Fake clicks
Bot clicks on feed ads
Software, not a person, clicks the sponsored listings on a search feed page so that the page owner earns a share of each paid click.
How it works
A search feed pays a publisher each time a visitor clicks a sponsored listing. The advertiser pays for that click because they expect a person who typed or chose a search and wants what the ad offers. A bot click breaks that promise: a program loads the page, "chooses" a keyword and clicks an ad, and nobody ever reads the advertiser's site.
Think of a market stall paid by a brand for every shopper it sends to the brand's shop. If the stallholder sends mannequins on wheels, the brand pays for footfall that can never buy. Modern bots are harder to spot than mannequins: they run real browsers, pause, scroll and arrive from ordinary home internet connections.
The search engines filter these clicks before and after billing. What slips through at first is usually caught later, when advertisers' own data shows the clicks never convert, and the money is taken back as a clawback.
Who pays for it
First the advertiser, who is billed for a click with no customer behind it. Then the honest arbitrageur and the feed provider: when the search engine detects the pattern it deducts the revenue, lowers the partner's traffic quality score or closes the feed, often for every publisher sharing that account.
Who does it, and why
Feed publishers trying to inflate earnings, traffic sellers who promise "search visitors" at prices too low to be real, and botnet operators who sign up as publishers under false identities. The incentive is simple: every fake click is paid at the same rate as a real one until it is caught.
Warning signs
- Ad click rate on the feed page far above the norm for the keyword, with almost no advertiser conversions.
- Clicks arriving in evenly spaced bursts or at hours when the targeted country is asleep.
- Many visitors with identical browser, screen and language settings.
- A widening gap between estimated revenue and finalised revenue.
- A traffic source that cannot say where its visitors come from.
Defences
- Filter traffic before it reaches the feed page (pre-click filtering) and review what happened afterwards (post-click analysis).
- Buy only from sources the feed has approved, and tag each one with its own Channel ID so a bad source can be isolated.
- Watch conversion signals the search engine shares, not only click counts.
- Score every source continuously; ClearTrust's TQI Score™ is one such index built from bot and fake-click filters.
An example
Real case: in 2006 Google engineers tracked Clickbot.A, a botnet of more than 100,000 infected PCs that clicked ads on small search sites its operator had registered with syndicated search engines. Each machine clicked rarely, so none stood out. Google marked the clicks invalid and estimated the upper limit of the damage to its advertisers at about $50,000.
Documented cases
- Clickbot.A (2006): Botnet click fraud aimed at syndicated search engines
- ZeroAccess (Sirefef) (2013): Peer-to-peer botnet for search hijacking and click fraud
- Bamital (2013): Search-hijacking and click-fraud botnet