The Alleged $7.5 Billion Fraud in Online Advertising

Posted by SamuelScott

"This is the biggest advertising story of the decade, and it's being buried."

So wrote Ad Contrarian Bob Hoffman, the retired CEO and chairman of Hoffman/Lewis Advertising, in June 2013 on a $7.5 billion scandal that has been developing under the digital radar in the advertising world for the past few years. The three main allegations, according to those who are making them:

1. Half or more of the paid online display advertisements that ad networks, media buyers, and ad agencies have knowingly been selling to clients over the years have never appeared in front of live human beings.
2. Agencies have been receiving kickbacks and indirect payments from ad networks under the guise of "volume discounts" for serving as the middlemen between the networks and the clients who were knowingly sold the fraudulent ad impressions.
3. Ad networks knowingly sell bot traffic to publishers and publishers knowingly buy the bot traffic because the resulting ad impressions earn both of them money—at the expense of the clients who are paying for the impressions.

These charges have not seen much discussion within the online marketing community. But the allegations have the potential to affect everyone involved in online advertising—ad agencies, in-house departments, agency and in-house digital marketers, online publishers, media buyers, and ad networks. An entire industry—billions of dollars and thousands of jobs—is at stake.

And it all starts with a single impression.

The impression that you make

(Wikimedia)

Online advertising is based on an "impression"—without the impression, then an advertisement cannot be viewed or clicked or provoke any other engagement. The Internet Advertising Bureau, which was founded in 1996 and "recommends standards and practices and fields critical research on interactive advertising," defines "impression" in this manner:

a measurement of responses from an ad delivery system to an ad request from the user's browser

In another words, an "impression" occurs whenever one machine (an ad network) answers a request from another machine (a browser). (For reference, you can see my definition and example of a "request" in a prior Moz essay on log analytics and technical SEO.) Just in case it's not obvious: Human beings and human eyeballs have nothing to do with it. If your advertising data states than a display ad campaign had 500,000 impressions, then that means that the ad network served a browser 500,000 times—and nothing more. Digital marketers may tell their bosses and clients that "impression" is jargon for one person seeing an advertisement one time, but that statement is not accurate.

The impression that you don't make

(Wikipedia)

Just because a server answers a browser request for an advertisement does not mean that the person using the browser will see it. According to Reid Tatoris at MediaPost, there are three things that get in the way:

• Broken Ads—This is a server not loading an ad or loading the wrong one by mistake. Tatoris writes that these mistakes occur roughly 15% of the time.
• Bot Traffic—Whenever hackers write these automated computer programs to visit websites and post spam or create fake accounts, each visit is a pageview that results an an ad impression. According to a December 2013 report in The Atlantic, 60% of Internet traffic consists of bots.
• Alleged Fraud—In Tatoris' words, "People will hide ads behind other ads, spoof their domain to trick ad networks into serving higher-paying ads on their site, and purposefully send bots to a site to drive up impressions." Noam Schwartz described in TechCrunch two additional methods of alleged fraud: compressing ads into a tiny one-by-one pixels that are impossible to see and using malware to send people to websites they never planned to visit and thereby generate ad impressions. AdWeek found in October 2013 that 25% of online ad impressions are allegedly fraudulent.

Tatoris crunches all the numbers:

We start with the notion that only 15% of impressions ever have the possibility to be seen by a real person. Then, factor in that 54% of ads are not viewable (and we already discussed how flawed that metric is), and you're left with only 8% of impressions that have the opportunity to be seen by a real person. Let me clarify: That does not mean that 8% of impressions are seen. That means only 8% have the chance to be seen. That's an unbelievable amount of waste in an industry where metrics are a major selling point.

Essentially: If you have an online display ad budget of $100,000, then only $8,000 of that ad spend has the chance to put advertisements in front of human eyeballs. (And that's not even taking into account the poor clickthrough rates of display ads when people do see them.)

If you are paying $0.10 per impression, then the $10,000 that you will pay for 100,000 impressions will result in only 8,000 human views—meaning that the effective CPI will actually be $1.25.

How bot traffic affects online ads

(Wikipedia)

Jack Marshall, an alleged reformed fake web traffic buyer, explains in a Digiday interview how the scheme allegedly operates. Here are just three excerpts:

How and why were you buying non-human traffic?
We were spending anywhere from $10,000 to $35,000 a day on traffic. My conversations with [these ad networks] were similar: They would let me decide how much I was willing to pay for traffic, and when I told them $0.002 or below, they made it clear they had little control over the quality of traffic they would send at that price. Quality didn't really matter to us, though. As a website running an arbitrage model, all that mattered was profit, and for every $0.002 visit we were buying, we were making between $0.0025 and $0.004 selling display ads through networks and exchanges. The biggest determinate of which traffic partner we were spending the most money with was pageviews per visit. Since we were paying a fixed cost per visit, more pageviews equaled more ad impressions. Almost none of these companies were based in the U.S. While our contacts were in the US and had American names and accents, most of the time we found ourselves sending payment to a non-US bank.

In other words, the publisher would allegedly pay an ad network $0.0020 for a visit from a bot, and the resulting ad impression would garner $0.0025 to $0.0040 in revenue—that's a gross margin of 25% to 100% for the publisher for doing nothing! It's no wonder that so many websites around the world may be allegedly involved in this practice.

Do you think publishers know when they're buying fake traffic?
Publishers know. They might say "we had no idea" and blame it on their traffic acquisition vendor, but that's bullshit, and they know it. If you're buying visits for less than a penny, there's no way you don't understand what's going on. Any publisher that's smart enough understand an arbitrage opportunity is smart enough to understand that if it was a legitimate strategy that the opportunity would eventually disappear as more buyers crowded in. What we were doing was 100 percent intentional. Some articles revolving around bot traffic paint publishers as rubes who were duped into buying bad traffic by shady bot owners. Rather, I believe publishers are willing to do anything to make their economics work.

Do networks, exchanges and other ad tech companies do anything to stop this from happening?
We worked with a major supply-side platform partner that was just wink wink, nudge nudge about it. They asked us to explain why almost all of our traffic came from one operating system and the majority had all the same user-agent string. There was nothing I could really say to answer that question. It was their way of letting us know that they understood what was going on. It wasn't just our account rep, either. It was people at the highest levels in the company. Part of me wished they'd said "You are in violation of our TOS and you have to stop running our tags." I would have been happy with that. But they didn't; they were willing to take the money.

If these stories are true, then ad networks do not care that the impressions are from bot traffic and publishers do not care that are getting bot traffic because they are both making money. Who gets hurt? The companies advertising their products and services.

The worst part of it all

(Flickr user Don Hankins)

It's not only that online display ads are alleged to be amazingly useless and that many publishers and ad networks are allegedly involved in sleazy deals. A March 2015 investigative report in Ad Age found the following:

Kickback payments tied to U.S. media-agency deals are real and on the rise, according to Ad Age interviews with more than a dozen current and former media-agency executives, marketers' auditors, media sellers and ad-tech vendors who said they'd either participated in such arrangements or had seen evidence of them. The murky practice—sometimes disguised as (undisclosed) "rebates" or bills for bogus services—is being motivated by shrinking agency fees and fueled by an increasingly convoluted and global digital marketplace. "It's really ugly and crooked," said one ad-tech executive who described receiving such requests.

Some arrangements go like this: A large media shop, poised to spend $1 million with that ad-tech executive's firm to buy digital ads last year, asked for $200,000 to be routed back to the agency's corporate sibling in Europe. The $200,000 would pay for a presentation or presentations by the sibling's consultants. But these types of presentations aren't worth a fraction of the price tag, according to numerous executives dealing with the same issue, who spoke on condition of anonymity for fear of losing business.

Essentially, here is what is allegedly happening:

• Clients give money to agencies to purchase online display advertising
• The agencies give the money to the ad networks
• The ad networks give a portion of the money back to the agencies
• The clients' display ads are only 8% viewable
• The 92% non-viewable impressions still earn money for publishers and ad networks

I think we can see who the loser is—everyone is making money except for the clients.

During the same month as the Ad Age report, former Mediacom CEO Jon Mandel reportedly told the Association of National Advertisers Media Leadership Conference that widespread "media agency rebates and kickbacks" were the reason that he left the agency business.

Heads in the digital sand

(Flickr user Peter)

I have yet to hear about this issue being addressed in any talk, panel, or session at a digital marketing, martech, or adtech conference. Prior to today, I have seen only one article each in two major publications in the online marketing industry. (Mozzers, please correct me if I am mistaken and have missed something major on this topic.)

Why is no one talking about this?

No marketing agency wants clients to know that 92% of its display advertising spend is wasted. No advertising manager wants the CMO to know that only 8% of the company's ads are reaching people at 100% cost. No CMO wants the CEO to know that 92% of the entire ad budget is being flushed down the digital toilet.

I myself would probably have not been permitted to write this article when I held various agency positions in the past because I managed clients' online advertising and some PR and digital marketing clients of the agencies were advertising networks themselves.

(Today, I am the director of marcom for Logz.io, a log analytics startup, and I have the luxury of being accountable only for the results of my in-house work—and I do not plan to use online advertising anytime soon. Still, I was a journalist in my first career years ago, and I wanted to write this report because I think everyone in my beloved industry should know about this explosive issue.)

Hoffman, the retired ad agency CEO who I quoted at the beginning, puts it better than I can:

How does an agency answer a client who asks, "You mean more than half the money you were supposed to be custodian of was embezzled from me and you knew nothing about it?" How does an ad network answer, "You mean all those clicks and eyeballs you promised me never existed, and you knew nothing about it?" How does a CMO answer his management when they ask, "You mean these people screwed us out of hundreds of thousands (millions?) of dollars in banner ads and you had no idea what you were buying?"

Everyone is in jeopardy and everyone is in "protect" mode. Everyone wants to maintain deniability. Nobody wants to know too much. If display advertising were to suffer the disgrace it deserves, imagine the fallout. Imagine the damage to Facebook, which at last report gets over 80% of its revenue from display. Imagine the damage to online publishers whose bogus, inflated numbers probably constitute their margin of profit.

If the comScore findings are correct and projectable, it means that of the 14 billion dollars spent on display advertising last year in America, 7.5 billion was worthless and constituted some degree of fraud or misrepresentation.

But clients, CMOs, and CEOs are going to read one of these articles one day and start asking uncomfortable questions. I would suggest that Mozzers—as well as all digital marketers and advertisers—start thinking about responses now.

Responses to the scandal

(Flickr user Chris Potter)

Google, to its credit, has disclosed that 56% of its digital ad impressions are never actually seen—of course, the report was also released with the announcement of a new ad-viewability product.

Ginny Marvin summarizes at Marketing Land:

Google's viewability measurement tool, Active View, is integrated into both the Google Display Network and DoubleClick. Advertisers can monitor viewability rates and buy ads on a viewable impression basis rather than by served impressions.

Google also announced an update to DoubleClick Verification last week, which includes viewability monitoring, ad blocking, a content ratings system and spam filtering capabilities.

The goals of the Media Rating Council (MRC), an industry organization founded in the United States in the 1960s following congressional hearings into the media industry, are:

• To secure for the media industry and related users audience measurement services that are valid, reliable and effective
• To evolve and determine minimum disclosure and ethical criteria for media audience measurement services
• To provide and administer an audit system designed to inform users as to whether such audience measurements are conducted in conformance with the criteria and procedures developed

The MRC has certified "viewable impressions" as a legitimate metric (as opposed to "served impressions"). The Interactive Advertising Bureau (IAB), mentioned earlier, issued guidelines in December that online advertising networks should aim for at least 70% viewability.

Facebook, for its part, announced in February 2015:

We are working with the MRC and a consortium of advertisers and agencies to develop more robust standards for viewable impressions. Our goal is to work with the MRC, our partners, and industry leaders around the world to help apply further standards for feed-based websites like Facebook, mobile media and new ad formats.

The American Association of Advertising Agencies, Association of National Advertisers, and IAB announced last year that they would create a new organization, the Trustworthy Accountability Group, to fight problems in the online advertising market and do the following:

• Eliminate fraudulent traffic
• Combat malware
• Fight Internet piracy
• Promote greater transparency

TAG now consists of representatives from Mondelez International, JCPenney, Omnicom, Motorola, Google, Facebook, AOL, and Brightroll.

Canada's latest anti-spam legislation aims to fight Internet malware and bots—but a big stumbling block is that most of the problem comes from outside the country.

Will these corporate and organizational responses be enough? For the following reasons and more, it's impossible to know:

• Industry guidelines depend on voluntary compliance. Industry recommendations do not have the force of law—any business that thinks it can still make a lot of money by ignoring the guidelines will likely continue to do so.
• Possible penalties for past behavior. Regardless of what reforms may occur in the future, should those who knowingly engaged in such alleged fraud and deception in the past be held criminally or civilly liable? (I'm not a lawyer, so I cannot comment on that.)
• IAB's 70% viewability goal. Should advertisers accept this metric as simply the nature of the medium? One estimate of the total display ad market amounted to $14 billion. If the 70% viewability goal can even be reached, should and will advertisers accept that $4.2 billion of their collective ad spend will still be lost before their advertisements are even viewed by human beings?

I have no answer—only time, I suppose, will tell.

But others are coming up with their own answers—those large corporations that are spending billions of dollars a year on online display advertising. As Lara O'Reilly wrote in May 2015 at Business Insider, $25 billion in ad spend is now under review in what Adweek is calling "Mediapalooza 2015." O'Reilly gives one possible reason:

Media reviews let brands reassess their ad spending, often by offering those contracts out in a competitive bidding process. The companies include General Mills, Procter & Gamble, Volkswagen, Visa, Sony, Coca-Cola, Citi, 21st Century Fox ... the list goes on. Some of these — P&G, Sony, and 21st Century Fox — spend more than $1 billion on advertising each year...

It could be that marketers are finally getting fed up with the apparent lack of transparency about where their budgets are actually being spent and why.

What marketers can do

(Image of an Indian online-marketing team I used with rights in a prior Moz essay
on the future of marketing departments)

Regardless of what the future will hold, here are my recommendations on how digital advertisers can respond:

• Stop doing cost-per-impression (CPI or CPM) campaigns. Traditional digital advertising strategy recommends that people use CPM campaigns for brand awareness, cost-per-click (CPC) campaigns for traffic, and cost-per-action (CPA) campaigns for sales and conversions. In light of this scandal, I see no good reason to do CPM at all anymore.
• Revise advertising KPIs and metrics in human terms. Earlier in this article, I calculated the following change to a hypothetical CPI value: "If you are paying $0.10 per impression, then the $10,000 that you will pay for 100,000 impressions will result in only 8,000 human views—meaning that the effective CPI rate will actually be $1.25." In addition, half of all clicks in CPC campaigns might also be bots. As a result, a $2 CPC result may actually be $4 when reaching human beings is taken into account. Ad campaign analysts may want to take alleged bot and fraudulent activity into account when calculating ROI and whether display advertising is worthwhile.
• Demand full disclosure. Clients should ask agencies and media buyers if they are getting paid directly or indirectly by ad networks. Agencies and media buyers should ad networks how they are combating bot activity and any fraudulent behavior. Ad networks should not turn a digital blind-eye to publishers who intentionally use bots to make profits off of advertisers. If anyone gives vague answers or otherwise disparages such questions, then that is a red flag. Advertisers should demand and receive full, verifiable information in light of what has allegedly been occurring.
• Block certain countries from campaigns. According to a report in Ad Week, China, Venezuela, Ukraine, and Singapore have "suspicious traffic" rates of between 86% and 92%. (The rate in the United States is 43%.)
• Use ad-fraud detection platforms. Companies such as Forensiq, SimilarWeb, Spider.io (which was bought by Google), Telemetry, and White Ops compare visit patterns with industry benchmark behavior as well as check for malicious software proxy unmasking, verify devices, and detect any manipulation.
• Run manual campaigns as much as possible. The only way to reduce wasted impressions significantly is to research and implement digital ad campaigns manually rather than use programmatic ad buying. Digital advertisers should research potential websites on which they want to run advertisements to see if they are legitimate—potentially even running ads on only the largest, well-known sites but doing so continuously. This way, it might be best to focus your ad campaigns on quality viewers rather than trying to maximize the quantity of viewers by also including lesser-known sites.

Beyond the current responses of the ad industry and my present recommendations for marketers, I do not know what will happen. My goal here is simply to explain to digital marketers what has allegedly been occurring. What the future will hold—well, that's up to we marketers and advertisers.

Additional resources

• The Ad Fraud Wiki
• Bob Hoffman's blog post with a partial list of his writings on this topic
• Ad Week's Mike Shields, and Ad Age's Alex Kantrowitz—two of the reporters who are following this issue closely

Sign up for The Moz Top 10, a semimonthly mailer updating you on the top ten hottest pieces of SEO news, tips, and rad links uncovered by the Moz team. Think of it as your exclusive digest of stuff you don't have time to hunt down but want to read!