What Is Ad Fraud and How Can Advertisers Prevent It?
Ad fraud is any activity that makes advertisers pay for impressions, clicks, or conversions no real person generated. It is measured as invalid traffic (IVT) and prevented through verified supply, independent measurement, and KPIs bots cannot fake.
Ad fraud is any activity that makes advertisers pay for impressions, clicks, or conversions that no real person generated, usually through bots, hijacked devices, or inventory that misrepresents where an ad actually ran. The industry measures it as invalid traffic (IVT), and preventing it takes three layers working together: verified supply, independent measurement, and KPIs that bots cannot easily fake.
How the Industry Defines Invalid Traffic
The Media Rating Council (MRC), which accredits ad measurement in the US, splits invalid traffic into two tiers. As Google's ad platform documentation summarizes the MRC standard, general invalid traffic (GIVT) is "identified using lists of known spiders and robots, or other routine checks," while sophisticated invalid traffic (SIVT) "is often more difficult to identify and requires human intervention or more in depth analysis."
The distinction matters when you buy. Almost every platform filters GIVT automatically. SIVT is where the money is lost, and it is the reason third-party verification exists.
The Main Types of Ad Fraud
- Bot traffic: automated scripts or emulators that load pages, play video, and register impressions with no human present.
- Click fraud: fake or incentivized clicks that inflate CTR and drain cost-per-click budgets, common in search and performance campaigns.
- Domain and app spoofing: low-quality inventory passed off as a premium publisher or app, so the buyer pays premium CPMs for something else entirely.
- Device hijacking and malware: real consumer devices infected to generate traffic in the background. In June 2025 the FBI warned that the BADBOX 2.0 botnet had compromised millions of devices, including TV streaming boxes, digital projectors, and picture frames, often before purchase.
- Impression fraud: ad stacking, hidden ads, and pixel-sized placements that count as served but are never seen. This overlaps with viewability.
How Big the Problem Is
Rates vary by channel. Pixalate, a fraud-measurement vendor, analyzed more than 80 billion open-auction programmatic impressions in Q2 2026 and classified 20% of web traffic, 41% of mobile app traffic, and 26% of CTV traffic as invalid, with UK CTV at 34%. Those are open-auction figures, not all digital media, but the pattern is clear: the channels growing fastest, app and connected TV, carry the most risk. In 2025, DoubleVerify's Fraud Lab uncovered the ShadowBot scheme, which spoofed more than 35 million mobile devices using emulators and fake app identifiers to target mobile and CTV inventory.
How Advertisers Prevent Ad Fraud
1. Control the supply path. The IAB Tech Lab's ads.txt, app-ads.txt, and sellers.json standards let publishers declare who is authorized to sell their inventory, and let buyers refuse anything that does not match. Pair them with programmatic direct deals and private marketplaces instead of running everything through the open auction. Knowing how a DSP and an SSP pass the bid request tells you where spoofing can enter.
2. Verify independently. Use an MRC-accredited verification partner for pre-bid filtering and post-bid measurement, and do not rely only on the reporting of the platform you are paying. Agree up front how invalid traffic will be credited back before the campaign launches.
3. Buy against KPIs bots cannot fake. Cheap CPMs and high click-through rates are exactly what fraud is optimized to produce. Attention, time in view, brand lift, and downstream conversions are much harder to counterfeit.
Ad fraud prevention protects reported performance. Brand safety protects where the ad appears. The two share tools but answer different questions.
How Criterion Global Builds Fraud Resistance Into the Plan
On Brookfield's private equity awareness campaign, we designed the plan around a simple observation: bots scrape a page and move on, while humans linger. The campaign optimized for quality time on page instead of total impression volume, and measured success through a brand-lift study against actual investment decision-makers rather than clicks. Choosing a metric that fraud cannot easily inflate is a fraud control in its own right.
We apply the same discipline in our programmatic advertising and paid media work, and channel-level fraud risk is one more reason allocation should be planned deliberately rather than chasing the lowest CPM, which is what the Criterion Global Budget Blueprint℠ is built for.