How Can I Stop Ad Click Fraud Aimed at My Gold Company?

Advertising Click Fraud is Now Rife in the Gold Niche – Here’s How to Combat the Fraudsters

Bullion.Directory’s Ask Ally Service
By Alison Macdonald
Commercial Editor at Bullion.Directory

I’m not going to name the individual or the company, but they have been seeing horrendous levels of click-fraud on their ad accounts at both of the large paid search ad networks and have tried to fix things over the space of several months, to no avail.

They estimate fraudulent clicks to make up 60-90% of all ad spend and to date they have installed a well-known click-fraud software and blocked 100s of IP addresses both in the ad platforms, where unfortunately they are limited to only 500 or 100 IP addresses, and at server level.

They have also blocked the worst of the geo-locations from seeing their ads, from within the ad platforms.

Despite this the fraud is ongoing, conversions on their proven highly optimized landing pages are at a tenth of where they should be and many of the leads they receive contain bad data, non existent phone numbers, or the details of people who swear they have not requested any info and end up angry on any calls.

Not a good state of affairs.

So today I’m going to answer this unnamed executive and aim this response not only at the person who reached out to me, but to all of the gold companies and individual gold affiliates who are being attacked in a similar way.

This is widespread, ongoing, and the feeling is the big ad networks don’t care…

Click Fraud and Gold Companies

As you’re now clearly aware, you’re dealing with a sophisticated form of ad fraud. And I feel for you – I really do as companies we’ve worked with in the past, gold affiliates we know, and indeed our very own ads, have seen everything you describe.

Firstly I need to say it’s probably not an attack specifically on your company but instead is more likely to be an attack on all of the perpetrator’s competition.

Because we work closely with a number of advertisers in the niche we are quickly able to determine if clearly fingerprinted attacks are happening to more than one company at a time. Typically they are.

Not that this helps make up for your lost ad-spend, but at least know that it’s (probably) nothing personal.

There is a silver lining here too albeit a morally ambiguous one.

If your competition is being similarly attacked, then their ad budgets are also being destroyed. If you can keep going while they become increasingly weakened you’ll soon get to enjoy some of the spoils of your attacker’s successes.

Decreased competition helps all who survive.

Next know that while you may stop some of the fraud by following the steps below, you can never stop it all.

Unless that is – you stop running ads – and who’s going to do that?

Yes you may drop from current levels of 60-90% bot clicks, to maybe 10-20%, and whilst you’ll not eliminate bots, it can be a substantial saving in wasted spend, moving from a may as well set fire to piles of money level, to one that’s closer to “the cost of doing business.”

With that out of the way, time to look at the widespread and ever-increasing problem.

So who and what is clicking your ads?

Bots are of course clicking, sometimes actual humans are clicking, and all of this will be at the behest of a malicious competitor, or competitors.

This works for competitors because the simple hard fact is; if you use up your daily ad spend budget, you’ll drop off the platform for the day, resulting in their ads becoming cheaper due to lower competition.

Alternatively if you use up the number of ad views and clicks the platform thinks you should have in any given time-frame, the more actual humans will see and click the ads of your competitor.

In some cases if these attacks are an ongoing onslaught as you’ve described, the attacked company might just up and quit the platform, leaving the bot-masters one competitor down, which for them is a win-win.

I know several advertisers who have abandoned PPC Ads at both of the big players due to this problem.

What ARE these bots?

Many are simple bots, (and in some cases even simpler humans) clicking your ads. If you’re lucky many can be super-easy to spot – unless you’re a supposed expert at a large ads network!

IP address patterns can soon become very obvious with even the most cursory glance. You may be attacked at the exact same time every day, or you may be attacked on the exact same group of keywords.

All of which is easy to fix by blocking IPs, changing ad schedule or editing your keywords.

You soon become very good at spotting what at least appears to be real traffic and what is obviously malicious.

You will find perpetrators of what will be the easiest fixes do change their methods a little from time to time, but mostly they’re pretty lazy.

The professional attackers, on the other hand, are using advanced bots which can be near-impossible to detect using standard methods. The worst of these, and most commonly used advanced bot is Google’s very own Puppeteer.

What’s this you ask? A company who benefits financially from click fraud AND who creates the same bot used to generate that very click fraud are one and the same?

Say it ain’t so.

Sadly Google’s Puppeteer Extra, when combined with a Stealth plugin is a very popular combination for those looking to automate browsing activities and to click competitor ads without being detected by any average bot detection systems.

Puppeteer Extra is a version of Puppeteer, a Node library which provides a high-level API to control Chrome or Chromium over the DevTools Protocol. Puppeteer Extra adds plugins that enhance its capabilities, making it more powerful for web scraping, testing, and automation.

If this sounds complex and technical, it is. Or at least the underlying tech is – the bot however, is frighteningly easy to control.

The Stealth Plugin causing this hard-to-detect mayhem is specifically designed to evade detection techniques used by many websites to identify and block bots.

It modifies various aspects of the browser’s fingerprint to appear as a normal user, including User-agent strings, WebGL and Canvas behavior to prevent fingerprinting, and has a number of evasive techniques for known bot-detection scripts.

Domestic Proxies are then used to allow the automated scripts to operate through IP addresses that appear to be regular household IPs, making them less likely to be blacklisted or identified as bots.

Puppeteer Extra

Puppeteer Extra is an extension of Puppeteer, which is itself a Node.js library developed by Google.

It provides a high-level API to control headless Chrome or full Chrome/Chromium. “Headless” refers to running a browser without a graphical user interface, making it perfect for automated tasks over the web.

Key Features and Enhancements:

• Plugins: Puppeteer Extra enhances the basic Puppeteer with a plugin ecosystem. These plugins can add new functionalities or modify existing behaviors of the browser being controlled. This makes it more versatile for specific tasks like web scraping, automated testing, and bulk data collection.
• Flexibility: Users can create custom plugins or use existing ones from the community, tailoring the browser’s capabilities to their specific needs.

The usability of Puppeteer is consistently improving.

For instance, Google has recently added significant enhancements, such as Firefox compatibility. In a recent update to Chrome, Google launched a built-in feature for recording Puppeteer scripts.

This advancement greatly eases the process of script creation, eliminating the need for extensive JavaScript knowledge to manage a headless browser.

Stealth Plugin

The Stealth Plugin is one of the most popular plugins for Puppeteer Extra.

Its main purpose is to make the automated browser sessions look more like those of a real human user, thereby avoiding detection as a bot. This is where things become frankly evil.

Key Modifications This Combo Uses to Evade Detection:

• User-Agent Strings: The plugin can modify the browser’s user-agent string, which is a label that tells a website what type of device and browser is being used. By rotating or randomizing user-agent strings, the plugin avoids patterns that can be flagged as bot-like.
• WebGL and Canvas Behavior: These technologies can be used by websites to create a unique fingerprint of a visitor’s device. The Stealth Plugin can interfere with how these APIs are accessed or respond, making the fingerprint look more typical of a broad range of users.
• Evasion Techniques: It implements specific code that can detect and block common JavaScript tests used by websites to identify automation tools. For example, it can obscure the fact that the browser is being controlled by automation, a detection method employed by some advanced bot detection systems.

Again if this sounds technical, all it means is basically the bot will seem exactly like a real human user to almost every detection system.

Domestic Proxies

Domestic proxies are IP addresses that appear to be regular user IPs typically from residential ISPs, rather than data centers or cloud hosting providers, which are commonly associated with automated traffic and bots.

How They Help in Ad Fraud:

• Appearance of Legitimacy: By using an IP address that looks like it belongs to a regular home internet connection, bots can bypass one of the simplest forms of bot detection—IP blacklisting.
• Geographic Distribution: These proxies can also distribute the requests across various geographic locations, making the traffic appear as if it is coming from different genuine users spread across the country or even globally.
• Rotation: With access to a large pool of domestic proxies, Puppeteer Extra can switch IPs continuously, thwarting detection methods that rely on flagging repetitive activity from a single IP. It also renders manually blocking IP addresses pointless.

Using Puppeteer Extra with the Stealth plugin and domestic proxies creates a potent combination for committing ad fraud because it addresses multiple layers of detection—browser behavior, browser fingerprint, and IP reputation.

Understanding these components reveals the sophistication involved in mimicking genuine user behavior and lets you know exactly what you’re up against – and why the methods you’ve been using so far have had limited success.

Fight Back With Advanced Behavioral Analysis

Behavioral analysis in the context of ad fraud involves monitoring and analyzing the way users interact with your website and ads. The goal is to distinguish between human and bot behavior based on interaction patterns and anomalies.

Why It’s Effective:
Bots, even some of the more sophisticated ones designed to mimic human behavior, often exhibit distinct patterns that can be detected through careful analysis.

These may include:

• Speed of interactions: Bots typically navigate websites much faster than humans – although they are now learning to randomize and delay interactions.
• Click patterns: Bots can repeatedly click on ads in a manner that’s not typical for human users, or click hidden elements on your site that regular users don’t (I’ll get to this)
• Navigation paths: Bots can often follow predictable and linear paths through a site, unlike humans who exhibit more random and exploratory behavior – but again, the latest bots are appearing increasingly human


How to Implement Behavioral Analysis:

• Collect Data: Start by implementing tracking on your website that collects data on user interactions. This should include clicks, mouse movements, scroll behavior, keyboard input, and page navigation times. Screen recorders are good at this – and Microsoft have a fairly decent free one called Clarity. Recordings of clearly fake visitor behavior will be useful when reclaiming fraudulent spend.
• Define Normal Behavior: Analyze the collected data to establish what typical human behavior looks like on your site. This involves statistical analysis to determine average session times, typical navigation paths, and common interaction patterns with ads. Humans still move their cursor in ways most bots don’t.
• Identify Anomalies: Once you have a baseline for normal behavior, you can start identifying anomalies. These are interaction patterns that deviate significantly from the norm. For instance, very short session times with a high volume of ad clicks would be considered suspicious. Perfectly straight mouse paths another.
• Machine Learning Models: To scale up and automate anomaly detection, you can use machine learning models. These models can learn from the data on what constitutes normal and suspicious behavior and can flag sessions that seem to be driven by bots.
• Continuously Update Models: As both human and bot behaviors evolve, it’s crucial to keep updating your models with new data. This ensures that your detection mechanisms adapt to new tactics used by fraudsters.
• Integration with Fraud Prevention: Once a session is flagged as suspicious, you can take various preventive actions. This will include feeding the data back to your ad network provider for further investigation – although you’ll soon become outraged at what these networks claim to consider normal behavior…

 

Benefits of Advanced Behavioral Analysis

• Ad Spend Efficiency: By reducing the number of fraudulent clicks, you can help ensure more of your budget is spent on reaching genuine potential customers.
• Improved Data Quality: Cleaner interaction data leads to better insights and decision-making for marketing strategies.
• Enhanced User Experience: By targeting only genuine users, the overall user experience on your site improves, potentially leading to better conversion rates and customer satisfaction. Screen recording sessions and heat maps can reveal surprising issues with your pages and can ultimately lead to better layout design and UX decisions.

Implementing advanced behavioral analysis properly is complex and will require the integration of third-party tools or the development of in-house capabilities, especially if using machine learning.

Depending on your resources and expertise, you may be best to consider working with external vendors who specialize in web analytics and fraud detection. After all your time may be more valuably spent doing what you’re actually good at.

Integrating advanced fraud detection solutions that employ machine learning can be a pivotal strategy in combating sophisticated ad fraud, like those executed using Puppeteer Extra with the Stealth plugin and domestic proxies.

Do be aware however that detecting the fraud may not necessarily result in refunds.

Many times we have submitted compelling evidence to the big two CPC search ad networks, who after “examining the data” have concluded that these clicks and visits fall within “normal parameters.”

We’ve seen outrageously obvious footprints like grouped IP addresses, duplicate behavioral patterns during visits, visitors clicking on invisible (to humans) ‘honeytrap’ links and more – all dismissed as perfectly normal.

Should those allegedly tasked with helping root out clickfraud be the very same people tasked with increasing click numbers and ad revenue? Exactly.

 

Advanced Fraud Detection Solutions

Machine learning (ML) is at the heart of the best advanced fraud detection technologies. These systems use large datasets of both legitimate and fraudulent activities to learn and identify patterns that may indicate fraud.



Here’s how they typically function:

• Data Collection: ML models are trained on vast amounts of data, including click patterns, IP addresses, device information, browsing behavior, and historical fraud data. Over thousands of users and millions of IP addresses, they have an excellent track record in weeding out fraud.
• Pattern Recognition: The models soon learn to recognize complex patterns and anomalies that suggest fraudulent activity. This can include recognizing bots that mimic human behavior but still exhibit subtle inconsistencies.
• Real-Time Analysis: Unlike simpler rule-based systems, ML models can analyze data in real-time, providing immediate assessments of traffic to identify and block fraudulent activity as it happens.
• Adaptive Learning: These systems continually learn and adapt, using AI to improve their accuracy and effectiveness as they are exposed to new data and tactics used by fraudsters.

 

Notable Companies and Their Technologies

1. Polygraph
We ourselves use Polygraph and they have been always been excellent especially in comparison to the more well known ‘solutions’ which in our experience offer little more than snake oil.
 

• Focus: Provides advanced click fraud detection and prevention for online advertisers, focusing on protecting ad budgets and ensuring high-quality traffic.
• Technology: Utilizes in-depth investigations of click fraud operations to identify and block fraudulent clicks, offering detailed reports on each fake click to aid in securing refunds from ad networks.
• Application: Polygraph supports all ad networks and PPC ad formats, offering tools to detect, prevent, and get refunds for click fraud, as well as blocking spam leads to improve traffic quality.

 

2. HUMAN (formerly White Ops)

• Focus: Specializes in detecting and preventing sophisticated bot attacks and fraud across advertising, marketing, and cybersecurity.
• Technology: Uses a multilayered detection methodology that includes behavioral analysis, machine learning, and continuous adaptation to new threats.
• Application: Their solutions are used to verify the humanity of more than 10 trillion online interactions every week, helping clients distinguish between human and machine-driven traffic.

 

3. Pixalate

• Focus: Offers real-time fraud protection for advertising and marketing industries, with a strong emphasis on compliance and data privacy.
• Technology: Uses machine learning to analyze ad traffic across devices, including desktop, mobile, and connected TV, to uncover fraudulent patterns.
• Application: Pixalate provides granular data on traffic quality and helps maintain compliance with advertising standards and regulations.

 

Benefits of Using Advanced Solutions

These platforms are not the cheapest available but their results will more than pay for themselves, especially in a high-competition and high-risk vertical like Gold IRAs.
 

• Enhanced Detection: These solutions detect fraud more effectively than traditional methods by analyzing far more complex data patterns and adapting to new fraud tactics.
• Cost Efficiency: By reducing the amount of money wasted on fraudulent clicks, companies can help ensure more efficient use of their advertising budgets.
• Scalability: Machine learning solutions can handle large volumes of data and traffic, making them suitable for high value ventures, medium-sized businesses and large enterprises.
• Improved Reporting: These technologies typically provide detailed insights and reporting capabilities, allowing businesses to understand and optimize their advertising strategies better.

Depending on the existing digital infrastructure, integrating these solutions might require significant setup and customization.

Advanced solutions are going to be more costly than simpler tools like Clickcease, so it’s essential to consider the ROI in terms of saved ad spend and improved campaign performance.

In markets like Gold, the cost of individual clicks will usually make the more advanced solutions cost effective, especially for companies or individual affiliates with high monthly spend.

Do remember these are not set and forget tools. It’s beneficial to work closely with these companies to ensure their solutions are tailored to your specific needs and challenges in ad fraud.

 

Stopping the Bots

Outside of using advanced tools stopping equally advanced bots, what other techniques are available to companies suffering clickfraud?

I’m now going to look in more detail at the options that are available, in ascending complexity.

The first tier is using interactive tasks.

Challenging suspected bots by implementing interactive tasks that are straightforward for humans but difficult for automated systems is can be a smart approach to reduce fraudulent activities.

I say ‘can be’ because other than honeypots, these methods do add ‘friction’ to your sales funnel and WILL impact conversion rates.

 

Traditional and Invisible CAPTCHAs

We all know how traditional CAPTCHAs work – we tick a box promising we’re not a bot, or we select bridges, cars or traffic lights. I find that by my living and working in the UAE they are a constant aggravation when visiting almost ANY site.

Annoying your visitors is never an ideal start, and even worse news is that even relatively basic bots can now bypass these with ease.

Unlike traditional CAPTCHAs that require users to solve visual puzzles, Invisible CAPTCHA works in the background to determine whether a user is a human without any user interaction.

It typically uses a combination of behavioral signals (like mouse movements and typing patterns) and machine learning to assess the likelihood of a user being a bot. It only prompts a CAPTCHA challenge (like identifying traffic lights in an image) if it detects suspicious behavior.

The advertised benefit is it “provides a seamless user experience for most legitimate users, as they are not burdened with tasks to prove their humanity.”

However, this site uses an invisible CAPTCHA on our contact form, and I can assure you we get at least 10 spam mails bypassing it every single day – so it’s safe to say these no longer work.

 

Honeypots

Honeypots are typically hidden form fields on web pages that are invisible to human users but will be seen by bots visiting a site.

When creating forms on your website (like signup or contact forms), you include an additional text field that is hidden from users by using CSS. Bots scanning through the form will likely fill out every field, including the hidden one.

Any form submission containing data in the honeypot field can be flagged as originating from a bot.

These are extremely easy to implement and do not affect the user experience for human visitors. Although not perfect, it can act as a first line of defense against less sophisticated bots.

Another honeypot, is the honeypot link.

This will be a link on your page that is hidden to humans. The period I’ve just used after humans, is an example. If I hadn’t told you, you’d have no idea it was a link – and so with even basic tracking software, you can easily see the IP addresses of ‘people’ who have clicked the link.

If ‘someone’ clicks your ad and then clicks that honeypot link, you will know 100% that they are a bot.

Of course as I mentioned elsewhere, the ad companies who receive money from these fake clicks will invariably claim it’s perfectly normal for humans to click invisible links, which is a clear nonsense.

 

Behavioral Challenges

A little like a CAPTCHA, these are challenges that require interactions indicative of human behavior, such as dragging a slider, adjusting a setting, or performing randomized tasks that vary from visit to visit.

You might prompt users to perform a task that involves more nuanced interactions, such as adjusting a slider to a specific value or rearranging items in a logical order. The key is that these tasks require a level of decision-making or fine motor skills that current bots struggle to mimic accurately.

These DO work, but again you need to balance the cost of clickfraud and bad leads against the cost of antagonizing potential genuine leads.

I recommend any company taking these steps to regularly test them to ensure they are effectively blocking bots and not impeding the experience of legitimate users.

You can collect feedback from users about their experiences with these challenges to fine-tune their complexity and intrusiveness – but I assure you, overall conversion rates WILL decrease. It’s up to you to assess if this added friction is worth the improvement in bot reduction

 

Session Fingerprinting

Session fingerprinting involves collecting and analyzing specific data points from a user’s session to create a unique identifier or “fingerprint” that distinguishes that user from others.

This fingerprint can be used to detect and prevent fraudulent activities by recognizing patterns that deviate from typical human behavior.

Key Components of Session Fingerprinting are:

User Agent

• Description: The user agent string is a line of text that a browser sends to a website that identifies the browser, its version, and the operating system.
• Use in Fingerprinting: By analyzing the user agent, systems can detect inconsistencies (e.g., a desktop user agent on a session with mobile-like navigation patterns) or outdated, uncommon, or spoofed user agents that might indicate a bot.

 
IP Address Patterns:

• Description: The IP address identifies the network that the user is connected from, which can provide geographical and network-related information.
• Use in Fingerprinting: Monitoring IP addresses helps in recognizing if a user frequently changes locations implausibly (e.g., different countries within short periods) or constantly uses IP ranges known for hosting proxy servers and VPN services. Tracking how an IP interacts across sessions can also help identify networks commonly used by fraudsters.

 
Timing Information Between Requests:

• Description: This refers to the timing and frequency of user actions on the website, such as how quickly pages are loaded or requests are made.
• Use in Fingerprinting: Automated scripts or bots often have superhuman speed or unnaturally consistent timing between actions. Analyzing the timing can help differentiate between human and non-human traffic. Timing patterns can also reveal scripted behaviors, such as periodic automated clicks.

 
IP addresses, IP patterns and timing info can actually be a very good smoking gun to identify attackers.

Last year I was involved in trying to identify a highly active click-fraudster attacking Bullion.Directory and ads we were running for clients over a space of several months.

There were some very clear IP patterns, combined with identical post-click activity and timing, so we very quickly realized these attacks were all coming from a single source.

I won’t go into specifics but we tracked and identified ALL IP addresses looking for cracks, and every now and then it was clear the attacker was using their own un-masked IP address (rather than VPN proxies.)

Looking up detailed information on this IP address revealed it was at the headquarters of a very well known Gold IRA company.

We were able to share this information with our clients and of course this also changed our perception of the company at the heart of the fraud.

 

Advanced Techniques in Session Fingerprinting

The following methods are significantly more complex than the skill level of most gold company CEOs, so will require the need to bring in some experts.
 
Canvas Fingerprinting:

• Description: This method uses the HTML5 canvas element to draw graphics and text to see how they are rendered differently by different browsers and devices, creating a unique signature.
• Application: It’s harder for bots to mimic specific graphic rendering properties of legitimate browsers, providing a robust dimension to the fingerprint.

 
Behavioral Biometrics:

• Description: This involves analyzing patterns in mouse movements, keystroke dynamics, and interaction with the website’s interface.
• Application: Behavioral biometrics are very effective at distinguishing humans from bots, as they can identify natural human interaction with the complexity and randomness it involves.

 
Network Level Analysis:

• Description: Looking at how requests are made to the server, including the use of session cookies, TCP/IP stack configuration, and other network-level signals.
• Application: Certain network behaviors and configurations are more common in bots, such as the lack of a typical browser’s TCP window size or the absence of usual session cookies.

 

Implementing Session Fingerprinting

Key to session fingerprinting is to implement mechanisms on your web server or through client-side scripting to collect necessary data points from user sessions.

You will use or develop analysis tools that can process and interpret the collected data to create and maintain user session fingerprints – and must regularly update and refine the fingerprinting techniques to keep up with evolving bot tactics and new browser technologies.

It’s important to consider privacy. Ensure compliance with data protection laws like GDPR or CCPA when implementing fingerprinting techniques.

Now while it can be complex, developing a sophisticated session fingerprinting system will mean you can significantly enhance your ability to detect and prevent fraudulent activities, protect your resources and provide a better environment for genuine users.

 

Proactive Monitoring – Setting Up Alert Systems

Setting up alerting systems for monitoring ad traffic in real-time is crucial for detecting and responding to potential ad fraud efficiently.

I’m going to give a brief overview of how to set up such systems, including examples and practical steps to implement them, especially focusing on environments like cPanel.

Alerting systems in the context of ad traffic monitoring are designed to notify you of any abnormal activities that could indicate fraud, such as sudden spikes in traffic or unusually high click rates from specific IP addresses or ranges.

 

Key Components of an Alerting System

Traffic Monitoring: Continuous observation of the volume and quality of traffic coming to your ads or landing pages.

Anomaly Detection: Algorithms that identify patterns deviating from normal traffic behavior.

Alert Mechanisms: Notifications sent via email, SMS, or other communication channels to inform you of potential issues.

 

Implementing Alerting Systems in cPanel

While cPanel itself does not directly support complex ad traffic monitoring (since it’s primarily a web hosting management tool), you can use associated tools and scripts within a cPanel environment to set up effective monitoring.

Here’s how to go about it:

Log Analysis with cPanel

• Description: Use cPanel’s built-in log file access (e.g., Raw Access Logs, Error Logs) to track and review requests made to your websites.
• Implementation: Access these logs via the cPanel dashboard. Use scripts to regularly parse these logs and extract meaningful data regarding IP addresses, request times, and page access patterns.

 
Integration with External Monitoring Tools

• Description: Since cPanel itself is limited in direct ad monitoring capabilities, integrating external tools like Google Analytics or specialized ad monitoring software can provide deeper insights.
• Implementation: Use the metrics from these tools to feed data into your cPanel-hosted site via APIs or direct data feeds. Set up scripts on your server to handle this data and trigger alerts.

 
Setting Up Alerts

• Using cPanel Cron Jobs: Set up cron jobs in cPanel to execute scripts at regular intervals that analyze the latest traffic data. Do note that setting up cron jobs is not something for non-experts!
• Example: A PHP or Python script that checks for traffic anomalies and sends an email if unusual patterns are detected.
• How to Set Up: Go to the “Cron Jobs” section in cPanel, specify the command for your script, and set the frequency of execution.
• Email Notifications: Configure these scripts to send alerts via email when they detect potential fraud activities.
• Example: Use the mail() function in PHP within your script to send an email alert detailing the suspicious activity.

 
Examples of Alert Conditions

• Sudden Traffic Spike: An alert if traffic exceeds 2x the average hourly visits within the last 7 days.
• High Click Rates from Specific IPs: An alert if more than a threshold number of clicks come from the same IP range within a short period.

 

Regularly review the effectiveness of your alerting parameters and scripts. Adjust them based on new patterns of fraud or changes in traffic behavior.

If cron jobs are that nerd-step too far, tools like Cloudflare or Sucuri can be integrated with your site running on cPanel to provide enhanced security features and better anomaly detection.

Either way, understanding the typical traffic patterns for your website will help you set more accurate thresholds and conditions for alerts.

 

Collaborating with Ad Networks

When dealing with ad fraud, collaborating with ad networks is essential, although it can be challenging when the networks themselves benefit financially from not addressing fraudulent clicks thoroughly, and their systems are less than transparent.

As I’ve already covered, ad networks profit from increased clicks, fraudulent or not.

This financial incentive can lead to a distinct lack of vigorous action against fraud, as reducing fraud could mean reducing their revenue.

This becomes all the more clear when one learns both major search networks have substantially reduced their click-fraud detection teams in the past few years.

Saying this, ad networks are generally aware of the reputational risk and long-term business risks if ad fraud is rampant on their platform.

Consistent communication and pressure from advertisers can push networks towards more proactive anti-fraud measures.

 

Strategies for Effective Collaboration

• Maintain an open line of communication with your account managers at the ad network. Regular updates about the fraud you’re detecting not only keeps the issue on their radar but also helps them understand the specific challenges you’re facing.
• Share detailed reports and evidence of suspected fraudulent activities. Highlight patterns and provide data that may help their internal teams improve fraud detection.
• Ad networks often have internal tools and resources dedicated to monitoring and preventing fraud, though they might not always be fully utilized without advertiser prompting.
• Ask the network to apply these tools specifically to your campaigns. Request detailed audits and reports on clicks and impressions to review any suspicious activities.
• Engage in periodic reviews of your campaign performance and associated fraud metrics with the ad network. These reviews can help both parties identify trends in fraud and evaluate the effectiveness of current mitigation strategies.
• Transparency in how traffic is verified and how fraud is detected is crucial to trust and effective collaboration.
• Request detailed explanations of the network’s fraud detection processes and the specific metrics they monitor. Ask for access to raw data if possible, to perform your own analysis.
• As a paying customer, you can in theory exert pressure on networks to implement stricter policies and better fraud detection techniques.
• Utilize contractual agreements to enforce certain levels of traffic quality.
• Check clauses in your contracts that stipulate penalties for high levels of fraudulent traffic or that allow for refunds/credits when fraud thresholds are exceeded. (Do note, some ad networks have recently added clauses denying all responsibility for clickfraud, so you may be on an uphill struggle here)

Developing a strong working relationship with your ad network can lead to more honest conversations about fraud and more willingness on their part to tackle the problem.

Or if you go ‘full-Karen’ on a hapless agent you may get dropped from the platform. It can be a fine line!

Basically when you start being considered a difficult customer, it’s important you don’t put all your advertising spend in one basket…

 

Legal Action



Taking legal action against perpetrators of ad fraud can be a crucial step, especially when significant financial losses are involved and the parties responsible for the fraudulent activities can be identified.

In some cases letting the company know that you know may suffice. This is what happened in the case we investigated, although I understand legal action is still being considered by one of our clients.

 

When to Consider Legal Action

Legal action typically becomes a viable option when the financial impact of the fraud is significant enough to justify the costs of legal proceedings.

This often includes not only direct losses from the fraud but also potential long-term damage to business operations.

In the gold niche, costs do rapidly mount and spending 5 or 6 figures a month on fraudulent clicks would be considered by most to be a significant financial impact!

The feasibility of legal recourse heavily depends on the ability to identify and locate the individuals or entities behind the fraudulent activities. This often requires in-depth investigations and in the example I gave earlier involves substantial digital forensics work.

Collecting comprehensive evidence is crucial for any legal case.

In the context of ad fraud, this includes logs of fraudulent activities, IP addresses, patterns of behavior, and any correspondences that might hint at malicious intent.

Use internal data analytics tools, collaborate with cybersecurity experts to trace and document fraudulent activities, and ensure that all evidence is collected in a manner that is admissible in court.

Cybersecurity experts can play a crucial role in tracing the origin of the fraud, identifying the perpetrators, and providing expert testimony about the nature of the fraud.

This is why I recommend hiring or consulting with experts who have a proven track record in digital forensics. They can help translate complex digital evidence into clear, understandable terms for legal proceedings.

 

Considerations Before Taking Legal Action

Legal action can be expensive and time-consuming. Weigh the potential benefits against the costs and the impact on your business operations.

Consider how legal action might affect your company’s public image. In some cases, it may deter future fraud, but it could also draw public attention to security vulnerabilities in your business.

If customers are trusting you with hundreds of thousands of dollars in their retirement account, is any vulnerability a good look?

Taking legal action requires careful planning and consideration, but it can be an effective tool to recover losses and deter future ad fraud when other methods fail.

Conclusion: The Future of Combatting Click Fraud


While the battle against click fraud is undeniably daunting, there are promising strategies and technologies on the horizon that offer hope.

Cutting-edge AI and machine learning algorithms can detect patterns and anomalies in real-time, providing an additional layer of defense against fraudulent clicks. Investing in these technologies can help you stay one step ahead of fraudsters.

Blockchain’s transparent and immutable ledger system, is already being leveraged to verify the authenticity of ad clicks. This technology can ensure that each click is legitimate, reducing the risk of fraud and as the technology becomes more commonplace will certainly help in the fight.

Joining forces with industry peers and participating in anti-fraud coalitions can amplify your efforts. Collective intelligence and shared resources can lead to more effective detection and prevention methods. This is how we caught one company engaged in massive fraud against it’s competitors.

Going forward, ensure that your marketing and IT teams are well-informed about the latest fraud tactics and prevention techniques. Regular training sessions can keep everyone vigilant and prepared.

By using the solutions available and staying informed you can protect your ad investments and ensure your marketing efforts yield genuine results. The fight against click fraud is ongoing, but with the right tools and strategies, you can begin to turn the tide in your favor.

Alison Macdonald

Ask Ally, is your direct line to gold investment wisdom. Alison “Ally” Macdonald, with her extensive experience and sharp tongue, cuts through clutter to offer honest, insider takes on your gold investment questions.

Need insights or industry secrets? Ally’s ready to deliver, combining professional expertise with a smattering of Glasgow patter. Get ready for straightforward, expert guidance from a one-time gold shill turned good guy. Ask Ally Today

The responses provided by ‘Ask Ally’ are strictly for informational purposes only and should not be construed as financial or investment advice. Alison Macdonald’s insights and opinions are based on her personal experience and knowledge of the gold industry and should not be taken as professional financial guidance. Before making any investment decisions, we strongly recommend consulting with a qualified financial advisor. Bullion.Directory and Alison Macdonald are not liable for any financial actions taken based on the information provided in this service.


On June 24, 2024   /   Ask Ally, Precious Metals Articles   /   Leave a comment

 Previous Post
Why Can't I Buy Gold at Spot Price?