions see only part of the traffic of the entire network. Hence, they can be less likely to identify patterns that span several advertisers. In addition, due to the limited amount of traffic they receive when compared to middlemen, they can be overly or less aggressive when judging traffic to be fraud.

In a 2007 interview in Forbes, Google click fraud czar Shuman Ghosemajumder said that one of the key challenges in click fraud detection by third-parties was access to data beyond clicks, notably, ad impression data.[25]

Click fraud is less likely in cost per action models.

Research

The fact that the middlemen (search engines) have the upper hand in the operational definition of invalid clicks is the reason for the conflict of interest between advertisers and the middlemen, as described above. This is manifested in the Tuzhilin Report[24] as described above. The Tuzhilin report did not publicly define invalid clicks and did not describe the operational definitions in detail. Rather, it gave a high-level picture of the fraud-detection system and argued that the operational definition of the search engine under investigations is "reasonable". One aim of the report was to preserve the privacy of the fraud-detection system in order to maintain its effectiveness. This prompted some researchers to conduct public research on how the middlemen can fight click fraud.[26] Since such research is presumably not tainted by market forces, there is hope that this research can be adopted to assess how rigorous a middleman is in detecting click fraud in future law cases. The fear that this research can expose the internal fraud-detection system of middlemen still applies. An example of such research is that done by Metwally, Agrawal and El Abbadi at UCSB. Other work by Majumdar, Kulkarni, and Ravishankar at UC Riverside proposes protocols for the identification of fraudulent behavior by brokers and other intermediaries in content-delivery networks.

gollark: This does not appear very RANDOM™.
gollark: ++magic py import datetimeawait ctx.send("Today's random number: 4")return None
gollark: Maybe just regular `eval` with strong timeouts enforced and a limited environment with most builtins gone.
gollark: `literal_eval` would be veeeery limiting, no?
gollark: Isn't that a security risk, if it has any commands?

See also

References
  1. Asdemir, Kursad; Yurtseven, Özden; Yahya, Mon. An Economic Model of Click Fraud in Publisher Networks. 2008.
  2. Schonfeld, Erick; The Evolution Of Click Fraud: Massive Chinese Operation DormRing1 Uncovered". TechCrunch. October 8, 2009.
  3. Badhe, Anup (April 2016). "Click Fraud Detection in mobile ads served in programmatic exchanges" (PDF). International Journal of Scientific & Technology Research. 05: 1.
  4. Gandhi, Mona; Jakobsson, Markus; Ratkiewicz, Jacob;Badvertisements: Stealthy Click-Fraud with Unwitting Accessories Archived 2016-03-04 at the Wayback Machine", APWG eFraud conference, 2006
  5. Grow, Bryan; Elgin, Ben; with Herbst, Moira (October 2, 2006). "Click Fraud: The dark side of online advertising". BusinessWeek.
  6. "Botnets strangle Google Adwords campaigns, Keyword Hijacking Risk". The Register. Retrieved 2005-02-04.
  7. V. Anupam; A. Mayer; K. Nissim; B. Pinkas; M. Reiter (1999). "On the Security of Pay-Per-Click and Other Web Advertising Schemes. In Proceedings of the 8th WWW International World Wide Web Conference" (PDF). Unizh.co. pp. 1091–1100. Archived from the original (PDF) on 2017-10-10. Retrieved 2014-03-11.
  8. A. Metwally; D. Agrawal; A. El Abbadi (2005). "Using Association Rules for Fraud Detection in Web Advertising Networks. In Proceedings of the 10th ICDT International Conference on Database Theory" (PDF). pp. 398–412. An extended version appeared in a University of California, Santa Barbara, Department of Computer Science, technical report 2005-23.
  9. "How Wikipedia Lost 3 Billion Organic Search Visits To Google in 2019 | Hacker Noon". hackernoon.com. Retrieved 2020-06-10.
  10. Davis, Wendy; "Google Wins $75,000 in Click Fraud Case" Archived 2009-01-22 at the Wayback Machine. Media Post July 5, 2005.
  11. Ryan, Kevin M. (July 5, 2006). "Big Yahoo Click Fraud Settlemen". iMedia Connection.
  12. Wong, Nicole; "Update Lanes Gifts v. Google". Google Blog, March 8, 2006
  13. Griffin, Joe E. (July 27, 2006). "Lanes v. Google Final Order" (PDF). Googleblog.blogsport.com.
  14. Sullivan, Danny;"Google Agrees To $90 Million Settlement In Class Action Lawsuit Over Click Fraud" Archived 2007-11-22 at the Wayback Machine. March 8, 2006
  15. "Court Docket For: Lane's Gifts and Collectibles, L.L.C. et al. v. Yahoo! Inc., et al". Docket Alarm, Inc. Retrieved 6 August 2013.
  16. Stricchiola, Jessie (July 28, 2004). "Lost Per Click". Search Engine Watch.
  17. "Criminal Docket for: USA v. Bradley, 5:04-cr-20108 (N.D.Cal.)". Docket Alarm, Inc. Retrieved 6 August 2013.
  18. US Department of Justice; "Computer Programmer Arrested for Extortion and Mail Fraud Scheme Targeting Google, Inc." Archived 2006-10-01 at the Wayback Machine. March 18, 2004
  19. Elgin, Ben; "The Vanishing Click Fraud Case". Business Week. December 4, 2006
  20. "Cybercriminal Who Created Global Botnet Infected With Malicious Software Extradited To Face Click Fraud Charges". www.justice.gov. Retrieved 2017-11-21.
  21. "Cybercriminal Convicted of Computer Hacking and Sentenced to Statutory Maximum". www.justice.gov. Retrieved 2017-11-21.
  22. "Click Fraud Prevention – Identify & Reduce Bot Traffic in Your Paid Ads". June 7, 2019
  23. Ghosemajumder, Shuman; "Using data to help prevent fraud". March 18, 2008
  24. Tuzhilin, Alexander; The Lane's Gifts v. Google Report, by Alexander Tuzhilin. July, 2006
  25. Greenberg, Andy; "Counting Clicks". Forbes. September 14, 2007
  26. Jansen, B. J. (2007) Click fraud. IEEE Computer. 40(7), 85-86.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.