Question 1

What is invalid traffic in advertising?

Accepted Answer

Invalid traffic (IVT) is any ad impression, click or visit that was not generated by a real person with a genuine chance of seeing the ad. It includes harmless automation such as search-engine crawlers as well as deliberate fraud like bots, hidden ads and spoofed websites. Advertisers should not pay for it, so the industry filters and measures it.

Question 2

What is the difference between GIVT and SIVT?

Accepted Answer

GIVT (general invalid traffic) is non-human traffic that can be caught with simple lists and rules, such as known crawlers, data-center IP addresses and self-declared bots. SIVT (sophisticated invalid traffic) is traffic built to look human, such as hijacked devices, residential-proxy bots, spoofed apps and hidden ads, and it needs advanced analytics to detect.

Question 3

How much money is lost to ad fraud each year?

Accepted Answer

Nobody knows precisely; published estimates range from a few billion to more than $80 billion a year depending on methodology. Juniper Research estimated $84 billion (22% of online ad spend) was lost in 2023, rising to $172 billion by 2028. Earlier ANA and White Ops studies put losses nearer $6 billion. All of these are modelled estimates, not audited totals.

Question 4

How do I know if my ad traffic is fake?

Accepted Answer

Look for numbers that do not behave like people: very high click-through rates with near-zero conversions, sessions lasting a second or two, traffic spikes at odd hours, clusters of identical devices or browsers, and visits from data centers or unexpected countries. The reliable answer comes from an independent IVT measurement or verification tool rather than from the seller's own reports.

Question 5

What is click fraud and how do I stop it?

Accepted Answer

Click fraud is the generation of fake or worthless clicks on pay-per-click ads, by bots, click farms, malware or competitors, so that someone profits or an advertiser's budget is drained. You reduce it by monitoring click patterns, excluding suspicious IP ranges, placements and apps, tightening targeting, using click-fraud detection tools and claiming refunds for invalid clicks.

Question 6

What is ad fraud?

Accepted Answer

Ad fraud is the deliberate faking of advertising activity, such as impressions, clicks, installs, leads or video views, so that someone gets paid for ads no real person saw or acted on. It is carried out with bots, malware, spoofed websites and apps, hidden ads and manipulated attribution, and it drains budgets while corrupting campaign data.

Question 7

What percentage of internet traffic is bots?

Accepted Answer

Roughly half, by some measures. Imperva's 2025 Bad Bot Report found automated traffic made up 51% of all web traffic in 2024, overtaking human traffic for the first time, with "bad bots" alone at 37%. That is all web requests, not ads specifically; the invalid share of measured ad impressions is usually far lower because much of it is filtered.

Question 8

Is ad fraud illegal?

Accepted Answer

Yes, deliberate ad fraud can be prosecuted as a crime. In the United States, operators have been convicted of wire fraud, computer intrusion and money laundering; the Methbot and 3ve ringleader Aleksandr Zhukov was sentenced to ten years in prison in 2021. Many cases are also pursued through civil lawsuits, platform bans and contract clawbacks rather than criminal charges.

Question 9

What is bot traffic in advertising?

Accepted Answer

Bot traffic is ad activity generated by software rather than people: automated programs that load pages, request ads, watch videos, click or install apps. Some bots are benign, like search crawlers, and should simply be excluded from billing. Fraudulent bots are designed to mimic human behavior so that publishers, resellers or fraudsters get paid for fake impressions and clicks.

Question 10

What is a click farm?

Accepted Answer

A click farm is an operation where low-paid workers, or racks of phones controlled by software, click ads, install apps, like posts or fill in forms in bulk to fake engagement. Because real people and real devices are involved, click-farm traffic can pass simple bot filters, which makes it harder to detect than purely automated fraud.

Question 11

What is domain spoofing in advertising?

Accepted Answer

Domain spoofing is when a seller misrepresents where an ad will run, labelling cheap or fraudulent inventory as a well-known premium website so advertisers pay premium prices. The bid request claims to be, say, a major news site, but the ad actually appears on a junk site or to a bot. ads.txt, sellers.json and ads.cert were built largely to stop it.

Question 12

What is SSAI spoofing?

Accepted Answer

SSAI spoofing is a connected-TV fraud where servers pretend to be a server-side ad insertion system requesting ads on behalf of real TVs. Because legitimate SSAI traffic naturally comes from a few server IPs for many viewers, fraudsters imitate it to generate millions of fake CTV ad requests that look like genuine streaming viewers, and collect high CTV prices.

Question 13

What is CTV ad fraud?

Accepted Answer

CTV ad fraud is fake or misrepresented advertising on connected TVs and streaming devices, such as spoofed apps, servers imitating TVs, ads played when the screen is off and bots on infected streaming boxes. It attracts fraudsters because CTV impressions sell at high CPMs and the ecosystem has weaker measurement than web browsers, so fakes are harder to catch.

Question 14

What is mobile ad fraud?

Accepted Answer

Mobile ad fraud is fraud targeting ads inside apps and mobile web, especially app-install campaigns. It includes fake installs from bots, emulators and device farms, and attribution theft such as click injection and click spamming, where fraudsters claim credit and payouts for installs that would have happened anyway. It also covers hidden ads and spoofed apps.

Question 15

What is click injection?

Accepted Answer

Click injection is an Android attribution fraud where a malicious app on the phone detects that another app is being installed and fires a fake ad click in the last seconds before the install finishes. The fraudster then appears to be the last click and collects the advertiser's install payout for a user who arrived organically or through another channel.

Question 16

What is SDK spoofing?

Accepted Answer

SDK spoofing is a mobile fraud in which criminals send fake install and in-app event messages directly to an attribution provider's servers, imitating the measurement SDK inside a real app. No device, app or user is involved; the fraudster simply fabricates convincing data so an advertiser pays for installs and purchases that never happened.

Question 17

What is ad stacking and pixel stuffing?

Accepted Answer

Ad stacking and pixel stuffing are ways of serving ads nobody can see while still charging for them. Ad stacking layers several ads on top of each other in one slot so only the top one is visible but all count as impressions. Pixel stuffing squeezes an ad into a 1x1 pixel or tiny frame, so it technically loads but is invisible.

Question 18

What is a residential proxy in ad fraud?

Accepted Answer

A residential proxy routes traffic through real home internet connections, so a bot running in a data center appears to be an ordinary household visitor. Fraudsters use residential proxy networks to disguise automated ad traffic, defeating simple filters that block data-center IP addresses. The home IPs often come from apps or devices whose owners unknowingly share their connection.

Question 19

What is data center traffic in advertising?

Accepted Answer

Data center traffic is ad activity that comes from IP addresses belonging to cloud providers and hosting companies rather than homes or mobile networks. Real people rarely browse from servers, so ad impressions from data centers are usually automated and are classed as general invalid traffic (GIVT), unless they come from a known legitimate source such as a corporate VPN or server-side ad insertion.

Question 20

What is a headless browser bot?

Accepted Answer

A headless browser bot is automated software that runs a real web browser engine, such as Chrome, without a visible window. It can load pages, run JavaScript, render ads and click like a person would, which makes it far harder to spot than a simple script. Legitimate uses include testing, but fraudsters use it to generate fake ad impressions.

Question 21

What is an acceptable IVT rate?

Accepted Answer

There is no official acceptable IVT rate, but many advertisers expect independently measured invalid traffic in the low single digits of impressions on protected campaigns, and treat sources that are consistently above that as suspect. Rates vary by channel, region and buying method, so compare each source against your own benchmark and against the same vendor's measurement.

Question 22

What is a traffic quality score?

Accepted Answer

A traffic quality score is a single number that summarizes how likely a source of impressions, clicks or visits is to be real, engaged human traffic. Vendors compute it from many signals, such as invalid-traffic flags, device and network checks, and behavior, so buyers and publishers can compare sites, apps and suppliers quickly instead of reading dozens of metrics.

Question 23

How does ad fraud detection work?

Accepted Answer

Ad fraud detection works by checking every ad request, impression or click against layers of signals: known bad lists (crawlers, data-center IPs), device and browser consistency checks, behavioral patterns, and network-wide analysis that spots coordinated activity. Suspicious traffic is either blocked before an ad is bought (pre-bid) or flagged afterwards (post-bid) so it is excluded from billing.

Question 24

What is pre-bid vs post-bid fraud protection?

Accepted Answer

Pre-bid protection evaluates an ad opportunity before the buyer bids and skips it if it looks fraudulent, unsafe or unviewable, so money is never spent. Post-bid protection measures impressions after they are bought, reporting invalid traffic for optimization, blocking the ad from rendering in some cases, and supplying evidence for refunds. Most serious buyers use both.

Question 25

Can I get a refund for ad fraud?

Accepted Answer

Often, yes, if you can prove it and your contract allows it. Many DSPs, exchanges and ad platforms credit impressions or clicks that accredited measurement flags as invalid, and some pass clawbacks back through the supply chain. Refunds are easiest when terms define invalid traffic, name the measurement vendor and set a claim window before the campaign starts.

Question 26

Does Google Ads refund invalid clicks?

Accepted Answer

Yes. Google Ads says it automatically filters many invalid clicks before you are charged, and you can see them in the "invalid clicks" columns. If invalid clicks slip through and Google later identifies them, it issues credits to your account. Advertisers can also request an investigation through Google's invalid click contact form if they suspect fraud.

Question 27

What was Methbot?

Accepted Answer

Methbot was a large video ad fraud operation exposed by White Ops (now HUMAN) in December 2016. It used data-center servers disguised as residential users, together with fake versions of premium publisher websites, to watch video ads automatically. White Ops estimated it earned $3 million to $5 million a day at its peak. Its organizers were later prosecuted in the US.

Question 28

What is malvertising?

Accepted Answer

Malvertising is the use of online ads to deliver malware, scams or forced redirects. Criminals buy ad space or compromise ad creatives so that simply viewing or clicking an ad sends users to phishing pages, fake tech-support scams or malicious downloads. It harms users and publishers even on legitimate, reputable websites, because the bad ad arrives through normal ad channels.

Question 29

What is cloaking in advertising?

Accepted Answer

Cloaking is showing one version of an ad or landing page to reviewers, scanners and platforms, and a different version to real users. Bad actors use it to get scams, malware or banned products approved: moderation systems see a harmless page, while targeted users are sent to phishing sites, fake stores or prohibited offers. Every major ad platform bans it.

Question 30

What is cookie stuffing?

Accepted Answer

Cookie stuffing is an affiliate-marketing fraud where a website or extension secretly drops affiliate tracking cookies on a visitor's browser without them clicking any link. If the person later buys from that retailer on their own, the fraudster's cookie claims the sale, and the retailer pays a commission for a purchase the affiliate did nothing to cause.

Question 31

What is lead generation fraud?

Accepted Answer

Lead generation fraud is the submission of fake or misleading contact forms so that a lead seller gets paid. Bots fill forms with stolen or invented details, click farms submit real-looking entries, or sellers recycle old leads. Businesses paying per lead, such as insurers, lenders, schools and software firms, end up paying for prospects who never intended to buy.

Question 32

Is incentivized traffic fraud?

Accepted Answer

Not necessarily. Incentivized traffic comes from people who are rewarded, with points, game currency or cash, for viewing ads, visiting sites or installing apps. It is legitimate when disclosed and bought knowingly, such as rewarded video in games. It becomes fraud when it is disguised as organic or non-incentivized traffic and sold to advertisers who did not agree to it.

Question 33

What is sourced traffic?

Accepted Answer

Sourced traffic is website traffic that a publisher buys from third parties, such as ad networks, content-recommendation widgets, social ads or traffic vendors, rather than earning it organically. It is not inherently bad, since many publishers promote articles, but cheap sourced traffic is a leading source of bots and low-attention visitors, and it underpins arbitrage and MFA sites.

Question 34

Can competitors click on my ads to waste my budget?

Accepted Answer

Yes, competitor click fraud happens, especially in expensive local search categories such as legal, locksmiths and home repair, where a single click can cost tens of dollars. A rival, or someone they pay, clicks your ads to exhaust your daily budget so your ads stop showing. Platforms filter some of it, and exclusions plus monitoring reduce the rest.

Question 35

What is the MRC IVT standard?

Accepted Answer

The MRC IVT standard is the Media Rating Council's set of guidelines for how measurement companies must detect, filter and report invalid traffic. It defines general invalid traffic (GIVT) and sophisticated invalid traffic (SIVT), sets minimum filtering requirements, and underpins MRC accreditation, which auditors grant to vendors whose IVT detection meets the rules.

Question 36

What is TAG Certified Against Fraud?

Accepted Answer

TAG Certified Against Fraud is a certification from the Trustworthy Accountability Group (TAG) for ad tech companies, publishers, agencies and advertisers that follow a set of anti-fraud practices, including filtering invalid traffic to MRC standards, using ads.txt and sellers.json, and sharing threat data. It signals a company has committed to TAG's fraud-prevention guidelines and audits.

Question 37

What is device fingerprinting in fraud detection?

Accepted Answer

Device fingerprinting in fraud detection is collecting many small technical attributes of a device or browser, such as screen size, fonts, graphics card behavior, time zone and network details, and combining them to recognize the device and check its story is consistent. Bots and spoofed devices often contradict themselves, for example claiming to be an iPhone while behaving like a Linux server.

Question 38

Is AI making ad fraud worse?

Accepted Answer

Yes, generative AI is lowering the cost of ad fraud: it can mass-produce plausible websites and apps, write fake reviews and create bots that browse more like humans. Verification firms such as DoubleVerify have reported sharp rises in new fraud schemes they attribute partly to AI. The same techniques also strengthen detection, so it is an arms race rather than a lost cause.

Question 39

What is the IAB Spiders and Bots List?

Accepted Answer

The IAB/ABC International Spiders and Bots List is a regularly updated list of known crawlers, bots and automated user agents, maintained by the IAB and ABC UK. Ad servers and measurement companies use it to filter known non-human traffic out of impression and click counts. It is a basic general invalid traffic (GIVT) filter referenced in MRC guidelines.

Question 40

What is programmatic advertising?

Accepted Answer

Programmatic advertising is the automated buying and selling of digital ads through software, instead of manual negotiations and insertion orders. Buyers use platforms that decide, impression by impression, which ads to buy and what to pay, often through real-time auctions that finish in a fraction of a second. It covers display, video, CTV, audio, mobile apps and digital billboards.

Straight answers

Invalid traffic & fraud

Programmatic

Supply chain

Business & finance

Privacy & regulation

Data & identity

Measurement

CTV & video

Mobile & app

Retail & commerce

Formats & creative

Search & social

Audio & DOOH

Basics