#ad fraud

I'm on a tour with my new book, the international bestseller Enshittification: catch me next in Toronto (THURSDAY!), San Diego and Seattle! Full schedule here.

Being "the enshittification guy" means that people expect you to weigh in on every service or platform that has been deliberately worsened to turn a buck. It's an impossible task (and a boring one besides). There's too much of this shit, and it's all so mid – a real "banality of enshittification" situation.

So these days, I really only take note of fractally enshittified things, exponentially enshittified things, omnienshittified things. Things like the fact that Google is sending people searching for health care plans to "junk insurance" that take your money and then pretty much just let you die:

https://pluralistic.net/junk-insurance

"Junk insurance" is a health insurance plan that is designed as a short-term plan that you might use for a couple of days or a week or two, say, if you experience a gap in coverage as you move between two jobs. These plans can exclude coverage for pre-existing conditions and typically exclude niceties like emergency room visits and hospitalization:

https://www.brookings.edu/wp-content/uploads/2020/07/Broader-View_July_2020.pdf

Crucially, these plans to not comply with the Affordable Care Act, which requires comprehensive coverage, and bans exclusions for pre-existing conditions. These plans only exist because of loopholes in the ACA, designed for very small-scale employers or temporary coverage.

The one thing junk insurance does not skimp on is sales and marketing. These plans outbid the rest of the market when it comes to buying Google search ads, meaning that anyone who uses Google to research health insurance will be inundated with ads for these shitty plans. The plans also spend a fortune on "search engine optimization" – basically, gaming the Google algorithm – so that the non-ad Google results for health insurance are also saturated with these garbage plans.

The plans also staff up boiler-rooms full of silver-tongued high-pressure sales staff who pick up on the first ring and hard-sell you on their plans, deliberately misleading you into locking into their garbage plans.

That's right, locking in. While Obamacare is nominally a "market based" healthcare system (because Medicare For All would be communism), you are only allowed to change vendors twice per year, during "open enrollment," these narrow biannual windows in which you get to "vote with your wallet" against a plan that has screwed you over and/or endangered your life.

Which means that if a fast-talking salesdroid from a junk insurance company can trick you into signing up for a garbage plan that will leave you bankrupt and/or dead if you have a major health crisis, you are stuck for at least six months in that trap, and won't escape without first handing over thousands of dollars to that scumbag's boss.

Amazingly enough, these aren't even the worst kinds of garbage health plans that you can buy in America: those would be the religious "health share" programs that sleazy evangelical "entrepreneurs" suck their co-religionists into, which cost the world and leave you high and dry when you or your kids get hurt or sick:

https://armandalegshow.com/episode/is-it-ever-appropriate-to-fudge-a-little/

The fact that there are multiple kinds of scam health insurance in America, in which companies are legally permitted to take your money and then deny you care (even more than the "non-scam" insurance plans do) shows you the problem with turning health into a market. "Caveat emptor" may make sense when you're buying a used blender at a yard-sale. Apply it to the system that's supposed to take care of you if you're diagnosed with cancer, hit by a bus, or develop eclampsia, and it's a literally fatal system.

Performance Programmatic Platforms follow the same rules as traditional programmatic platforms, but the focus on performance campaigns is to optimize ad placements through real-time bidding and enable data-driven decision-making.

These platforms buy and place ads for advertisers with targeting functionalities, dynamic creative optimization, and performance analysis. As they market themselves, the entire process is ML and algorithm-driven. However, there is a prevailing myth that these platforms are fraud-free. Even MMPs are failing to do anything to curb these frauds because they have no protection at the impression level and minimum protection at clicks.

Many marketers still view ad fraud from a linear lens. They think bots are easy to spot, and platforms flag it. However, this assumption is no longer true.  

Over the years, advertising has transformed into a deeply interconnected, automated, and omnichannel ecosystem. Brands no longer run isolated campaigns. They operate across open web, apps, platforms, affiliates, influencers, CTV, and ecommerce media simultaneously.  

With this scale comes complexity, and with complexity comes a new class of ad fraud. One that hides deep inside the user journey, behaviour, blends into engagement, and surfaces only after real business impact has already been compromised. 

Many marketers still view ad fraud from a linear lens. They think bots are easy to spot, and platforms flag it. However, this assumption is no longer true.  

Over the years, advertising has transformed into a deeply interconnected, automated, and omnichannel ecosystem. Brands no longer run isolated campaigns. They operate across open web, apps, platforms, affiliates, influencers, CTV, and ecommerce media simultaneously.  

With this scale comes complexity, and with complexity comes a new class of ad fraud. One that hides deep inside the user journey, behaviour, blends into engagement, and surfaces only after real business impact has already been compromised. 

This means ad fraud is no longer a traffic problem. It does not operate in straight line. It moves across channels, adapts to campaign objectives, and embeds itself deeper into the funnel—quietly influencing optimization, attribution, and budget decisions. Therefore, to protect campaigns, brands need ad fraud solutions that must follow the full campaign journey, across environments and down the entire funnel to detect ad fraud. This is precisely where mFilterIt’s advanced ad fraud solution is designed to operate. 

How Ad Fraud Has Evolved and Why Omnichannel Protection Is the Foundation of Modern Fraud Prevention 

Sophisticated invalid traffic is engineered to resemble genuine user behaviour. It mimics human interaction patterns, rotates devices, locations, and stays just below platform thresholds long enough to be considered legitimate. The goal is no longer just to generate fake clicks or installs; it is to influence how marketers optimize campaigns across multiple channels and platforms based on false data. 

As ad fraud evolved from a visible threat to a systemic risk, protection had to evolve as well, beyond basic checkpoints – invalid ad traffic validation, click fraud prevention, into continuous fullfunnel protection. 

At the same time, brands now run branding and performance campaigns simultaneously across web, app, programmatic, search, social, OTT/CTV, and affiliate ecosystems. In such a fragmented environment, fraud naturally migrates to the least protected channel. This makes omnichannel protection not a feature, but the foundation of effective, modern ad fraud prevention. 

mFilterIt’s Omnichannel Coverage: How Protection Works Across Campaigns and Channels

mFilterIt uses an advanced approach for detection. Instead of treating channels in isolation, the ad fraud solution aligns the detection process with campaign intent, environment-specific risks, and user journey stages, powered by a unified intelligence layer across the ecosystem. Here’s how it works: 

Web Traffic Validation: Branding Campaigns – Protecting reach, visibility, and brand exposure

Branding campaigns are often assumed to be low risk, as they are optimized based on CPM (impression) models and not for conversions. But in reality, they are highly vulnerable to fraud that drains budgets without triggering immediate alarms.  

Viewability, while widely used as a quality metric, is not a measure of authenticity. Bots and spoofed environments can easily generate viewable impressions that technically meet industry thresholds but are never seen by real users. At the same time, ads are frequently served on low-quality or made-for-ad environments where content exists solely to host ads, offering no real audience value. 

Moreover, when impressions are repeatedly served to the same users due to frequency cap violations, reach appears inflated while true exposure shrinks. In such scenarios, simply validatingimpression counts is not enough. Without deeper validation of where ads appear, how often they are served, and whether exposure is genuine, branding budgets risk optimizing for visibility metrics that look healthy but deliver minimal brand impact. 

Affiliate marketing, as a concept, is revolutionary. It enables businesses to make money by using the influence of popular online publishers. When the right affiliates are involved, affiliate marketing not only drives more sales, but also boosts long-term brand performance metrics like brand recall value and trustworthiness of the brand.  

At the same time, by design, affiliate marketing ensures the publishers bring their A-game in getting brands maximum visibility and ensuring their audiences view them in a positive light. After all, more sales also translate to better affiliate payouts for the publishers.  

Thanks to this symbiotic nature of affiliate marketing, it is nearly the perfect marketing activity. Nearly.  

For years, impressions and viewability have been the go-to metrics for evaluating campaign success. They help understand whether the ad was delivered and seen. But was it actually paid attention to?  

That is the real question. And that’s where the conversation is shifting. 

As brands expose themselves to more open forums like websites, apps, OTT, CTV, etc., they begin to look beyond visibility and focus on something far more valuable, i.e., attention measurement, meaningful human attention your ad received.  

You know you need an answer when your campaigns don’t perform as you expect them to. Or maybe they do perform, but just on dashboards? 

Click fraud is no longer limited to just basic bot traffic. In 2026, it has evolved into more sophisticated threats that many traditional detection tools are not equipped to identify. 

Fraudsters now deploy AI-powered bots that simulate real user behaviour to evade behavioural detection. They operate across performance marketing ecosystems, including Google Search, display, GDN, Pmax, Meta, affiliate networks, app install campaigns, lead generation, and re-engagement campaigns. 

According to mFilterIt, 18% of global digital ad traffic was invalid in 2025. Moreover, with global digital ad spend projected to reach $866.2 billion in 2026 and $916 billion by 2027, the scale of fraud opportunity is growing at exactly the same rate as advertiser investment. 

Therefore, the traditional method of identifying fraudulent clicks is not enough. Marketers need a tool that has advanced specifications that can help them stay ahead of such evolving threats. 

But the question remains, “What exactly should marketers look for in a click fraud prevention tool in 2026?” 

We have simplified this search for you in this blog. 

It breaks down:

What features should an advertiser prioritize in a click fraud protection tool? 

How is mFilterIt different from standard ad fraud detection solutions? 

Why isn’t click-level protection enough for web and app campaigns? 

So, if you’re comparing solutions or preparing to invest, this is the clarity you need to make the right decision. 

Key Features to Look for in a Click Fraud Protection Software

The right click fraud protection tool is supposed to give you actionable insights, measurable improvements, and cross-channel protection. Here’s what to expect from a tool that actually solves your business problems: 

Proactive Click Validation

Click fraud operates in milliseconds. Your click fraud protection tool should have the capability to detect fraud proactively before it reaches your deep funnel or MMPs. Click validation ensures invalid traffic is flagged and filtered before it drains your ad budget. Here are some checks that a robust solution must perform:  

Click Repetition Behavior: Spamming on the same Device ID, click and impression injections, IP address repetitions, clusters, and spikes  

Malicious IPs / VPNs: VPNs, proxies, and data center traffic should be identified in real time  

Invalid Device Make-Model: Invalid devices detected via User Agent analysis  

Invalid Geo: Non-applicable geographies flagged via IP address checks 

Multi-Channel Compatibility Across Performance Campaigns

Fraud is not confined to one platform.It spreads across Google Ads, affiliate programs, Meta, DV360, mobile app networks, and even OEM and influencer traffic. Your protection tool should have omnichannel compatibility to work seamlessly across all environments to give you consolidated protection. 

Integrated platform coverage must include Google Search, Google Search Partners, GDN, DV360, Facebook Audience Network, FB.com, YouTube, Bing, affiliate and direct publisher networks.  

Full-Funnel Traffic Scoring from Click to Conversion

Since ad fraud doesn’t stop at click, the right click fraud solution doesn’t just analyze a single click. It evaluates the entire customer journey from impression to post-click behaviour, and scores each interaction based on engagement, path anomalies, and conversion likelihood. This helps identify suspicious traffic that may initially look normal.

Here’s what full-funnel validation covers:

Impressions: Ad visibility and post-bid checks for invalid inventory. 

Clicks: Real customer clicks vs. bot-generated traffic. 

Visits: Actual customer visits vs. bot-simulated sessions, scored by intent. 

Leads/Events: Genuine leads vs. malicious leads; form submissions validated against bot detection and geo-IP matching. 

Purchase/Sale: Organic sales vs. falsely attributed conversions.

Behavioural & Session-Based Analysis for GIVT & SIVT Detection

Basic filters cannot catch sophisticated click fraud. It needs a deeper context, including behavioural and session-level analysis. The industry-standard classification splits invalid traffic into two categories:  

General Invalid Traffic (GIVT): Traffic from known crawlers and bots behaving in obviously non-human ways, easier to detect.  

Sophisticated Invalid Traffic (SIVT): Advanced ad fraud techniques like advanced bots, click spam, fake attribution, cookie stuffing, ad pixel stuffing, domain spoofing, fake clicks, click injection, punched leads, reseller fraud, duplicate users, and device farms, require ML and behavioural analysis for detection. 

Therefore, the advanced ad fraud prevention solution must analyze session depth, scroll behaviour, dwell time, bounce rate, and other engagement signals to understand true user intent. This helps distinguish a curious customer from a bot. 

The BFSI sector runs some of the most high-stakes digital campaigns in advertising. With customer lifetime values stretching across years of loans, credit cards, investments, and insurance renewals, every lead matters enormously. But that’s precisely what makes BFSI such a lucrative target for fraud. 

Performance campaigns in BFSI are built around a simple promise: pay per lead, optimise for cost per acquisition. It’s efficient in theory. In practice, it’s where exploitation begins. Because a bad click isn’t just a bad click — it travels downstream, pollutes the funnel, and contaminates every stage below it. Fake clicks become fake leads. Fake leads inflate CAC. And inflated CAC quietly bleeds campaign budgets dry. 

This blog covers – 

Why BFSI Brands Are Prime Targets for Lead Fraud  

Average Bot Traffic on BFSI Campaigns   

The Invisible Journey of Lead Fraud in BFSI   

How Lead Fraud Impacts BFSI Campaigns   

Why Surface Level Detection Falls Short 

What Smarter Click Fraud Detection Looks Like in BFSI   

Conclusion 

Why BFSI Brands Are Prime Targets for Click Fraud

Few industries spend on digital ads as aggressively as banks, insurers, fintechs, and financial services. The reason is clear: customer value in BFSI is unusually high. Hence the cost running campaigns is higher. 

A single customer can generate returns for years through loans, credit cards, investments, insurance renewals, or financial subscriptions. 

Because of this, keywords like “instant loan,” “credit card instant approval,” “trading app,” and “term insurance” often carry some of the highest CPCs in digital advertising. 

For fraudsters, that creates a perfect setup. The higher the cost per lead, the more profitable fake leads become. 

Fraud networks know BFSI brands can’t slow acquisition cost, especially during festive seasons, loan drives, tax-filing months, or insurance renewals. That’s why BFSI campaigns often attract unusually high levels of invalid traffic, fake installs, and manipulated engagements across both web and app ecosystems. 

What makes it worse: today’s fraudulent activity rarely looks obviously fake. It blends into normal user behaviour, making detection far harder than before. 

The Scale of the Problem: Bot Traffic on BFSI Campaigns

On BFSI campaigns, bot and invalid traffic routinely accounts for a significant share of total traffic often sitting well into double digits. 

The above table reveals a far more serious reality for BFSI advertisers globally.  

Bot traffic for different BFSI campaigns ranged from 9% to 28% of total campaign traffic. It is not a minor inefficiency; it contributes to click fraud and later contributing to lead fraud, a massive setback for brands.

In BFSI, losing nearly one-fourth of campaign traffic to bots means brands are potentially pouring millions into fake engagement, distorted performance metrics, and audiences that never truly existed. 

The Invisible Journey: How Click Fraud Becomes Lead Fraud in BFSI

BFSI marketers are accountable for metrics that sit deep in the funnel: 

Cost per approved loan 

Cost per activated credit card 

Cost per funded account 

Cost per issued policy 

These aren’t click metrics. They are business outcomes. Which is exactly why click-level fraud gets missed for so long, it enters at the top and the damage only becomes legible at the bottom, by which point the cause is buried under months of campaign data. 

The journey looks like this: 

Impression → Fraudulent Click → Fake Lead → Inflated CAC → Low Conversion → Revenue Gap 

Three Ways the Funnel Gets Exploited

Fake Leads

Bots or traffic farms fill out lead forms with fabricated or recycled personal data. These submissions pass basic validation — name, phone, email format checks — but carry no intent. They exist only to trigger the publisher’s payout. 

Punched Leads