Ad Fraud and Bot Traffic: How to Spot Fake Results

What is ad fraud?

Ad fraud is any trick that makes you pay for advertising results that no real, interested person produced. It might be a bot clicking your ads, a rack of phones installing your app, a script filling your sign-up form, or a real person creating throwaway accounts to collect a reward. The money goes to whoever runs the scheme, and your reports fill up with numbers that will never become customers.

It turns up in every channel and every country. Estimates of how much traffic is fake vary widely, and no single figure fits every channel, so the more useful question is not how common fraud is in general but how much of it reaches your own campaigns. That part you can measure, and mostly control.

The most common types of ad fraud

• Bot traffic. Automated scripts visit pages, click ads, and sometimes fill forms. Simple bots are easy to spot, while advanced ones imitate mouse movements and real browsers.
• Click farms. Groups of people or racks of devices click, install, and sign up by hand for very little money each.
• Click spamming and click injection. Fake clicks are fired in the background so that a fraudster can claim credit for installs or sales that would have happened anyway.
• Hidden and stacked ads. Display ads are loaded in invisible frames or piled on top of each other, so you pay for impressions nobody could see.
• Domain spoofing. Low-quality sites pretend to be well-known publishers to sell their inventory at a higher price. The IAB Tech Lab’s ads.txt standard lets publishers list who is authorized to sell their ad space, so buyers can check a seller before they pay.
• Fake leads and sign-ups. Forms are filled with invented or stolen details, often to collect a per-lead payment.
• Reward abuse. On incentivized traffic, one person uses many accounts, or fakes the paid event with throwaway sign-ups or trials cancelled at once, to collect the same reward several times.
• Location fraud. VPNs and proxies make traffic appear to come from a high-paying country.

Warning signs of bot traffic in your data

Fraud rarely gives itself away in a single result. It shows up as patterns real people do not produce:

• Timing that is too perfect or too fast: sign-ups every 30 seconds, installs within seconds of the click, or in-app goals reached faster than anyone could actually play or use the app.
• Repeats from the same IP address, device model, or email pattern, such as name123, name124, and name125.
• No engagement afterwards. Users never log in again, never open the app a second time, or never click the confirmation email.
• Data center addresses, meaning traffic from hosting companies instead of home and mobile internet providers.
• Location mismatches, like a user in one country with a phone language, time zone, or currency from another.
• Sudden spikes from one source that do not match any change you made.
• Conversions with no match in your own records: results a source reports that have no real user, order, or event in your database.

How to check your own traffic

1. Split results by source. Fraud usually concentrates in one network, site, or campaign, and averages hide it.
2. Follow users past the result. Compare day 7 activity, purchases, or email opens by source, because real users do something after they arrive.
3. Look at the raw records for a sample of results: times, IPs, devices, and what each user did afterwards.
4. Add a hidden form field that people cannot see but simple bots fill in, and discard any submission that contains it.
5. Require email or phone confirmation before a sign-up counts as a result.

How to protect your ad budget

Most of these steps cost nothing and work even on a $50 test. Start with the first two, since they shift the risk before any money leaves your account.

• Pay for results your server confirms. Paying per conversion that your own tracking records, rather than per impression or click, moves most of the fraud risk away from you.
• Check before you pay. Count a result only once your own system has confirmed it, for example after the email is verified or the app is opened a second time.
• Pay for an event that is hard to fake, such as a confirmed email, a second app session, a reached level, or a first purchase, rather than a bare install or form fill.
• Cap spend per hour and per day, so a sudden wave of fake results cannot drain the budget.
• Verify postbacks with a signature so nobody can report conversions that did not happen. See What is a postback URL?
• Buy from sources that explain their checks, and be suspicious of prices far below everyone else’s.

What publishers and rewards sites do

Honest publishers lose from fraud too, because advertisers pay less for traffic they cannot trust and reverse results they reject. Good rewards sites therefore check users before the advertiser ever sees them: they detect VPNs and proxies, fingerprint devices to stop multiple accounts, hold new earnings for a while, and review large withdrawals. Moonetix publishers follow the traffic quality rules.

How Moonetix handles fraud

Advertising on Moonetix runs through custom integrations, and the fraud protection is part of that setup. Our team reviews every offer before it goes live. Your offer appears on the offerwall of publisher websites, apps, and communities, where users must be real people, and the wall blocks VPN, proxy, Tor, and datacenter traffic before anyone sees an offer. Automatic fraud checks run on the traffic as well.

The strongest filter is how conversions are counted. They come from your own server-to-server postback, so you decide which event counts and you pay only for the conversions your postback confirms, never for impressions or clicks. A sign-up that never confirms its email, or an install that never opens the app, simply is not reported. Read How Moonetix checks traffic quality and why paying only for results protects your budget.

Frequently asked questions