Not Your Father’s Click Fraud
Today the Click Fraud Index for Q1 2009 was released, and the startling news would appear to be that the click fraud rate in Q1 dropped to 13.8% from over 17% a quarter ago. But there are several plausible explanations for the sharp drop in click fraud. The real news was in the types of fraud that were identified, and the likely targets of these new attacks.
So why the drop-off? Several factors likely contributed. First, the Q4 fraud rate was unusually high, the highest ever in the history of publishing the click fraud index. Due to the huge amount of online spending during the holiday season and the eroding economic climate, there was a sort of “perfect storm” for fraudulent activity. In Q1, by contrast, there was a drop-off in online ad spending — Google reported their first-ever quarterly revenue decline — and more importantly, a decrease in the average cost-per-click (the number of paid clicks still increased by 17%, even though total revenue was down). Lower CPCs means less reward for fraudsters.
Maybe the most important contributor to the reduced click fraud rate, though, was the heightened awareness of bots, worms, and other forms of malware created by the Conficker reporting (anyone see “60 Minutes?”). It would appear that the tier 1 ad providers and ad networks did a much better job of mitigating fraudulent activity in Q1 than in previous quarters. We can only hope this is a trend that continues.
But the more interesting trend uncovered in the Q1 data were the new types of fraud and the new targets of click fraud. The data showed several examples of malicious scripts (JavaScript) designed to perpetrate click fraud. When a visitor lands on a site these scripts execute by opening a zero iframe or zero-pixel window and clicking on paid ads. The site visitor never sees these hidden frames and never visits the advertiser’s site. But the advertiser pays for the click, and the site owner reaps the commission for the paid click. Because the clicks are generated by a real browser with a valid IP address on a real web site with no suspicious repeat clicking patterns, this type of fraud is very difficult to discover for the average advertiser or unsophisticated ad network. (No, we can’t tell you how we find it, but we do.)
The bottom line is that the click fraud rate was down in Q1, but click fraud schemes continue to get more sophisticated. As tier 1 ad networks and ad providers like Yahoo! and Google continue to increase their efforts and effectiveness, the fraudsters will migrate elsewhere. Tier 2 ad networks must focus on traffic quality initiatives in order to protect their advertisers, and themselves.

