There are several types of advertising fraud, with scammers using various methods to steal fraudulent publishing revenue. Below, we’ll review how these ad fraud techniques work.

Impression fraud is any fraudulent activity aimed at generating false impressions. This could be caused by scammers placing a fake, possibly invisible ad in front of a legitimate ad that redirects to a fraudulent site upon being clicked, earning an impression on the fraudulent site (more on this ad stacking method later). It could also be done via a legitimate ad being placed directly onto a fraudulent site without the advertisers intent, and using bots to generate false impressions of that ad on the site.

Click fraud is one of the most basic, common forms of ad fraud, with large numbers of ad clicks being generated by automated click programs or human click farms. The latter consists of low-wage workers paid to click on ads for long periods of time. Click fraud leads to misleading click data without any actual sales resulting from the fake ad engagement.

Location-based ad fraud is a more complex form of ad fraud in which a scammer may spoof multiple devices to make them appear to be in a certain location to defraud geo-targeted advertising.

Hidden ads are used as a method of stealing impressions, in which the scammer places an invisible ad onto a fraudulent website to take advantage of impression-based ad revenue.

Ad stacking fraud and pixel stuffing are methods of ad fraud similar to hidden ads – with ad stacking, the fraudsters will place a fraudulent ad over top of a legitimate one but make it difficult to remove from a user’s view or even impossible to see, allowing it to steal clicks when users try to close it or click on the legitimate ad. The fraudsters might also stuff a fraudulent ad into a single pixel, making it incredibly small and essentially impossible to see. This lets them easily steal impressions undetected.

Domain spoofing ad fraud is when fraudulent sites masquerade as a reputable site by using a web domain that appears to be relevant to a certain market or another reputable site. This can sometimes lead advertisers and DSPs to publish on that site by mistake, but is easier to detect than most other forms of ad fraud.

Click hijacking occurs when an attacker is able to compromise a website, a user’s computer or a proxy server and redirect a click on a legitimate ad to a click on a fraudulent one.

Fake app installation ad fraud is commonplace in a market filled with in-app advertising. Mobile ad fraud like application ad fraud can occur through this method which entails click farms of users downloading apps in bulk.

Bots and botnets are like the technological manifestations of ad fraud attackers themselves, multiplying their efforts and automating their attacks. As mentioned previously, over 40% of the traffic on the internet is estimated to be bot traffic. There are two types of bots: good and bad. According to a report from Imperva, it’s likely that around 15.2% of traffic are good bots that are owned by legitimate businesses and automate tasks to improve users’ experiences online. Bot fraud in digital advertising is carried out by bad spam bots, which may make up 25.6% of traffic and help scammers take advantage of digital advertising on a massive scale. Botnets are an additional way of complicating the effort to detect bots, as it links multiple bots across multiple devices to make them all look more legitimate due to their different IP addresses.