Lesson 7 of 8 · 10 min read · intermediate
How fraud gets caught
Pre-bid vs post-bid, the signals detectors read, honeypots, sample vs census measurement and threat intelligence: how invalid traffic is actually found.
Fraud detection is an arms race with a simple scoreboard: can you tell a real person from a fake one before, or at least soon after, money changes hands? No single test does it. Detection works by layering many imperfect checks at different moments in an ad's life, and by people who study fraud operations the way police study organised crime.
Think of a bank catching card fraud. Some transactions are declined instantly because the card is on a stolen list. Others go through but get flagged hours later because the pattern is odd (a coffee in Mumbai and a TV in London ten minutes apart). And sometimes investigators spend months mapping a whole gang. Ad fraud detection has exactly these three layers.
How invalid traffic gets caught
Every impression starts as a visit from a device. Some are people; some are crawlers, scripts or hijacked phones pretending to be people.
- A visit arrives: Every impression starts as a visit from a device. Some are people; some are crawlers, scripts or hijacked phones pretending to be people.
- Layer 1: known lists: The easy catches: declared crawlers on the IAB/ABC Spiders & Bots List, known data-center IP ranges, non-browser user agents. The MRC calls this GIVT.
- Layer 2: device and network signals: Next, deeper checks: does the device claim to be an iPhone but behave like a Linux server? Is it a headless browser or a residential proxy? Inconsistencies are red flags.
- Layer 3: behaviour: Bots can fake a fingerprint, but it is hard to fake human behaviour at scale: timing, scrolling, click-to-install gaps, impossible volumes. Behavioural analysis catches SIVT.
- One score to act on: Signals are combined into a score buyers can act on in real time. ClearTrust’s TQI Score™, for example, rolls 150+ filters into a single number.
- Pre-bid: don’t buy it: With pre-bid filtering, bad traffic is never bought. Clean requests go through to the auction.
- Post-bid: prove it and claw it back: Post-bid measurement audits what was bought. Invalid impressions are reported, excluded from billing and, where contracts allow, refunded.
Before the bid vs after the ad
Pre-bid filtering
- Runs on the bid request, in milliseconds, before any money is spent
- Uses lists and reputation: IPs, devices, apps, domains, sellers
- Great for GIVT and known-bad sources
- Blind to how the ad actually renders
- Prevents waste instead of refunding it
Post-bid measurement
- Runs when the ad renders and afterwards, via tags or SDKs
- Reads the live environment and behaviour over time
- Needed for most SIVT
- Money is already spent; enables blocking, reporting and refunds
- Feeds new bad sources back into pre-bid lists
Pre-bid filtering is offered inside DSPs, often powered by verification vendors' data, and by SSPs screening their own supply. Post-bid measurement uses a tag that runs with the ad (on the web) or the Open Measurement SDK (in apps). A post-bid tag can also block, swapping the ad for a blank if the environment looks invalid; the share of impressions blocked is reported as a block rate. The best programmes use both and connect them, so everything learned after the bid improves what is rejected before it.
The signals detectors read
| Signal family | Examples | What it reveals |
|---|---|---|
| Network | IP reputation, data-center and proxy ranges, ASN, IP-to-device ratios | Where traffic really comes from |
| Device and browser | Fingerprints, user agent, screen, fonts, graphics, sensors, automation traces | Whether the device is what it claims and whether it is automated |
| Behaviour | Scrolls, dwell time, click timing, session paths, time-of-day patterns | Whether activity looks like a messy human or a tidy machine |
| Supply chain | ads.txt, sellers.json, schain, declared vs observed domain or app | Whether the inventory is what the seller said |
| Population and time | Sudden traffic spikes, identical clusters, impossible ratios | Coordinated schemes invisible at the single-impression level |
Individually, most signals are weak. A VPN user and a proxied bot share an IP pattern. A power user and a bot both click fast. What catches SIVT is corroboration: many weak signals pointing the same way, across millions of events. That is what the MRC means by multi-point corroboration. Machine-learning models and anomaly detection do the heavy lifting, while human analysts investigate clusters the models surface.
Honeypots and threat intelligence
A honeypot is a trap: a page, app, ad slot or cookie set up so that no real person would ever interact with it. Anything that does is automatically suspect, and its fingerprint can be studied. Researchers also run infected machines in controlled labs, reverse-engineer malware, and follow the money through ad accounts and shell companies. HUMAN's Satori team, Google, DoubleVerify's Fraud Lab and others have disclosed most of the big schemes this way, often in coordination with platforms and law enforcement, because disrupting a scheme's infrastructure or cash-out stops it everywhere at once.
Sample vs census measurement
A census approach measures every impression. A sample approach measures a subset and projects the result. Sampling is cheaper, but fraud is clustered, so a small sample can miss a concentrated scheme or misjudge a small publisher. MRC standards expect measurers to disclose their methods, and for blocking or refunds you generally want impression-level (census) data, since you cannot refund impressions you never measured. When comparing vendors' IVT rates, always ask whether figures are census or sampled and over which environments.
False positives are real costs
A detector that flags too much punishes honest publishers and throws away real customers, such as people on corporate VPNs, shared family devices or mobile networks in India or Indonesia where many users share one IP address. Good vendors measure their false-positive rates, publish how their categories map to MRC definitions, and let publishers dispute findings. Precision matters as much as recall.
Accreditation: who checks the checkers
MRC accreditation means an independent auditor has examined a vendor's methods, controls and data against MRC standards for specific metrics in specific environments, for example "SIVT detection for desktop and mobile web display" but not necessarily CTV. Accreditation is not a guarantee of catching everything; it is evidence that the process is documented, consistently applied and audited. TAG's programmes, covered in the next lesson, certify companies' anti-fraud practices rather than their measurement.
Key takeaways
- Pre-bid filtering prevents waste using lists and reputation; post-bid measurement sees rendering and behaviour and catches most SIVT.
- Detectors combine network, device, behaviour, supply-chain and population signals; corroboration beats any single signal.
- Honeypots, malware labs and threat-intelligence investigations uncover and dismantle large schemes.
- Census measurement is better than sampling for clustered fraud and refunds; always check MRC accreditation per environment.
Questions people ask
What is the difference between pre-bid and post-bid fraud detection?
Pre-bid detection checks the bid request before an ad is bought, rejecting traffic from known-bad IPs, devices, apps, domains or sellers in milliseconds. Post-bid detection runs when and after the ad renders, reading the device environment and behaviour to catch sophisticated invalid traffic. Pre-bid prevents waste; post-bid finds what pre-bid misses, supports blocking and refunds, and feeds new bad sources back into pre-bid lists.
How do ad verification companies detect bots?
They collect many signals, such as IP reputation, device fingerprints, browser properties, behaviour, timing and supply-chain data, and look for contradictions, like a supposed smart TV behaving like a phone or thousands of users with identical patterns. Machine-learning models find anomalies, honeypots attract bots, and threat researchers reverse-engineer malware. MRC accreditation confirms a vendor's methods are audited for specific environments.
What is a honeypot in ad fraud detection?
A honeypot is a trap set up so that no genuine person would interact with it, such as a hidden page, ad slot, link or unused app. Any traffic that reaches it is almost certainly automated, so researchers can study its fingerprint, trace where it came from and add those signals to detection models. Honeypots are one of several tools used to discover new bot operations.