Fake visitors
Device and location spoofing
A visit lies about what it is: it claims to be a new iPhone in New York when it is an emulator or cheap device somewhere else.
How it works
Every visit announces details about itself: device model, operating system, browser, language, sometimes location. Search advertisers bid more for some combinations (a current phone in a wealthy country) than others. Spoofing means editing those announcements so cheap or fake traffic is priced as expensive traffic.
Because the announced details are just text, they are easy to change. Fraud detection therefore compares the story with physical evidence: does the screen behave like that phone model, does the network route match the claimed city, do the fonts and graphics hardware fit the claimed system? Device fingerprinting is the practice of collecting those small facts.
Who pays for it
Advertisers overpay for the wrong audience. Arbitrageurs overpay their traffic source for "tier-1" visits that the feed then values as lower tier or invalid.
Who does it, and why
Traffic sellers turning low-value inventory into premium-priced inventory, and bot operators disguising automation.
Warning signs
- Device claims that do not match measured screen size, touch support or hardware.
- One device ID or fingerprint appearing with many different claimed models.
- Claimed country differs from network location or time zone.
- A source whose device mix is suspiciously perfect for the campaign targeting.
Defences
- Check consistency between claimed device, measured device and network location.
- Compare the feed's reported country split per source with what the source claims to sell (Tier 1 / Tier 2 / Tier 3 geos).
- Pay for traffic by outcome where possible, so mislabelled traffic earns the seller less.
An example
Illustrative: a source sells "US iPhone" visits at $0.05. The feed's country report shows 70% of that channel's ad requests from outside the US, where RPC is a tenth of the US figure. If US clicks earn $0.50 and the others $0.05, the blended value is 0.3 × $0.50 + 0.7 × $0.05 = $0.185 per click, not $0.50, and the campaign that looked profitable on paper is not.