Google Faces The Slickest Click Fraud Yet

Click fraud, that perpetual bane of online advertisers, is usually hard to detect in the moment, but easy to spot after the fact. That's because, unlike real clicks, sham clicks performed by automatic click software or human fraudsters pump up an advertiser's pay-per-click fees but never generate sales.

But on Tuesday, Harvard Business School professor Ben Edelman revealed what he says is a new form of click fraud that accomplishes what online fraud watchdogs might have once thought impossible: a scam that not only simulates valid clicks on a Google ad sold to an advertiser, but seems to result in a real customer who spends money on the advertiser's site.

"This is a particularly insidious kind of click fraud," says Edelman. "It takes more effort to organize, but it gives the perpetrator the capacity to impose charges in a way that's much harder for the advertiser to notice."

In a real example dissected on his blog, Edelman described how that complex and stealthy click fraud scheme works. According to Edelman, the perpetrators of the fraud, who run a site called TrafficSolar.com, make a deal to host Google's pay-per-click ads through a long string of Google affiliate partners, each of which agree to place their ads on other sites in exchange for a share of those ads' revenue.

Then Edelman says the TrafficSolar owners infect Web surfers' machines with spyware through a common cybercriminal tactic, exploiting a security vulnerability in either Windows XP or Internet Explorer when the user visits a popular, compromised Web site. (Edelman says he isn't sure which site the fraudsters used to infect his test machine.)

When someone with an infected computer later visits any of a number e-commerce sites, including Expedia.com, Gap.com or the shoe-seller Finishline.com, the spyware on his or her machine throws up a large pop-up window that covers the entire browser with another browser window displaying the same site. Unsuspecting shoppers make purchases on that pop-up window they normally might.

But that second window "reflects the fruit of click fraud," says Edelman. To create that pop-up, TrafficSolar invisibly simulates a click on one of the ads it hosts through its deal with Google affiliates, an ad for the same site the user intended to visit.

The result is that TrafficSolar.com--along with Google and each of the affiliates it shares its revenue with--gets a share of the pay-per-click fee paid by the advertiser. Meanwhile, the e-commerce site that paid for the ad receives real traffic and real sales, with no reason to suspect wrongdoing.

TrafficSolar's sleight of hand? Those sales would have happened regardless. But its spyware hides lucrative fraud in what otherwise would have been normal transactions.

"The retailer may think it can detect click fraud by a low sales conversion rate," says Edelman. "But here, the traffic converts. Based on that high conversion rate, they might even decide to raise their bid [in Google's advertising auction system] and have no way to realize that it's all a ruse."

TrafficSolar didn't respond to an e-mail message sent to the address listed in its domain registration or to a message left at its listed Austrian telephone number, whose voicemail greeting welcomed callers to the tourism center for the Austrian city of Graz. A site advisory warning from the cybersecurity company McAfee warns users that TrafficSolar.com may be infected with malicious software, and urges visitors to use "extreme caution."

Edelman, however, isn't focused on TrafficSolar so much as the seemingly legitimate deals that allowed the site to host Google ads. For those, he blames Infospace, another search engine that dealt directly with Google to broker the ads that were in turn passed on to more than seven other affiliates in a chain of deals that eventually led to TrafficSolar's scheme.

Those tangled arrangements, according to Edelman, should lead Google to cut its ties with Infospace. "It's all well and good for Google to have partners," he says. "But for the partners to have partners who have partners ... it becomes virtually impossible to monitor.
Google owes its advertisers something better than that."

Edelman's interest in Google is less than completely objective. He's currently serving as counsel in a lawsuit by Vulcan Golf alleging misplacement of the company's ads, and he's also worked as a consultant to Microsoft. But he says neither company funded his latest research.

It isn't the first time that Infospace, which didn't respond to a request for comment, has been the target of Edelman's criticism. Since 2005, Edelman has repeatedly accused the company of brokering deals that place ads on people's computers via security exploits and spyware. Even earlier, the company faced lawsuits and ousted its chief executive in 2001 after its stock price lost most than 99% of its value in the dot-com bust.

A Google spokesperson responded in an e-mailed statement that it's the company's policy "to prohibit [advertising] partners from being associated--whether directly or indirectly, intentionally or unintentionally--with parties who buy traffic in ways that cause a poor user or advertiser experience," and that it responds quickly to any violations of that policy.

As for its ability to detect the new form of click fraud, Google has long argued that it credits advertisers for as much as 10% of their ad spending based on click fraud that the company detects. While the company wouldn't comment on Edelman's TrafficShare example, a spokesperson wrote that the company uses "hundreds of data points" to detect fraud, not just clicks.

In a report last October, click fraud research firm Click Forensics measured click fraud at around 14%, significantly higher than Google's estimates. But even Click Forensics may not be counting the sort of click fraud Edelman accuses TrafficSolar of committing. Because Click Forensics' data is pulled from advertisers, the company can't necessarily detect click fraud that is disguised as real customers and real sales, according to the company's chief executive, Paul Pellman. Pellman believes, however, that the kind of click fraud Edelman discovered is likely mixed with traditional click fraud to increase the scheme's traffic volume while keeping it hidden.

Because the new form of click fraud involves installing spyware, it's likely used at a much smaller scale, Pellman says. But by mixing it with traditional fraudulent traffic, the spyware trick could cause higher-volume scams to seem to result in some sales, and thus lend them credibility.

"This is about adding a bit of what seems like quality traffic to what is otherwise a stream of junk," Pellman says. "It's just another example of how incredibly lucrative click fraud has become for its perpetrators, and the kind of sophistication that they've come up with to protect their income."

eBay Attempts To Curtail Click Fraud

eBay has tapped technology from Click Forensics, which verifies audiences and traffic quality for online advertisers, to block fraudulent and invalid traffic from paid search ad campaigns. The campaigns have been designed by merchants that sell products and service in the network.

Some merchants were clicking on ads to exhaust daily ad budgets of competitors.They also found fraudulent clicks on ads in eBay's Partner Network, where they allow partners to send traffic to eBay merchants. Steve O'Brien, vice president of marketing for Click Forensics, calls the move "classic competitor click fraud."

O'Brien declined to describe the extent of the click fraud problem. He did say that by working to filter out low-quality and invalid traffic, Click Forensics will help eBay advertisers on AdCommerce gain higher-quality audiences that can lower fraud rates.

"We process every click for every campaign," O'Brien says. "Our technology looks for patterns of fraud or invalid traffic. That could be as simple as seeing a click from a prior source and we know it's fraudulent, that this click is not human. We recognize it's a bot or a spider, clearly not a person with an intention to buy something."

The application doesn't replace another, according to Alexis Van De Wyer, director of advertising for eBay. "We have spent a lot of time and effort building an internal click filtering system that is the primary mechanism through which we assess click activity," he says. "The Click Forensics deal is only a part of that overall system."

Although Van De Wyer did not explain the remainder of the system, he did say Click Forensics's technology incorporates numerous tracking signals used to improve traffic quality provided to advertisers.

Van De Wyer says measuring success becomes challenging, but there are numerous ways ebay can determine how effective the system is over time. Most signals are found in data trends, both external and internal. Ultimately, satisfaction and participation from advertisers in the AdCommerce program becomes the most important signal indicating success.

Multiple eBay business units will take advantage of Click Forensics technology, including the eBay Partner Network (ePN) and the eBay AdCommerce unit.

AdCommerce is an advertising tool for eBay merchants that helps increase their visibility among eBay buyers by displaying cost-per-click ads to eBay visitors based on keywords or categories.

"Eliminating fraudulent inbound traffic means the advertiser pays less," O'Brien says. "By increasing the conversion rate, you increase the ROI, the return on advertising investment. So, you spend less and make more."

The Click Forensics audience verification platform allows ad networks, advertisers, agencies and publishers to protect themselves against bad online traffic sources, while targeting and delivering traffic sources that are more likely to convert into sales.

The agreement between the two companies includes sharing data, technology licensing and professional services consulting.

The Click Forensics platform measures and analyzes each individual ad visitor, or click, to determine its value and propensity to convert. The platform is also used to block certain types of online traffic that deliver poor ROI, such as botnets and known fraud perpetrators.

Lower my CPC ~~~~~~ Click Fraud UPDATE~~~~

Click fraud continues to plague online advertising, but many just want to sweep it under the rug. Radar Research managing partner Marissa Gluck calls it "the dirty little secret of the online ad industry that no one wants to talk about."

Perhaps that's because data released Thursday in a study conducted in July reveals that more than half of ad impressions and 95% of clicks in online ad buys were fraudulent. Gluck compiled and analyzed the findings published by ad optimization company Mpire, Seattle, Wash., with help from its AdXpose technology.

Nearly all the fraudulent traffic was hidden behind numerous layers of nested I-Frames -- ad units pulling ad content from other sources that can hide URLs and in-view data. The test shows significant impression fraud and URL padding in standard run-of-network (RON) online ad buys.

"There's an enormous amount of budgetary and impression waste taking place because of click fraud," Gluck says. "Ad networks, which have traditionally been seen as suspect, need to eliminate click fraud if they want to be taken seriously by advertisers."

Many of the sites in these exchanges use multiple layers of I-frames, which further complicated efforts to track campaigns. Sites are able to hide fraudulent traffic behind numerous layers of nested I-frames, leaving advertisers blind to in-view data, according to the study.

Mpire believes the default trafficking behavior of many RON buys is to include fraudulent and well-known botted sites. Gluck writes in the study that not all marketplace or exchange traffic is bad, but rather simply includes nefarious inventory that ad networks could block, but for some reason do not.

The report states that most campaigns are automatically optimized based on CTR and/or eCPM -- so this fraudulent traffic, if left unchecked, will dominate contracted volume. Gluck believes it would only take a little bit of effort to exclude these sites to reduce or eliminate click fraud.

The tests were conducted with two types of campaigns. The first was a managed campaign where ads were served to reputable sites, pre-approved by the advertiser to reduce concerns surrounding fraud. The second was a run-of-network (RON) campaign.

The buys were delivered in July on more than 20 million impressions to ads from 53 advertisers. These impressions were filled by the initial nine ad networks through downstream daisy-chaining on at least 45 additional ad networks on more than 100,000 sites.

Mpire also conducted a test directly on a top-ten ad network, with the goal of proving the power of referrer and fraud data to unlock the hidden value of horizontal networks. The impressions were bought on a CPM-basis, rather than on a CPC or CPA basis. The revealed that while 50% of the impressions were never within view of a user, the click and impression fraud volume was significantly lower than on the exchange-based buys.

Before optimization based on Mpire's data, there was an in-view-to-impression ratio of just 53%. After optimization, traffic generated by bots nearly disappeared and user engagement improved dramatically. Overall, the in-view-to-impressions ratio rose to more than 92%, post-analysis and implementation, according to the study.

Industry Click Fraud Rate Holds at 16.2 Percent in Second Quarter 2008

Botnets Grow to Make Up More than 25 Percent of All Click Fraud

AUSTIN, Texas – July 22, 2008 – Click Forensics™, Inc., . today released industry pay-per-click (PPC) fraud figures for the second quarter 2008 from the search advertising industry's leading independent click fraud reporting service - the Click Fraud Index (www.ClickFraudIndex.com).

Now in its third year, the Click Fraud Index monitors and reports on data gathered from the Click Fraud Network™, which more than 4,000 online advertisers and agencies have joined. The Click Fraud Network provides statistically significant industry PPC data collected from online advertising campaigns for both large and small companies across all the leading search engines. Key findings from data reported for Q2 2008 include:

• The overall industry average click fraud rate was 16.2 percent for Q2 2008. That's down slightly from the 16.3 percent rate reported for Q1 2008 and up from the 15.8 percent click fraud rate reported for Q2 2007.
  
• The average click fraud rate of PPC advertisements appearing on search engine content networks, including Google AdSense and the Yahoo Publisher Network, was 27.6 percent. That's down from the 27.8 percent rate reported for Q1 2008 and up from the 25.6 percent average click fraud rate reported for Q1 2007.
  
• For the first time, traffic from botnets was responsible for more than 25 percent of all click fraud traffic in Q2 2008.
  
• In Q2 2008, the greatest percentage of click fraud originating from countries outside North America came from China (4.3 percent), Russia (3.5 percent), and France (3.2 percent).
  

"Although click fraud rates were relatively unchanged in the second quarter, we found that the methods used to commit click fraud have become increasingly more sophisticated and difficult to detect," said Tom Cuthbert, president of Click Forensics. "The threat from botnets is the biggest concern as they have grown to cause over one quarter of all click fraud. Online advertisers should be extra vigilant in watching for traffic from botnets in their search marketing campaigns."

The Click Fraud Index publishes data collected from the Click Fraud Network (www.ClickFraudNetwork.com), the industry's first independent third-party click fraud detection service dedicated to helping companies more accurately monitor their online advertising campaigns for pay-per-click fraud. Click fraud data is tracked and published on a quarterly basis for specific search providers, industries and trends. The service is unique in that it monitors online campaigns for click fraud by correlating data collected from search provider campaigns and the advertisers' own web sites – providing the industry’s most accurate view of click fraud to date.

About Click Forensics, Inc.

Click Forensics is the leading provider of PPC traffic quality management and click fraud prevention solutions that help online advertisers and publishers stop click fraud and improve search marketing campaigns. The company also publishes the Click Fraud Index™, the top independent source of industry click fraud data. Click Forensics is headquartered in Austin, Texas, and is privately held with funding from Sierra Ventures, Austin Ventures and Shasta Ventures. More information on Click Forensics and its offerings is available at www.ClickForensics.com.

###

Click Forensics, Click Fraud Index and Click Fraud Network are trademarks of Click Forensics, Inc. All other company and product names mentioned are used only for identification and may be trademarks or registered trademarks of their respective companies.

Media Contact:
Karl Scholz
For Click Forensics karl.scholz@clickforensics.com
(512) 493-0909