#ad fraud

I'm on a tour with my new book, the international bestseller Enshittification: catch me next in Toronto (THURSDAY!), San Diego and Seattle! Full schedule here.

Being "the enshittification guy" means that people expect you to weigh in on every service or platform that has been deliberately worsened to turn a buck. It's an impossible task (and a boring one besides). There's too much of this shit, and it's all so mid – a real "banality of enshittification" situation.

So these days, I really only take note of fractally enshittified things, exponentially enshittified things, omnienshittified things. Things like the fact that Google is sending people searching for health care plans to "junk insurance" that take your money and then pretty much just let you die:

https://pluralistic.net/junk-insurance

"Junk insurance" is a health insurance plan that is designed as a short-term plan that you might use for a couple of days or a week or two, say, if you experience a gap in coverage as you move between two jobs. These plans can exclude coverage for pre-existing conditions and typically exclude niceties like emergency room visits and hospitalization:

https://www.brookings.edu/wp-content/uploads/2020/07/Broader-View_July_2020.pdf

Crucially, these plans to not comply with the Affordable Care Act, which requires comprehensive coverage, and bans exclusions for pre-existing conditions. These plans only exist because of loopholes in the ACA, designed for very small-scale employers or temporary coverage.

The one thing junk insurance does not skimp on is sales and marketing. These plans outbid the rest of the market when it comes to buying Google search ads, meaning that anyone who uses Google to research health insurance will be inundated with ads for these shitty plans. The plans also spend a fortune on "search engine optimization" – basically, gaming the Google algorithm – so that the non-ad Google results for health insurance are also saturated with these garbage plans.

The plans also staff up boiler-rooms full of silver-tongued high-pressure sales staff who pick up on the first ring and hard-sell you on their plans, deliberately misleading you into locking into their garbage plans.

That's right, locking in. While Obamacare is nominally a "market based" healthcare system (because Medicare For All would be communism), you are only allowed to change vendors twice per year, during "open enrollment," these narrow biannual windows in which you get to "vote with your wallet" against a plan that has screwed you over and/or endangered your life.

Which means that if a fast-talking salesdroid from a junk insurance company can trick you into signing up for a garbage plan that will leave you bankrupt and/or dead if you have a major health crisis, you are stuck for at least six months in that trap, and won't escape without first handing over thousands of dollars to that scumbag's boss.

Amazingly enough, these aren't even the worst kinds of garbage health plans that you can buy in America: those would be the religious "health share" programs that sleazy evangelical "entrepreneurs" suck their co-religionists into, which cost the world and leave you high and dry when you or your kids get hurt or sick:

https://armandalegshow.com/episode/is-it-ever-appropriate-to-fudge-a-little/

The fact that there are multiple kinds of scam health insurance in America, in which companies are legally permitted to take your money and then deny you care (even more than the "non-scam" insurance plans do) shows you the problem with turning health into a market. "Caveat emptor" may make sense when you're buying a used blender at a yard-sale. Apply it to the system that's supposed to take care of you if you're diagnosed with cancer, hit by a bus, or develop eclampsia, and it's a literally fatal system.

Ensuring the legitimacy of clicks is a key performance measurement metric for marketers and businesses. Verification backed with accurate measures leads to optimized performance. Click Tracking ensures all invalid traffic is identified before it drains the ad budget and skews ad campaign performance data.  Let’s delve deeper to understand the need for click tracking and how it can help in campaign optimization.  

Click Measurement and Validation 

Consider a scenario where an ad gets a massive number of clicks, generating a good number of impressions but ending up with a low conversion rate. This is a clear waste of spending. Advertisers need to identify gaps across the funnel that start with first and foremost wider end with a flurry of clicks.   

What does the advertiser need?

Advertisers need to optimize their ad campaigns with click fraud detection software, that can bring transparency to the ad campaigns.  

Weed out invalid traffic starting with clicks

Invalid traffic from clicks on Google ads and Meta Ads need to be identified in real-time, ensuring no damage to your ad budget. 

Identify genuine clicks vs Bots clicks

Genuine clicks usually show varied patterns, high engagement, and diverse geolocations. While Bot clicks exhibit rapid, consistent patterns, low engagement, and suspicious IP addresses. Identifying Bot patterns and accurate measurement is the key to protecting wastage of ad spend. 

Detect Fake clicks

Driving genuine traffic led to getting conversions. Detecting fake clicks generated via click spamming in real time improves your quality of traffic and can get you more conversions. 

Click farms

Are large-scale dedicated click fraud operations generating invalid clicks? Are you able to track that? Usually, click farms are hired to inflate the click volume on ads leading to inflated and skewed metrics.  

Accuracy of Measurement can prevent hefty payout on invalid clicks and bring transparency into the ad campaign across app, web, or programmatic advertising platforms.  

If you’re running app campaigns at scale, you’ve probably seen this before. Your attribution reports look clean, installs are coming in, and your ad fraud detection tool shows no major issues—yet the overall quality of users doesn’t feel right. 

For app marketers, with fraud checks now bundled into most attribution platforms, it’s easy to assume traffic quality is covered. But these validations are mainly built to ensure installs are attributed correctly, not to deeply assess how users behave after they enter the app. And that’s where things start to drift. 

The challenge for marketers isn’t spotting obvious fraud anymore; it’s making sense of why validated traffic still underperforms. Cohorts don’t retain as expected. Conversions don’t scale the way spend does. Business impact feels weaker than what the top-line numbers suggest. 

In this blog, we cover:  

The key signs attribution platforms miss  

Impact of missed ad fraud signals on app campaigns  

How mFilterIt helps marketers to solve this 

Key Signs Your Current Tools Might Be Missing

Manual and traditional monitoring tools overlook some serious ad fraud signs that lead to long-term impacts. Let’s understand each of them – 

Abnormal Click-to-Install Ratios

Abnormal click-to-install ratios are one of the clearest signs that something is off. In our 8-day analysis, we saw an extremely high number of clicks but almost no installs, resulting in a CTIT of just 0.01% on 03-08-2025. Such unusual click patterns cannot happen with real users. It’s a strong indicator of bot activity, where automated systems continuously click on ads without ever converting, making it harder to detect. 

Spam + Bot Traffic Masquerading as Average

Let’s take it a step further. We already saw high clicks with very few installs, but the conversion rate makes it even more suspicious. Out of all the installs, only a tiny fraction went on to make a purchase. For example, in one case with 170 million clicks and 249K installs, only 384 real orders were placed, resulting in a conversion rate of just 0.154%. This gap strongly suggests spam or bot traffic rather than genuine users that cannot be tracked with manual monitoring or traditional monitoring tools.

Sudden Increase in Low-Value Orders

There was a sudden and noticeable surge in low-revenue orders, which is a clear sign of arbitrage. This usually happens when dishonest affiliates pay users a small amount to place very cheap orders, just to make it look like their channel is driving sales. In reality, these orders are fake signals meant to earn them higher commissions. 

Are you proactively analyzing the ad traffic of your campaigns?  

Is it really coming from genuine users or just being generated by bots? 

Yes, a significant portion of traffic that makes your ad campaigns seem successful could be invalid traffic. According to mFilterIt’s analysis featured in FICCI Report 2025, invalid traffic contributes to as much as 30–50% of activity across digital channels, directly distorting performance metrics and draining ad budgets. 

This means the performance you see on dashboards may not always reflect real user intent. Instead, it could be influenced by automated systems, proxies, or manipulated interactions that inflate impressions, clicks, and even conversions. 

Are you proactively analyzing the ad traffic of your campaigns?  

Is it really coming from genuine users or just being generated by bots? 

Yes, a significant portion of traffic that makes your ad campaigns seem successful could be invalid traffic. According to mFilterIt’s analysis featured in FICCI Report 2025, invalid traffic contributes to as much as 30–50% of activity across digital channels, directly distorting performance metrics and draining ad budgets. 

This means the performance you see on dashboards may not always reflect real user intent. Instead, it could be influenced by automated systems, proxies, or manipulated interactions that inflate impressions, clicks, and even conversions. 

In this blog, we break down what invalid traffic really is, why it’s increasing, differences between general invalid traffic and sophisticated invalid traffic, and how you can identify and mitigate its impact to ensure your campaigns deliver genuine results. 

What is Invalid Traffic? Why is it Increasing Rapidly?

Invalid traffic simply means ad activity that doesn’t come from real users but still shows up as genuine impressions, clicks, or visits. This happens when bots or automated systems interact with ads, making it look like people are engaging when they actually aren’t. 

Over time, this traffic has become more advanced and harder to spot. Bots now easily mimic real user behaviour, such as browsing pages, scrolling, or clicking on ads.  Moreover, developments in technology, AI usage, and advertising infrastructure also contribute to this. Here’s how: 

AI is making bots smarter

Earlier, bots were easy to detect because they behaved like machines. Today, AI-powered bots can scroll, pause, click, and even mimic browsing patterns. Some can simulate entire user journeys, making fake engagement look real in analytics tools. 

The ad ecosystem has become more complex

Modern advertising runs through multiple layers and channels, DSPs, SSPs, ad exchanges, networks, and resellers. This fragmentation creates blind spots, making it easier for low-quality or fraudulent traffic to enter without being noticed. 

Cheap infrastructure fuels large-scale ad fraud

Server farms allow fraudsters to generate massive volumes of ad traffic at very low cost. What once required physical devices can now be scaled instantly using virtual environments. 

Limited transparency and visibility

Limited transparency and visibility across the digital ecosystem make it harder for advertisers to verify traffic quality. With restricted access to detailed user-level data, identifying whether engagement is coming from real users or sophisticated invalid traffic becomes more challenging. 

As long as advertisers pay based on clicks or impressions, there’s always a chance for misuse. Fraudsters take advantage of this by generating invalid clicks or views to earn money, especially when proper checks are not in place. 

Therefore, detecting invalid traffic has become more important than ever. Invalid traffic is generally classified into two main types: General Invalid Traffic (GIVT) and Sophisticated Invalid Traffic (SIVT). 

Two Major Types of Invalid Traffic

Invalid traffic is broadly classified into two categories based on how complex the fraud technique is.  

What is General Invalid Traffic (GIVT)?

It refers to non‑human or automated interactions that inflate ad metrics, caused by easily identifiable bots, spiders, or crawlers. These bots typically do not attempt to mimic real human behavior. They’re not malicious in intent but can distort campaign reporting and waste ad spend due to their automated nature. 

Because the patterns are predictable, platforms and verification tools can often identify and block this traffic using ad fraud detection techniques.  Here’s what we observed in one of the campaigns .

VPN and proxy traffic contributed 12.4% of total activity, indicating that a significant portion of traffic was not genuinely coming from real users. 

Several visits appeared to come from genuine mobile users but traced back to VPN and proxy networks, that were being used to hide the real user’s location. A deeper analysis showed that these IP addresses were linked to data center hosting providers (DCH) instead of real user networks.  

Consider a fast-growing ecommerce brand with strong organic traffic and a well-run affiliate program. Revenue looks solid every month, but one odd trend appears: a mid-tier affiliate suddenly becomes the highest contributor, while trusted, high-quality partners stay flat. 

At first, it feels like a performance win. 

However, a closer look reveals the truth. 

Most of those “affiliate-driven” traffic was from users who were already interested to buy from the brand. At the last moment, the credit shifts to the affiliate — even though they didn’t bring in a new customer. To burst this bubble, focus on what really adds value. 

Your mobile app campaigns are delivering installs. But how many of them are real? Or are those installs further converting to genuine user activity or events? 

The global mobile advertising market reached USD 262.84 billion in 2025 and is expected to grow to USD 322.67 billion in 2026. 

And this is what fraudsters aim to target using sophisticated bot networks, click farms, invalid traffic, and affiliate networks. Because with scalability comes vulnerability if not monitored closely. 

You know you need an answer when your campaigns don’t perform as you expect them to. Or maybe they do perform, but just on dashboards? 

Click fraud is no longer limited to just basic bot traffic. In 2026, it has evolved into more sophisticated threats that many traditional detection tools are not equipped to identify. 

Fraudsters now deploy AI-powered bots that simulate real user behaviour to evade behavioural detection. They operate across performance marketing ecosystems, including Google Search, display, GDN, Pmax, Meta, affiliate networks, app install campaigns, lead generation, and re-engagement campaigns. 

According to mFilterIt, 18% of global digital ad traffic was invalid in 2025. Moreover, with global digital ad spend projected to reach $866.2 billion in 2026 and $916 billion by 2027, the scale of fraud opportunity is growing at exactly the same rate as advertiser investment. 

Therefore, the traditional method of identifying fraudulent clicks is not enough. Marketers need a tool that has advanced specifications that can help them stay ahead of such evolving threats. 

But the question remains, “What exactly should marketers look for in a click fraud prevention tool in 2026?” 

We have simplified this search for you in this blog. 

It breaks down:

What features should an advertiser prioritize in a click fraud protection tool? 

How is mFilterIt different from standard ad fraud detection solutions? 

Why isn’t click-level protection enough for web and app campaigns? 

So, if you’re comparing solutions or preparing to invest, this is the clarity you need to make the right decision. 

Key Features to Look for in a Click Fraud Protection Software

The right click fraud protection tool is supposed to give you actionable insights, measurable improvements, and cross-channel protection. Here’s what to expect from a tool that actually solves your business problems: 

Proactive Click Validation

Click fraud operates in milliseconds. Your click fraud protection tool should have the capability to detect fraud proactively before it reaches your deep funnel or MMPs. Click validation ensures invalid traffic is flagged and filtered before it drains your ad budget. Here are some checks that a robust solution must perform:  

Click Repetition Behavior: Spamming on the same Device ID, click and impression injections, IP address repetitions, clusters, and spikes  

Malicious IPs / VPNs: VPNs, proxies, and data center traffic should be identified in real time  

Invalid Device Make-Model: Invalid devices detected via User Agent analysis  

Invalid Geo: Non-applicable geographies flagged via IP address checks 

Multi-Channel Compatibility Across Performance Campaigns

Fraud is not confined to one platform.It spreads across Google Ads, affiliate programs, Meta, DV360, mobile app networks, and even OEM and influencer traffic. Your protection tool should have omnichannel compatibility to work seamlessly across all environments to give you consolidated protection. 

Integrated platform coverage must include Google Search, Google Search Partners, GDN, DV360, Facebook Audience Network, FB.com, YouTube, Bing, affiliate and direct publisher networks.