How 80% Impression Fraud Hides in Site Traffic - "see Fou yourself" FouAnalytics | Dr. Augustine Fou

Many folks cited a study that said "$63 billion was lost to invalid traffic." It was wrong. Here are three reasons why.

Invalid Clicks Versus Invalid Impressions

The company that did the study measures invalid clicks on websites that come from all different paid media sources, from paid search, to paid social, to paid programmatic ads. Assuming for the moment that their tech catches invalid clicks correctly and completely, the invalid click rate is not reflective of the percentage of impressions that are invalid.

That's because bots only do the thing they need to do to make money. For the ad impressions that are sold on a CPM ("cost per mille") basis, all the bots have to do is cause the ad to load in order to get paid; they don't need to waste time and effort to click on those ads, so they don't click. For the ad impressions that are sold on a CPC ("cost per click") basis, the bots have to click in order to get paid, so they do click. Nearly 20 years ago, I was already seeing greater than 100% click-through rates for my pharma clients on search ads.

The chart above shows 80% of the impressions are invalid (dark red). The chart below is on-site measurement for the same timeframe. Note the dark red is sub-10%. The percentage of invalid clicks that arrive on the site is not reflective of the percentage of invalid impressions upstream from it, because the revenue model was CPM for the ads and the bots did not need to click through to the site in order to make money, so they didn't click. The invalid rate measured on the site severely underestimates the percentage of invalid impressions—wasted ad spend.

Digging one step further, see the supporting data grid below, which shows the clicks arriving from paid media campaigns (URLs contain utm_source). The ones highlighted in yellow correspond to the clicks coming from display ad (CPM) campaigns. Note how small the counts are (bots didn't need to click through to the site in order to make money on CPM campaigns). And note the color coding under each row: surprisingly, more blue than expected. Basically, of those ads that were shown to humans, some humans did click through on the ads and arrive on the landing page. Some bots did too, but again, these were CPM campaigns so they didn't need to. So the rate of invalid clicks (arrivals on the site) is not reflective of the invalid rate of IMPRESSIONS. Also, note the row marked "TikTok." The vendor reported, "TikTok recorded the highest average IVT rate at 24.2 percent." Again, that's the clicks coming to the site, not the percentage of invalid impressions. And you can do great TikTok advertising by turning off Pangle, their audience network. The clicks that we can see below are almost all dark blue and very little dark red (invalid).

So the "$63 billion lost to invalid traffic" report severely underestimated the dollars lost to fraud (invalid impressions) because it only measured invalid clicks on the landing pages.

IP Address Detection Methodology Is Mostly Incorrect

The second issue is using IP addresses to detect invalid clicks or bots. Not only is it incomplete, but in most cases today, it's outright wrong and more harmful to campaigns than if it were not used at all. Let me explain. Fifteen years ago, it was sufficient to use IP addresses as a detection methodology because bots came from data center IP addresses and humans came from residential IP addresses.

But today, most botnets disguise themselves using residential proxy services, so their IP addresses look like residential IPs. Residential proxy services are typically made from malicious "free VPN" apps that people unwittingly install on their own devices. A compromised iPad at home is used to route bot traffic to make it look like it's coming from that residential IP address, instead of the data center IP where the bot originated. If you block this residential IP address, you are blocking the actual humans from that household from seeing your ads. The household may have 10–15 devices, but only that one iPad had the malicious free VPN app used to route bot traffic. The other devices were used by the humans in the household.

If you see data center IP addresses these days, it could be a real human who is using a VPN. Based on FouAnalytics data, that percentage has gone up from 0.1% to 1–2% these days. So if you mark a data center IP address as invalid and block it, you may be blocking real humans from seeing your ads or arriving on your sites.

If you're using a vendor that supposedly detects invalid clicks and traffic to your site, you may be inadvertently doing more harm to your campaigns. They are under-reporting the actual fraud in your campaigns. They are blocking data center IPs (accidentally blocking humans) and not blocking residential IPs (accidentally not blocking bots disguised as residential) and other variations thereof. And finally, by blocking the invalid traffic and clicks from your site reporting, you don't know how bad your paid campaigns actually are. For example, if they block the invalid clicks from your Facebook/Instagram campaign, you can't see that Audience Network was not turned off and virtually all of your clicks were invalid.

I have recommended that advertisers NOT block any invalid clicks to your site, because you need to see those clicks in order to know the health of your campaigns. Blocking invalid clicks from showing in your reports doesn't make campaigns better; it just hides the truth from you.

Let's wrap this up.

Multiplying Invalid Click Rate by Ad Spend by Country Is Wrong

And finally, I assume you understand by now why it's incorrect to just multiply the invalid click rate by country by the ad spend by country to get the "dollars lost to invalid traffic."

This is why I don't publish global estimates of the dollars lost to bots, fraud, and invalid traffic:

1. I don't need the publicity.

2. I don't have complete measurement, so I don't have the data to substantiate it.

3. It would be irresponsible of me to just extrapolate and make incorrect calculations to arrive at a big scary number for fraud that everyone then breathlessly cites in blog posts and articles.

I have seen over the years that whatever the fraud number—regardless of how big it is—it doesn't cause any substantive corrective action. It's nothing more than publicity for the company that published it and will be forgotten by the next news cycle.

Why Subscribe

Because low invalid click rates on your website don't mean your ad budget is safe—they might just be hiding an 80% fraud rate in your upstream impressions. Every week, FouAnalytics uses forensic campaign data to dismantle flawed ad-tech metrics, broken IP detection logic, and misleading industry reports, giving media buyers and budget owners the independent proof needed to protect their spend.

Subscribe below to read more from FouAnalytics weekly here on State of Streaming.