Dr. Augustine Fou is an Ad Fraud Investigator, Marketing Sciences Consulting Group. He talks about ad fraud, sharing the scope and the drivers of the problem for the advertising industry and sharing the issues that encourage the growth of ad fraud. He discusses the essential role marketers play in addressing the ad fraud problem, along with the media agencies, ad tech companies and even the private equity investors. He also offers practical solutions for reducing it.
You can listen to the podcast here:
Welcome to Managing Marketing, a weekly podcast where we discuss the topics of interest to media, marketing, and advertising.
Today I’m in New York City and having a conversation with Dr Augustine Fou who is the ad fraud investigator from Marketing Sciences consulting Group. Welcome, Augustine. Or should I call you Doctor?
Doctor’s great. But thank you very much; glad to be here.
The ad fraud investigator. There are a lot of companies out there that say they measure ad fraud. What’s the difference between measuring ad fraud and investigating ad fraud?
Very simply, it’s technology plus a methodology. You need the technology to collect the data but you also need to know how to look at the data and where to look. The bad guys are very good at tricking measurement. They’re now able to make the bot look perfectly human.
In fact, they now even spoof mouse movement, page scrolling and clicks so unless you know how to tell it apart from real human activity on a web page or mobile app it’s very hard to detect it using technology alone.
So, the difference between the fraud detection technology companies is that they try to build in the algorithms that look for anomalies but the investigation part is I look at the data, interpret it and look for other things that the technology may not be able to catch.
The thing about the crime of fraud, generally, not just ad fraud; the most successful fraudsters were the ones who were never detected.
Correct. It’s the amateur bad guy who goes out and uses a stolen credit card to buy a TV. They’re going to get caught and that credit card is going to be turned off the next day. But the more sophisticated ones are already in the system. They’re making money and they’re able to stay hidden. And the longer they can stay hidden the more money they can make.
So, the more advanced cyber-criminal committing this type of fraud will try to stay hidden as long as possible. So, it’s their first job to avoid or trick detection to make it look like everything is fine.
Because if people don’t know they’re being defrauded they just keep going. And we’ve seen investments into online advertising in all its forms continuing to increase even though the conversation around ad fraud is continuing.
Because they’re willing to suspend disbelief and to believe everything is going great. The way I see it as a digital marketer for 23 years—this is my industry and I’m very sad that it is not the digital marketing it could be.
The reason I say that is as more and more of these dollars shift in from other channels; TV, print and any kind of offline channels—in the US we surpassed 100 billion and we’re on track to hit 120 billion additional ad spending this year. Worldwide it’s approaching $350 billion in digital ad spend.
So that is a bucket of money that gets renewed every single year. It’s not just a finite bucket; it gets renewed every single year and because ad fraud can be committed from the comfort of the bad guy’s home it’s far easier to do and more people are doing it. And because of the dollar amounts you can imagine that organised crime is getting in on it as well.
And that for me was the really concerning thing. I know it’s very difficult to put a dollar value on the size because the size of the pool keeps expanding across all different channels. Even amongst display you’ve got private markets versus open and real time bidding.
The statement that this is globally second only to illicit drugs and close to human trafficking, which are two terrible crimes against humanity and it’s up there with those types of crimes.
When I last looked about a year ago ad fraud was already bigger than both of those. The reason for that is it’s annually replenished by the big advertiser’s budgets. It’s like counterfeit goods. If you have a counterfeit handbag you have to actually sell it. You have to have tourists visit Canal Street here in New York to buy those counterfeit handbags.
Or Shenzhen in China or parts of Hong Kong.
But in digital there are not even these physical constraints. They can generate countless, unlimited ad impressions. The bad guys are creating the exact thing you want to buy. So when big brand marketers want to buy more reach and frequency in the form of ad impressions they’ll just go and generate as many ad impressions as you want to buy.
We’ve seen data that shows there just aren’t many humans spending that much more time on their devices looking at more web pages to generate that many more impressions. That has all plateaued. I published some recent data from Pew Internet which tracked human use of the internet, mobile and social over 20 years.
And pretty much since the year 2013 all those lines have plateaued. Yet digital ad spend continues to skyrocket so how is that possible?
Almost exponentially as well.
Right. It’s not supported by human’s usage of the internet and social. So when the bad guys are creating these things; if marketers want to buy display ads they’ll just generate more display ads, if the search marketers want to buy more clicks they’ll generate more clicks.
Do you think part of this is it’s largely hidden and in some ways people would say it’s a victimless crime because the only people who are wasting their money are the major advertisers. But we all end up paying for it don’t we?
That’s a common argument; it’s the big companies that are losing millions of dollars so if they don’t care about ad fraud why should you? The government and law enforcement take that attitude as well. Ad fraud is not illegal and that’s because the laws have simply not caught up.
So, there is no law against ad fraud but that doesn’t mean it’s not fraud. You need to interpret the counterfeit goods laws to apply to digital ads. Or there might be other things like securities fraud—when you have a lot of fake accounts that are inflating your DAUs and MAUs that get reported by all these public companies—that could amount to securities fraud.
They are artificially propping up their revenues using bots and not humans. And when you see some of those growth lines that are perfectly straight, humans don’t move that way. It’s really hard to believe that all of these companies can be growing at such a high rate year after year, quarter after quarter for that long.
As more people start looking into it that’s been securities fraud for years.
Some of the most common ways that fraud occurs is around creating false traffic so that you can then sell that false traffic, and false clicks (bots). What are some of the ways these fraudsters are fleecing the major marketers?
Well, firstly, who are the bad guys? There are not 1,000s and 1,000s of hackers. There only need to be a few hackers who can make the bot nets that are maintained to generate this enormous amount of traffic and clicks. There are only a few hackers who are sophisticated enough to build those bot nets.
You’ve heard of the ones made out of mobile devices, malware on your computers, and even IOT devices like your webcam. As long as those things have a processor in it and an internet connection it could be hijacked and used as a bot. The hackers make money by renting out their bot nets—how much traffic do you want to go to a particular site or how much usage on a particular app?
For the unscrupulous website publisher who is just out there to generate as much ad revenue as possible, not even to make real content; as long as the cost of the traffic is less than the revenue they can make from selling digital ads they’re just arbitraging a very handsome profit.
In that sense there are a few hackers that maintain these vast bot nets and these bot nets are similar to the DDOS ones that overwhelm a site with so much traffic that it goes down. But that wasn’t lucrative because you can’t make money from that.
But now if you point that traffic fire hose to sites with AdTech on it you can make a ton of money through the ad revenue. So that’s what’s going on. You have traffic resellers who buy low and sell high; they’re all arbitragers. And then there are those sites that want traffic because no humans are ever going to go there.
These are brand new sites that don’t have any content and no human is ever going to discover them. So, if you have no human audience you buy all the traffic. In some cases I’ve seen one bad guy is all three. So if they know how to make the bot nets and how to put up the websites and how to stick the ad tech on it they don’t need to pay anybody else to do it.
It’s almost like a house of cards and as long as the marketers continue to be willing to spend because they’re going after reach and frequency and where else can I buy a billion impressions? The bad guys love it; marketers are just handing them money.
I’ve had a number of conversations with regional CMOs who have asked me how much should I be spending on digital media compared to non-digital? Well that depends on your strategy, what are you trying to do? And they’re attracted to getting reach and frequency (such an old measure) but the cost per 1,000 was incredibly low and this is why they were attracted to it.
In their minds they were getting reach and frequency to millions of people at a very low CPM. It’s the wrong measure isn’t it?
It is and it’s basically numbers on a spreadsheet. It looks really good and some of the marketers today are too young to realise those are not realistic. There are a couple of things here. They’re taking this old TV mentality of reach and frequency into digital. The reason it doesn’t work in digital is that we no longer have the physical constraints of the physical world.
What I mean by that is in TV marketing there are only so many TV shows and only so many ad slots in those shows. There’s a limited supply. So when there is more demand basic laws of supply and demand mean prices go up. In the Super bowl here in the US there are a lot of marketers who want that so prices go up.
In digital there are no constraints in the physical world. There can be unlimited websites, ad inventory and the way we can tell that from a macro-economic perspective is in the last 10 years or so we’ve seen massive dollars shifting into digital you would have expected prices to go up because that’s demand.
However, we’ve actually seen the supply go up even faster. On average over the last 10 years CPM prices have gone down. In the mid 90s when you had to pay Yahoo $35 CPMs, now you’re able to get a lot of inventory for 30 cents (1/10 or 1/100th of what it was). That’s because supply grew even faster than demand.
But ad tech people have said to me but yes, supply is increasing exponentially. Even though the population is limited, the markets that are getting Smartphones and internet access means that the 7 or 8 billion people is now increasingly online so of course usage curves are going to go up.
To me that’s not even plausible anymore. They used to be able to say that in the early days of the internet but if you look at the human population and the people who can afford Smartphones because they have disposable income that they don’t have to spend on food to survive and then the markets that have internet connectivity.
I look at the Pew internet studies where they study humans accessing the internet, mobile and social–they’ve been doing that for 20 plus years and in recent years all of those lines have plateaued so the number of humans using digital things is not growing exponentially. In fact it’s plateaued yet the digital ad spending is continuing to skyrocket. So that’s the disconnect that I’m talking about.
So, in my estimation it’s not humans it’s something else that’s generating all these ad impressions but again there are vested interests that want to see it continue because the venture capitalists and investors that invest in these companies need to see those hockey stick charts otherwise they can’t sustain these massive valuations.
One of the things I noticed when the internet started around the mid 90s, in the early part of this century everyone was talking about commercialising the internet on a one to one basis, how good the internet was going to be at targeting and engaging with people and to be able to do that on scale.
Except that somewhere around the global recession, around 2007, suddenly the talk was about mass audience delivery at low cost; it was less about engagement so it was about scale. What I think was driving that was people had put lots of money into things like Facebook and Google and now they were wondering when the return was going to come.
You had to see the Facebook MAUs and DAUs continue to skyrocket and they could say ‘we’ve got 1.3 billion people accessing it on a daily basis’. That was plausible for a while but no longer. In the years since you’ve seen more and more cases of mass purges of fake accounts. They now realise some of these were made by bots, they’re not real.
And in the early days of rapid growth no one wanted to look at those problems. Everyone wanted to keep growing so they could make more money.
You mentioned the purges and I remember when Facebook dumped some 300 million fake users and yet revenues continued to go up. If a TV station or newspaper announced that 20% of their audience had disappeared because they were fake there would be a backlash but investment continued.
Because no one, the marketers, AdTech companies, wanted to look. In 2017, 2018 over about 6 months Facebook purged 1.2 billion accounts.
Which would have been 50%?
Yeah, it was a very large number. At the time they were down to 2. something billion daily active users so the numbers were enormous but no change to their business outcomes and they didn’t go back and restate all of their quarterly filings to reflect all of the fake accounts and the DAU charts.
That’s why I called it securities fraud. Something’s going on there that is not real, that’s been propped up artificially through fake accounts. But the marketers are still willing to buy it because they want the reach and frequency. In fact some of the incentives systems in the big companies are misaligned in that they goad the marketer; the marketer is told you have to spend it all by the end of the year otherwise you won’t get as much budget next year.
So the marketer wants to buy as much stuff as they can and it’s the opiate of the marketers because when you have something you can buy more and more of and it costs you less and less that’s a drug you can’t wean yourself off.
If your agency keeps telling you we can get 10 billion more impressions next quarter and the cost is going to be lower, what are you going to do? You’re going to buy it because you get increased reach and frequency. When you have done that for a few quarters you’re not going to be able to stop because if you do stop suddenly, the quantity you can buy is going to be half or less than what you had bought.
And you’re certainly not going to admit that to your boss and lose your job over it.
A CMO said to me she felt like she was sitting in the back seat of a car going very fast down the highway driven by her advertising agency and all the lights were turned off at night so it was nothing but blackness. And whenever she said to the agency what’s happening? They kept saying we need to go faster and put more money into digital.
And yet she felt she was getting less return. And I asked her ‘why don’t you sort this out?’ She said ‘How will I look? I’ve been on this ride with the agency for 2 or 3 years. For me to turn around now and confess I’ve been doing the wrong thing could mean my job’.
I hear that every day but the CMOs are going to lose their job anyway. When they get found out they’re going to be the scapegoat. If they themselves find out now and start taking action to make it better there will still be work for them to do by the time the CFO and CEO come knocking.
It is scary to look if you might find something you don’t want to see but my advice to CMOs is it’s better if they look now themselves rather than after the CFO comes knocking because now there are enough examples of where the fraud detection technology companies are not catching the fraud. That media agencies are relying on those fraud detection reports to tell their clients everything’s fine, keep buying.
The motivations are laid bare and the agencies need more spend to run through their pipes so they can make more money. They’re not out to help you do better business. The CMO needs to have the courage to take that first step to wean themselves off this drug addiction, first to admit there is a problem and then start taking steps. It’s not like we’re going to solve the fraud overnight or lop off 90% of the impressions.
In fact the way I work with marketers who actually choose to look is to take out the most egregious bad guys first—there’ll be domains that are 100% fraudulent, none of the traffic or impressions are generated by humans. The same thing with apps, flashlight or keyboard apps; all of those are generating billions of impressions and they’re loading it every hour of every day.
Some of those things when you look at the data it’s obviously fraud so you start cleaning that up, take out the top 5 or 10, the most egregious offenders; you can now start to clean your campaigns. And over time you’ll make your campaigns cleaner and cleaner.
The CMO is the one who initiates that process; they’re going to be the heroes instead of the scapegoat.
I hear a lot of finger pointing in the industry towards the agencies. They’ll do the right thing if they’re told to do the right thing but actually the financial model goes against them doing the right thing because they’re not getting paid for their services; they’re getting paid for the volume they put through.
I’ll say something quite controversial: the marketers need to take more responsibility and they need to pay their agencies better. It’s not paying the agencies for doing some of this programmatic stuff because the programmatic stuff should be automated. You need to pay the agency for their expertise.
In the Adage article recently the title was ‘I Indict the Holding Companies’ and I do indict the holding companies. The reason for that is the holding companies are trying to make as much money as possible so they can show the holding company that the stock price is going up quarter after quarter.
It’s the decisions at the holding company management level that misalign what the media agencies do for the clients. I don’t indict any of the people who work at the agencies because they are simply doing their job and what they’re told.
There have been many stories over the years where somebody who works at a media agency sees something really strange; they can see the fraud. They want to tell the client but they’re told to be quiet and their job is at stake.
I wrote an article for The Drum saying there are two levels of truth here; an institutional truth, the one taking the hammering because it is the holding companies who are answering to their shareholders not the clients.
Whereas you get to a certain level in the hierarchy, the more someone has direct face to face interaction with the client the greater the level of trust and truth because that’s the fundamental point of performance isn’t it?
Yeah, and they’re in the trenches every day, they actually see the data and they can tell something’s wrong. But if they say something, that’s a threat to the revenue streams of the holding company so they’re told not to say anything.
But how accountable are the AdTech companies? We know that in the digital supply chain there are a number of players involved and they must also be incentivised to have as much traffic and volume going through?
To put it simply; they have no incentive to actually solve fraud. They really don’t even have any incentive to look. Even though they have security and anti-fraud teams they’re just looking casually. But until a 3rd party brings them incontrovertible data that says this is fraud they’re not going to do anything.
Why do anything if no one’s even asking about it? We’ve seen many cases of this. Craig Silverman, investigative reporter who writes for BuzzFeed, he’s outed some of these very large ad fraud schemes. It could be a public Chinese company that’s using keyboard apps to commit ad fraud.
Again, all of this is happening in broad daylight but until someone calls it out—it was someone outside the industry, an investigative reporter who actually did the work and found out who was doing this, called it out and when the data was presented to the ad exchanges and ad networks they had to kick it out.
They couldn’t justify continuing to let it go so they kicked them out but why didn’t they kick them out sooner? It is pretty evident some of this data doesn’t look right. When you have a website that started a month ago and all of a sudden it’s selling a billion impressions a day, something’s wrong. Common sense will tell you if you choose to look at the data.
The other excuse you often hear is that there is so much data; that the systems, platforms produce so much information. One of the complaints from a lot of the media agencies is that there is a requirement from their marketing clients to produce all these reports but the reports are largely a dump of that behaviour in a PDF.
Yeah, it’s completely and utterly useless. And all of that data is irrelevant so it gets back to knowing where to look and what to look for. A simple example from Google Analytics; if you see that traffic coming from a single source has either 100% bounce rate or 0% bounce rate, common sense should tell you something is wrong with that.
If you have a day or week’s worth of data, say you’re super conservative, and wait for a month’s worth of data and that traffic source continues to exhibit abnormal behaviour (100% or 0% bounce rate) then turn off that source. That’s all you have to do.
People are using it as an excuse; I’m afraid of all of this data. We couldn’t possibly ingest these petabytes of data per day; completely irrelevant and useless, you’re not going to be able to find anything from that big pile of crap. If you just look at your analytics and use some basic common sense you’ll be able to pick out the fraud.
The problem is most brand marketers don’t do that. They say my agency is supposed to do that. The agency person has worked so hard getting these campaigns launched—they don’t do that. Then they say we have fraud detection companies measure it for us and all of those companies say everything is fine. So who is going to make the effort to look further and do more work when no one’s complaining about it? So the cycle continues.
Have you heard of the saying (one of my favourites), the golden rule: the man with the gold makes the rules. So I would naturally say that the marketers are the people who should be making the rules about how digital marketing and the supply chain changes but it doesn’t seem to be happening.
We’ve seen ISBA in the UK, ANA here have all said it needs to be cleaned up but I’m not hearing a lot of conversations around the specific things we need to do to make it change. If anything I’m seeing optimistic reports about how it’s much cleaner than it was but it’s clearly not.
I think it also gets back to a fear of the unknown; they don’t know what they don’t know. And they don’t know what to do so therefore they’d rather perpetuate the current storyline. But my advice to CMOs and marketers is very simple: take a look and use common-sense.
In neither of those two points did I say use more technology because ad fraud is not a technology problem; it’s an incentives problem. The marketers need to spend it all so if I tell them there’s all this fraud over here there is less stuff for them to buy, you can’t spend it all so then they’re not doing their job.
So misaligned incentives and I would also say that the Trade Associations, for example the ANA, they literally don’t know what they don’t know because they’re relying on the reports from the fraud detection companies that are only looking for IVT (invalid traffic), they’re only looking for bots.
The problem with a lot of fraud detection is they don’t know what they’re missing because they don’t know what the bad guys are doing. To borrow a page from cyber security; you’ve heard of the term Zero Day, which means the first day you discover a particular exploit or malware. It’s not that that malware just got there; it’s the first time you’ve detected it but it’s been there all along.
The same thing with fraud; the good guys don’t know what they’re missing. It’s very hard to say this is the amount of fraud because you don’t know how much fraud you’re not accounting for. So what I’ve done in recent quarters is write about what I can measure or confirm. That’s very different from saying how much bots or fraud there is.
It’s more like I can actually confirm that there are 2% humans that saw your ad, that viewability is this. It’s really the opposite of it. Just like the blacklisting and whitelisting methodology; when you blacklist 1,000 sites, the bad guys will have another 1,000 or even 10,000 more sites.
So, if you try to use the blacklisting methodology there’s a vast ocean of other stuff you can never keep up with. Whereas if you use the whitelisting methodology and know that these are good publishers with human audiences going to their websites that’s a much more finite thing.
Similarly in fraud detection, it’s really hard to know if your fraud number is complete or not. That’s been my point for a very long time.
Because they can just reinvent themselves in any number of ways.
There are new forms of frauds you haven’t even accounted for.
Every time you close down one, 10 or 1,000 more pop up.
It’s the old whack a mole thing; it’s never-ending game. If you allow it to become a tech arms race the bad guys will always be ahead. They will always have better tech. Also think about the standards in digital and media. MRC (Media Ratings Council) they create standards but the potential negative effect of the standards is that these are goal posts that the bad guys can shoot for.
For example, the viewability one—50% of the pixels in view for one second. The bad guys know exactly where the goal posts are so they can tune their bots to hit exactly that so they can have 100% viewability all the time. So, the bad guys have goal posts whereas the good guys don’t.
For the good guys it’s what kind of fraud are the bad guys doing—they don’t know ahead of time. It’s asymmetric warfare and that’s why the bad guys always have the advantage. For the good guys it’s better to assume there’s something you’re missing as opposed to assuming fraud is solved. That’s the message from the ANA and is the exact opposite to what marketers need to be thinking about.
Instead of fraud is at its lowest point fraud is at its highest point and the marketers need to be the most vigilant they’ve ever been, not the least.
I read a report recently with the GDPR crackdown on data a lot of fraud is moving away from Europe into other markets. Is that true?
Here’s why it’s not true; who do you think gives consent? Humans or bots? It’s actually the bots. The job of the bots is to get more ad impressions. So, the bot gives consent so that more ads can be served to them. How many humans do you know who have actually given consent to an AdTech company for serving more ads to them?
In this case, because the bots have given consent there is even more fraud. If you do it correctly and only want to market to users who have given consent, you are now disproportionately marketing to bots rather than humans. Even though those bots are not caught or detected by the fraud detection companies.
You’ve just told me two things that are counterintuitive to the way I’ve been thinking. The first was around setting standards. In some ways setting a standard just helps the fraudsters doesn’t it?
It’s not to say standards are bad. We need standards otherwise it’s the Wild West. However, standards alone are not going to do anything to solve fraud. That’s a common misconception. If you think about the viewability thing again. Bad guys have higher viewability than good publishers because they’re tricking the viewability measurement.
They know exactly how to make the bot trick the viewability measurements so it comes out 100% viewable. Whereas for a good publisher—think about the layout of a page—you have 3 ads on the page-top, right, bottom (a simplistic example)—that’s already over 60% viewability.
So for a good publisher 66% viewability is not bad but if you notice over the years agencies will insist on 100% viewability; it’s actually exposing the marketer to more fraud because the only people who can have 100% viewability all the time are the bad guys.
That’s an example where the agency makes themselves look really good but in fact have exposed their client to more fraud not less.
One of the ways of overcoming the focus on performance—the marketers doing performance marketing where they’re looking and monitoring every impression to see not just click-through rates but leads and applications or purchase. Bots can’t purchase things or fill in forms can they?
They can and they do. They will do exactly the thing you’re willing to pay for. Take an example from mobile, some of the big advertisers, for example Uber. In their desire to grow as fast as possible they went out and paid all these mobile networks to get as many app installs as possible.
So what do you think those fraudulent mobile app networks did? They tricked the attribution systems to say we caused this many app installs. Those are all fake. What’s being revealed now in the Uber lawsuit is they’re going after the mobile ad exchange; ‘you guys falsified the records, these were not humans and in fact the app wasn’t even installed. All they did was trick the attribution system to make it look like the install happened.’
The bad guys will do the exact thing you’re willing to pay for. Uber is a performance marketer, doesn’t pay for impressions or clicks, we only pay when the app gets installed so the bad guys go out and make it look like the app got installed. Now, once the money has gone Uber has to sue to try to get the money back.
It’s not about doing away with performance. Performance has to mean business outcomes; sales in the offline world or something like that, not these fakable metrics like clicks or engagement or app downloads. Just to complete the circle. When you talked about sales, the bad guys are actually faking the sale.
There’s a loophole in the attributions systems where if you carefully construct a URL with all the right parameters you can actually make it look like a sale occurred when it didn’t and get paid the affiliate revenue share. And until the market does regular nightly reconciliation, because ecommerce systems are different from marketing systems, they won’t even know that they’ve been ripped off.
A lot of performance marketers I talk to assume they are immune from fraud. They are not. The only thing they need to do is not assume they’re immune from fraud and actually look at the data and see if the marketing drove real business outcomes.
Just to summarise; firstly, always be curious and wary and questioning. Secondly, look at your data with common-sense and logic and see if there are things that just don’t make sense.
So the next step, if there is a marketer who has done those two things and it’s got them to the point that they think there is a problem how can you help them?
The way I help marketers; think about it as an audit, basically an extra pair of eyes to look at their campaigns. A lot of these marketers have been told everything is fine but their gut tells them something is still strange, it doesn’t add up.
It’s to show the clients if there is a problem. In some cases when the marketer is very vigilant and they are looking at the data already and have very strict whitelists there may be very little additional fraud. It might be very clean and they’re doing O.K. and we’d like to know that too.
The bottom line for the marketers if they have been handing their dollars and budgets to their media agencies in the past is they should not assume it’s going to be O.K. even if all the fraud detection reports make it look like it’s O.K. it’s worth another look. So, that’s how I help the marketers; it’s an extra pair of eyes.
Augustine, this is a terrific conversation. Unfortunately, we’ve run out of time. There’s so much money in this and you’ve been a terrific gamekeeper; have you ever thought about becoming a poacher?
Ideal for marketers, advertisers, media and commercial communications professionals, Managing Marketing is a podcast hosted by Darren Woolley and special guests. Find all the episodes here