Anatomy of a click-fraud scheme

How a dishonest publisher hides fake and junk visits inside a search feed, who ends up paying, and the signs that give it away.

1. Paid per click, so clicks get faked: A feed pays whenever a sponsored result is clicked. An honest publisher earns that by bringing interested people. A dishonest one looks for the cheapest thing that resembles a click, which is click fraud.
2. Visits that cost almost nothing: The fraudster sources bot traffic, or people with no interest: pop-unders nobody asked for, or incentivised traffic paid a reward to click. A real interested visitor costs $0.20 in our example; these cost a fraction of a cent.
3. Blended with real visitors: Sent alone, fake visits stand out. So they are mixed with a layer of genuine traffic until the averages look normal (traffic blending), or passed through other sites first to hide where they came from (traffic laundering).
4. Searches and clicks nobody meant: On the page, the fake visits “search” and “click” sponsored results. Queries no human chose are query fraud. To the feed, each one arrives looking like an ordinary ad click.
5. The advertiser pays for nothing: Each click bills an advertiser about $1.00. No customer arrives, so its money buys nothing. Honest publishers in the same feed suffer too: when partner traffic converts poorly, engines pay less for all of it (smart pricing).
6. What gives it away: Reviewers look for clicks that never convert, visitors from data centres or a single device model, click rates that are too high and too steady, night-time activity as busy as daytime, and one-second sessions. No single sign proves fraud; together they form a pattern of invalid traffic.
7. Refunds, clawbacks and a closed account: When the engine acts, invalid clicks are credited to advertisers, the publisher’s revenue is clawed back and the feed is usually terminated (feed suspension). The feed provider above it can lose its contract as well.