Ad fraud explained: bots, click fraud and how to stop it
What ad fraud is, the main types from bots to click farms and install fraud, how ad networks filter it before and after the bid, and what a buyer can check in their own data.
Ad fraud is any deliberate scheme that fakes ad impressions, clicks, installs or conversions so someone gets paid for traffic no real, interested person produced. Bots, click farms, hidden ads and spoofed websites are the usual tools. Click fraud, the version aimed at pay-per-click budgets, is the best-known kind.
What is ad fraud and how does it work
Digital ad fraud works because every ad deal pays someone for a countable event: an impression, a click, an install or a sign-up. A party paid for that event, such as a publisher, app owner, reseller or affiliate, pads the count with activity no buyer is behind.
The advertiser pays twice: for the fake events, and again when bidding rules read the padded placements as winners and send them more budget. Honest publishers lose too, competing on price with sellers whose numbers are invented.
The industry term is invalid traffic (IVT). It also covers innocent noise such as search crawlers, so not every invalid click is a crime, but every fraudulent click is invalid.
Types of ad fraud
Ad fraud comes in six main forms, each with its own footprint in your data.
Bot traffic: GIVT vs SIVT
The Media Rating Council (MRC), the US industry body that accredits ad measurement, splits invalid traffic into two classes. General invalid traffic (GIVT) is what routine filters catch with lists and parameter checks: known datacenter traffic, declared crawlers, non-browser user agents, 0x0 and 1x1 ad sizes. Sophisticated invalid traffic (SIVT) needs advanced analytics or human review to find: emulators, hijacked devices, bots posing as users, invalid proxy traffic, and datacenter traffic that only deeper analysis uncovers.
Cheap bots run from hosting providers and repeat one simple action. In a report they look like clones: one device profile, near-instant sessions, no scrolling. Simple scripts often skip JavaScript, so the tracker logs a click the landing page pixel never sees.
Click fraud and click farms
Click fraud is any click made to drain a pay-per-click budget or inflate a publisher's earnings. Google's definition of invalid clicks includes bot clicks and manual clicks meant to raise an advertiser's costs, such as a competitor clicking your search ads.
A click farm uses paid workers instead of scripts to tap, install and sign up in bulk, so nothing looks automated. The MRC puts organized, directed click-farm activity under SIVT. The giveaway is downstream: sign-ups that never come back or pay.
Hidden and stacked ads
Hidden-ad schemes bill for impressions nobody could have seen. Several ads are stacked in one slot so only the top one is visible, creatives are squeezed into a 1x1 pixel, or malware or a rigged page fires ad calls in the background.
The trace: one placement with high impressions, near-zero viewability and almost no clicks.
Domain spoofing and fake inventory
In domain spoofing, a seller labels cheap or fake inventory as a well-known site or app so it sells at a premium. The bid request says "major news site"; the ad runs elsewhere, or nowhere. App IDs and CTV apps get spoofed too.
The US Justice Department said the Methbot scheme spoofed the domains of thousands of publishers, including major US newspapers. ads.txt was built against exactly this. The tell is a premium domain at a suspiciously low price or at volumes that site cannot have.
Install and attribution fraud
On mobile the payout event is usually an install, so fraud moves there. Click flooding (click spam) sends masses of fake clicks so one gets credit when a real user installs on their own. Click injection, an Android trick, has a malicious app fire a click just before another app finishes installing. Google Play's Install Referrer API reports when an install began, so attribution tools can reject clicks that arrive later. SDK spoofing sends fabricated install and event data to the attribution platform with no device at all.
Traces: odd click-to-install times and installs with no in-app activity; see our in-app advertising guide. The web relative is cookie stuffing, where a hidden frame plants an affiliate cookie to claim a sale nobody referred.
Incentivized and low-intent traffic
Some traffic comes from people rewarded to install, register or fill in a form. The reward is the point, so second visits and deposits tend to be thin. The MRC treats incentivized human activity that is organized and directed as invalid, but excludes disclosed reward programs whose users act on their own, and asks that such activity be reported separately. Paid installs an advertiser did not agree to are on the wrong side of that line, which is why offer rules decide it. Operator-side abuse such as bonus hunting is covered in iGaming affiliate fraud.
What ad fraud costs, and which numbers to trust
Headline loss figures are models. The most-quoted comes from a Juniper Research study published in autumn 2023, produced in collaboration with the ad-fraud protection vendor Fraud Blocker. It estimated that advertisers would lose about $84 billion to ad fraud in 2023, roughly 22% of online ad spend, rising to about $172 billion by 2028. It is a modeled estimate, not an audited count, and the vendor link is a reason for care.
Ask the same of any click fraud statistics: who published them, when, and how fraud was defined.
How ad networks and exchanges fight ad fraud
Ad fraud prevention at a network or exchange runs in two layers: fast checks before the bid, slower analysis after delivery. See our DSP vs SSP explainer for the bid path.
Before the bid
Pre-bid filtering decides in milliseconds whether to answer a request; supply-chain files do much of the work against ad tech fraud:
ads.txt lets a publisher list the companies allowed to sell its inventory.
app-ads.txt does the same for apps, including CTV apps.
sellers.json names the companies behind seller IDs.
The SupplyChain object lists every party that handled a given bid request.
Networks also screen datacenter and known-bot IP ranges, reject user agents that contradict the rest of the request, and block placements with a bad history. These checks fit the MRC's GIVT layer: cheap and fast, but a bot on a residential IP with a clean user agent passes them.
After the bid
Post-bid analysis looks at what traffic did once it arrived: repeat visits, timing patterns, and whether the same device appears across unrelated sessions. Browser and device fingerprints are compared with what the user agent claims. Some networks also use outcomes as a signal: a source that converts poorly across many advertisers may be reviewed or blocked. Advertisers run cohort checks on retention weeks later, one reason many CPA offers hold payouts; each network's terms set the hold length.
Blocking every small anomaly would cut real users too, so networks tune thresholds.
What happens after detection
Detected sources are blocked, and the network may adjust the advertiser's invoice. Refund and credit rules differ by network, so get the written policy before you launch. Who answers for traffic quality also depends on whether you buy from a CPA network or an ad network.
Signals of ad fraud in your own data
Ad fraud shows up first in a click log split by subID; the question is where to look, not which single metric to trust.
In the click log. Dozens of clicks sharing an IP, device ID or user-agent string; clicks that arrive on a metronome; traffic from hosting ranges or countries you did not buy.
In the placement report. One subID or placement whose CTR, cost per action and post-click behavior sit far from the rest of the same offer. Compare sources on the same attribution window first, or the gap may be a setup artifact.
In the lead quality. Sign-ups that never confirm an email, never return and never pay.
Weak signals on their own. High bounce, or high CTR with thin conversions, can just mean a weak landing page or creative. They matter when they arrive with log-level signals such as old browser versions, one screen size or one hosting range.
How a cluster reads (illustrative numbers, not a real account):
| subID | Clicks | Share from one /24 IP range | Leads | Second sessions |
|---|---|---|---|---|
| 1041 | 3,200 | 2% | 38 | 21 |
| 1077 | 2,900 | 40% | 61 | 0 |
Placement 1077 wins on leads, yet 40% of its clicks share one small network block and no lead returned. Either fact alone could be noise; together they justify a pause and a ticket.
How to prevent click fraud and protect a campaign
You cannot remove fraud, but you can limit what you pay for it.
Track at placement level: a subID per placement, raw click logs, postback tracking and consistent UTM parameters.
Start new sources on a small daily budget and scale only after conversions hold up past the first week.
Block early. Exclude placements that trip several log-level signals at once.
Test the path yourself on a real phone, ad to form, so a broken redirect is not mistaken for bots.
Ask your network for its invalid-traffic report, its credit process, and whether its IVT filtering is independently audited.
File disputes with data: dates, subIDs, an IP and user-agent export, and your tracker's conversions.
Third-party ad fraud detection tools and click fraud protection software range from pre-bid filters to post-click verification. Treat them as one more data source, not a guarantee.
Ad fraud on Google and in mobile apps
Google filters invalid clicks out of Google Ads reports and billing automatically. As of October 2026, its help page says advertisers are not charged for those clicks, and that clicks found invalid after billing get a credit on a later invoice "where appropriate and possible".
Facebook and other social platforms set their own rules; check their billing terms before counting on a credit. Mobile adds install and attribution fraud on top of click fraud.
FAQ
What is ad fraud?
Ad fraud is cheating an advertiser into paying for ad activity that no genuine prospect produced. A bot farm clicking banners on a fake site, a network passing off junk inventory as a premium publisher, or an app stealing credit for installs all count. The industry's umbrella term is invalid traffic.
What are the different types of ad fraud?
The main types of ad fraud are bot traffic, click fraud and click farms, hidden or stacked ads, domain spoofing, install and attribution fraud (click flooding, click injection, SDK spoofing) and, depending on offer rules, incentivized traffic. Each leaves different traces in your reports.
Is ad fraud illegal?
Ad fraud is often illegal, although "ad fraud" is not itself a crime on the statute books; charges depend on the scheme. In 2018, federal prosecutors in Brooklyn charged eight people over the Methbot and 3ve schemes with wire fraud, computer intrusion and money laundering counts, and the Methbot operator later got 10 years in prison. Breaking a platform's terms is a separate matter. This is not legal advice.
What are ad bots?
Ad bots are programs that load pages, view ads, click or install apps as if they were people. Simple ones run on datacenter servers and are caught by lists. Sophisticated ones run on infected devices or emulators and mimic people, so detection needs behavioral analysis, not IP lists alone.
Can you get malware from an ad?
Malware can reach you through an ad, though usually by clicking rather than viewing. In a December 2022 alert, the FBI warned that criminals buy search ads that lead to lookalike sites offering malware disguised as real software. That is malvertising, a separate harm from ad fraud: the victim is the user, not the advertiser's budget.
How do you detect click fraud?
Click fraud is detected by a cluster of signals in a click log split by subID: repeated IPs or devices, datacenter or proxy traffic, mismatched countries, odd click timing and leads that never return. One weak metric is not enough. Compare sources on the same attribution window and send the evidence to your network.
Sources
Media Rating Council, Invalid Traffic Detection and Filtration Standards Addendum, June 2020 update
IAB Tech Lab, ads.txt and app-ads.txt
IAB Tech Lab, sellers.json and the SupplyChain object
Google Ads Help, Invalid clicks
Android Developers Blog, Google Play Referrer API: Track and measure your app installs easily
Adjust, glossary entries on click injection, click spam and SDK spoofing
U.S. Attorney's Office, Eastern District of New York, Two international cybercriminal rings dismantled and eight defendants indicted
U.S. Attorney's Office, Eastern District of New York, Russian cybercriminal sentenced to 10 years in prison for digital advertising fraud scheme
FBI Internet Crime Complaint Center, Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users
Juniper Research, ad fraud study (2023), as reported by Search Engine Land and MediaPost
