2026 Edition
The Ad Fraud Dictionary
Every scam against your ad spend, explained in plain English. With the fix included.
39
fraud types, decoded
4
channels protected
0
jargon required
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
.png){kind=icon}
Ad injection
noun. Ads where no ads should be.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I paying for clicks from placements that should not even exist?”
you, probably, at some point this quarter
WHAT IT IS
Ads inserted into websites without the publisher's consent, usually by a browser extension, plugin or app working quietly in the background. Injected ads cover the site's real ads, replace them entirely, or appear on pages that never sold advertising at all.
IN PLAIN ENGLISH
graffiti, except it is billboards, and someone is charging you rent for the wall.
HOW IT WORKS
1
A user installs a free extension or app bundled with injection software.
2
As they browse, it inserts ads into pages without the publisher's knowledge.
3
Injected placements cover legitimate ads or invent slots that never existed.
4
Impressions and clicks bill as if all of it were real inventory.
SPOT IT IN THE WILD
Placements reported on sites with no ad slots to sell.
Publishers disputing ads they never served.
Placement performance nobody can reproduce by visiting the page.
THE TRAFFICGUARD FIX
Ad injection is one of the sophisticated invalid traffic types TrafficGuard detects and invalidates in real time, so engagement produced by injected inventory is identified before it wastes spend or feeds your optimisation.
Certified Fraud
Ad stacking
noun. Also answers to: ad layering, install theft.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How does one tap fire five ads?”
you, probably, at some point this quarter
WHAT IT IS
Multiple ads layered in a single slot so only the top one is visible. One genuine tap clicks every hidden layer underneath, and whichever buried click best matches a later install or sale collects the credit.
IN PLAIN ENGLISH
ten raffle tickets stapled behind one, all filled in with someone else's name.
HOW IT WORKS
1
A fraudulent publisher stacks several ads into one placement. 2
2
A user sees one ad and clicks once.
3
Every hidden layer registers its own click at the same instant.
4
When the user later converts, a buried click steals the attribution.
SPOT IT IN THE WILD
Multiple clicks from the same user at the same moment, across campaigns.
Flat click-to-install time distributions.
Impression volumes out of all proportion to visible slots.
Certified Fraud
Adware and malware
noun. The uninvited software economy.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How does software on a stranger's phone spend my ad budget?”
you, probably, at some point this quarter
WHAT IT IS
Unwanted software on real devices that generates ad activity in the background: fake clicks, hidden ad loads, even fraudulent install claims. The device is genuine and so is its owner. The engagement is anything but.
IN PLAIN ENGLISH
a stowaway running up the minibar bill in someone else's hotel room, with the invoice sent to you.
HOW IT WORKS
1
A user installs a free app or download that arrives bundled with adware.
2
The software runs quietly in the background of an ordinary device.
3
It fires clicks, loads ads nobody sees and claims credit for installs.
4
Every fabricated event lands on an advertiser's bill. Usually yours.
SPOT IT IN THE WILD
Clicks from devices with engagement patterns no human produces.
Bursts of activity traced back to a single app or download source.
Installs that users have no memory of making.
THE TRAFFICGUARD FIX
TrafficGuard recognises the behavioural and technical fingerprints of adware-driven activity and invalidates it at the source, before it reaches your reporting.
Certified Fraud
App install farms
noun. Racks of phones with a payroll.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Who is actually installing my app ten thousand times?”
you, probably, at some point this quarter
WHAT IT IS
Rooms of real devices operated by real, low-paid workers who install apps, complete onboarding and imitate early engagement. Then the devices are wiped, given fresh identities, and sent through the line again.
IN PLAIN ENGLISH
a gym paying people to walk in, take the tour and leave, so the membership numbers look magnificent.
HOW IT WORKS
1
An operator sells app installs by the thousand.
2
Workers cycle through racks of devices, installing and opening your app.
3
Device IDs are reset and the whole production line repeats.
4
Your cost-per-install budget funds a warehouse's shift work.
SPOT IT IN THE WILD
Bursts of installs from tight geographic clusters.
High proportions of freshly reset or brand-new device IDs.
Engagement stopping at exactly the event that triggers payout.
THE TRAFFICGUARD FIX
TrafficGuard reads device, location and behavioural patterns together, recognising production-line installs and invalidating them before payout.
Certified Fraud
Auto-refresh
noun. The impression treadmill.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I paying for ads nobody had time to see?”
you, probably, at some point this quarter
WHAT IT IS
Publishers refresh ad slots on a timer or on user actions, cramming several 'impressions' into a single page view. Refresh fast enough and no ad is on screen long enough for a human to register it, but every rotation bills on a CPM model regardless.
IN PLAIN ENGLISH
a billboard that changes every two seconds, on a road where each car passes once.
HOW IT WORKS
1
A publisher sets aggressive refresh intervals on its ad slots.
2
One page view serves a rotating stream of ads.
3
Each rotation logs a billable impression.
4
Advertisers pay for exposures too brief for anyone to notice.
SPOT IT IN THE WILD
Impression volumes far beyond realistic page views.
Vanishingly short time-on-screen per impression.
CPM spend climbing while response stays flat.
THE TRAFFICGUARD FIX
Impressions that engagement never follows are the tell. TrafficGuard classifies auto-refresh abuse as sophisticated invalid traffic and detects it in real time, invalidating inventory that racks up exposures no genuine attention could explain.
Certified Fraud
Bots
noun. Official taxonomy name. Street name: bot traffic.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Are bots really clicking my ads, or am I paranoid?”
you, probably, at some point this quarter
WHAT IT IS
Automated software that loads pages, clicks ads, fills forms and even fakes conversions. Basic bots are clumsy scripts. The sophisticated ones scroll, pause, move the mouse like a human and defeat simple filters entirely.
IN PLAIN ENGLISH
you are not paranoid. A meaningful share of the traffic on the internet is not human at all, and it does not buy anything.
HOW IT WORKS
1
Operators deploy scripts, headless browsers or networks of infected devices.
2
The bots crawl search results and social feeds, clicking paid placements as they go.
3
Every click charges your account and writes a fake data point into your analytics.
4
The ad platform optimises towards whatever the bots keep clicking. It gets worse on autopilot.
SPOT IT IN THE WILD
Traffic spikes at hours when your customers are asleep.
Sessions that bounce in under a second, at scale.
Conversion events that never turn into revenue.
THE TRAFFICGUARD FIX
TrafficGuard verifies clicks and impressions against device, network and behavioural signals, invalidating non-human activity in real time across all four channels.
Certified Fraud
Click farm
noun. Fraud, but artisanal and handmade.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“What are click farms, and how do they end up on my campaigns?”
you, probably, at some point this quarter
WHAT IT IS
A room full of low-paid workers, or racks of phones running scripts, paid to click ads, like posts and install apps. Because real fingers touch real screens, click farms sail past filters built to catch obvious automation.
IN PLAIN ENGLISH
thousands of clicks for hire, none of them from a customer.
HOW IT WORKS
1
An operator sells clicks, installs or engagement by the thousand.
2
Workers or device racks receive target lists, including ads on your keywords and placements.
3
Clicks arrive from thousands of different devices, SIMs and IPs, so they look organic.
4
Your engagement metrics rise. Your revenue does not.
SPOT IT IN THE WILD
Engagement from geographies you have never targeted.
Suspiciously uniform device models and OS versions clustering together.
Sky-high CTR paired with zero downstream value.
THE TRAFFICGUARD FIX
TrafficGuard's multi-signal analysis reads behaviour, device and network patterns together to expose click-farm activity, invalidating it before it distorts your optimisation and keeping farmed installs from earning attribution or payout.
Certified Fraud
Click fraud
noun. The classic. The one your CFO has heard of.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I getting clicks but no real customers?”
you, probably, at some point this quarter
WHAT IT IS
Any deliberate clicking on pay-per-click ads with no intention of buying, done either to cost you money or to make someone else money. Bots do it, click farms do it, competitors do it. It is the umbrella over half this dictionary.
IN PLAIN ENGLISH
someone ringing your doorbell and running away, except every ring costs you the price of a click.
HOW IT WORKS
1
An actor with a motive appears: profit, sabotage or plain mischief.
2
They click your paid ads repeatedly, manually or at machine scale.
3
Your budget drains and your cost per acquisition climbs.
4
Worse, Smart Bidding learns from the junk clicks and optimises towards more of them.
SPOT IT IN THE WILD
CTR rising while conversion rate falls off a cliff.
Repeat clicks from the same device or network fingerprint.
Daily budget exhausted earlier and earlier each day.
THE TRAFFICGUARD FIX
TrafficGuard verifies every click as it happens, invalidates the fakes, keeps your optimisation signals clean and builds the evidence file for your refund claim.
Certified Fraud
Click hijacking
noun. Also answers to: ad hijacking, brand poaching.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Did that affiliate really earn the commission I just paid?”
you, probably, at some point this quarter
WHAT IT IS
Anything that steals a click in flight, or steals the credit for it. Malware intercepts genuine clicks mid-route and redirects or re-tags them. Rogue affiliates run lookalike ads on your brand terms and slip their tracking between the click and your site, collecting commission on customers who were already yours.
IN PLAIN ENGLISH
a courier who swaps the delivery label mid-route.
HOW IT WORKS
1
A user clicks an ad: yours, or a convincing copy of it.
2
Malware on the device, or an impostor's redirect, intercepts the journey.
3
The click is rerouted, or re-tagged with the hijacker's tracking ID.
4
Your visitor is stolen outright, or arrives with someone else invoicing you for the introduction.
SPOT IT IN THE WILD
Billed clicks that never arrive as landing-page sessions.
Affiliate revenue climbing while direct and brand traffic dips.
Ads you never wrote appearing on your own brand searches.
THE TRAFFICGUARD FIX
TrafficGuard validates the journey behind every attributed conversion, checking that credit traces back to a legitimate click path, so intercepted clicks, impostor ads and hijacked commissions are exposed before they are paid.
Certified Fraud
Click injection
noun. Attribution theft with a stopwatch.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why do my app installs all arrive seconds after a click?”
you, probably, at some point this quarter
WHAT IT IS
A fraud technique where malware hiding inside an innocent-looking Android app listens for new installs on the device, then fires a fake ad click moments before the install completes. The fraudster's click is now the last one, so they take the credit and the payout.
IN PLAIN ENGLISH
photobombing the finish-line photo and then claiming the medal.
HOW IT WORKS
1
A user unknowingly installs an app bundled with fraudware.
2
The fraudware listens for install broadcasts on the device.
3
Your genuine campaign wins a real user. As the app installs, the fraudware fires its own click.
4
Last-click attribution hands the fraudster credit for an install someone else earned.
SPOT IT IN THE WILD
Click-to-install times measured in seconds rather than minutes.
Installs credited to publishers who never showed an impression.
Install spikes correlated with specific Android apps in market.
Certified Fraud
Click spam
noun. Also answers to: click spamming, click flooding.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How is a publisher I have never heard of driving thousands of my installs?”
you, probably, at some point this quarter
WHAT IT IS
Fraudsters fire enormous volumes of fake clicks on behalf of users who never saw an ad. Then they wait. When any of those users installs the app organically, the fraudster's stale click is sitting in the attribution window, ready to claim the credit.
IN PLAIN ENGLISH
shouting 'that was me!' every time anyone, anywhere, scores a goal.
HOW IT WORKS
1
The fraudster obtains device identifiers at scale.
2
They programmatically register ad clicks for those devices, no ad ever shown.
3
A slice of those users installs the app on their own, days later.
4
The attribution platform finds the fraudster's click and pays them for your organic growth.
SPOT IT IN THE WILD
Click-to-install times spread flat across days instead of clustering in minutes.
Sources with millions of clicks, minimal impressions and a rounding-error conversion rate.
Paid installs cannibalising your organic install baseline.
Certified Fraud
Competitor click abuse
noun. Passive aggression, invoiced by Google.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Do competitors really click my ads on purpose?”
you, probably, at some point this quarter
WHAT IT IS
Yes. Rivals, or people they pay, click your ads to burn through your daily budget and push you out of the auction. Once your spend caps out, their ads inherit your position at a lower cost. It is one of the most common suspicions in PPC, and one of the most confirmed.
IN PLAIN ENGLISH
they are spending your money so that theirs goes further.
HOW IT WORKS
1
A competitor searches the keywords you both bid on.
2
They click your ad, manually or with rotating VPNs and devices to avoid detection.
3
Your daily budget exhausts hours early.
4
Their ad takes your slot for the rest of the day, cheaper than before.
SPOT IT IN THE WILD
Click clusters at the most auction-competitive hours.
The same behavioural fingerprint reappearing across supposedly different IPs.
Budget gone by lunchtime, conversions flat.
THE TRAFFICGUARD FIX
TrafficGuard fingerprints devices and behaviour, not just IP addresses, so repeat offenders are recognised however they disguise themselves, and their clicks are invalidated.
Certified Fraud
Compliance fraud
noun. Real users. Wrong users.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Is the traffic I am paying premium rates for really from my target market?”
you, probably, at some point this quarter
WHAT IT IS
Traffic deliberately sourced from outside your target audience, or through methods your programme forbids, then dressed up as the premium traffic you paid for. The click or install is made by a genuine person. Just not the person you were buying.
IN PLAIN ENGLISH
ordering the premium cut and being served whatever was cheapest, plated to look the part.
HOW IT WORKS
1
A partner buys inexpensive traffic from a market or method outside your campaign terms.
2
They obscure its origin, typically behind VPNs and anonymous proxies.
3
The disguised traffic enters your premium-rate campaign as if it belonged there.
4
You pay tier-one prices for users who were never in your target audience.
SPOT IT IN THE WILD
Unusually high volumes of anonymised or proxied traffic from a single source.
One partner's conversion quality collapsing while volumes hold.
A geo mix that never quite reconciles with campaign targeting.
Certified Fraud
Cookie stuffing
noun. Official filing: cookie stuffing, recycling or harvesting.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I paying commission on sales my own marketing won?”
you, probably, at some point this quarter
WHAT IT IS
A fraudster plants affiliate tracking cookies on people who never clicked an affiliate link, using hidden iframes, invisible images, pop-unders or shady browser extensions. If any of those people later buy from you, the fraudster's cookie is waiting to collect the commission.
IN PLAIN ENGLISH
slipping a business card into every wallet in town, then invoicing you whenever anyone shops.
HOW IT WORKS
1
The fraudster hides your affiliate links inside webpages, ads or browser extensions.
2
Visitors receive the tracking cookie silently. No click, no consent, no idea.
3
Some of those visitors buy from you later, through any channel at all.
4
Last cookie wins. The fraudster is paid for a customer they never touched.
SPOT IT IN THE WILD
Affiliates whose referred customers behave exactly like your organic ones.
Conversion rates implausibly high for the click volume reported.
Commission costs rising with no matching lift in new revenue.
THE TRAFFICGUARD FIX
TrafficGuard monitors click patterns across affiliate traffic and validates every click path, flagging referral clicks that fire moments before a purchase with no preceding engagement, so attribution stays with the partners and channels that genuinely drove the sale.
Certified Fraud
Domain spoofing
noun. MRC filing: falsely represented sites.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Is my ad really running on the sites I paid for?”
you, probably, at some point this quarter
WHAT IT IS
Fraudsters misrepresent low-quality or fabricated websites as premium, brand-safe inventory, so advertisers pay top rates for placements that do not exist as described. The MRC files it under falsely represented sites. Everyone else files it under expensive.
IN PLAIN ENGLISH
a market stall wearing a department store's name badge.
HOW IT WORKS
1
A fraudster sets up junk inventory, or hijacks the ad call of a legitimate page.
2
They declare a premium domain in the bid request.
3
Buyers pay premium rates for the counterfeit placement.
4
The ad runs somewhere nobody would have chosen, or nowhere at all.
SPOT IT IN THE WILD
'Premium' placements performing like your worst inventory.
Placement reports that do not match the publisher's own analytics.
Impossible impression volumes from a single site.
THE TRAFFICGUARD FIX
Spoofed domains betray themselves in the traffic they send: referrers that do not match the placement they claim to be, clicks that do not fit the audience a premium site would deliver, and conversion rates too good to be true. TrafficGuard reads those signals in real time and invalidates the traffic.
Certified Fraud
Duplicate clicks
noun. Reporting name: rate duplicate click GCLID.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Do double-clicks on my ad cost me double?”
you, probably, at some point this quarter
WHAT IT IS
Two or more clicks on the same ad instance, the same Google Click ID, inside the short window Google defines. Usually a right-click, a double-click or the back button; occasionally a crawler re-walking the same link. Google generally identifies these and does not charge for them, but they add no value and muddy your click data.
IN PLAIN ENGLISH
someone pressing the lift button five times. The lift was already coming.
HOW IT WORKS
1
A user double-clicks your ad, or bounces back to it with the back button. 2
2
Several clicks register against one GCLID within Google's window.
3
Google typically absorbs the charge for the extras.
4
The clicks still pollute frequency and engagement data.
SPOT IT IN THE WILD
Click counts running above sessions.
The 'rate duplicate click GCLID' reason in TrafficGuard reporting.
Bursts of same-instant clicks from a single user.
THE TRAFFICGUARD FIX
TrafficGuard identifies duplicates, removes them from most reporting, and keeps the pattern visible in the duplicate click report so noise never reads as demand.
Not Fraud. Still A Bill.
Emulators
noun. A thousand phones, zero handsets.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Can one computer pretend to be a warehouse full of phones?”
you, probably, at some point this quarter
WHAT IT IS
Software that imitates a mobile device on a server, letting one machine impersonate thousands of brand-new phones. Each fake phone installs your app, taps your ads and collects your cost-per-install budget.
IN PLAIN ENGLISH
a ventriloquist doing a thousand voices, all of them asking to be paid.
HOW IT WORKS
1
A fraud operation spins up emulated devices in bulk on rented servers.
2
Each emulator resets its identity to present as a factory-fresh phone.
3
The fake devices install your app and imitate early engagement.
4
The entire cohort goes silent the moment the payout clears.
SPOT IT IN THE WILD
Improbable clusters of brand-new device IDs from one source.
Identical hardware and OS profiles repeating at scale.
Retention curves that fall off a cliff after day one.
THE TRAFFICGUARD FIX
Emulated devices produce installs without lives behind them. TrafficGuard's install and post-install behavioural monitoring flags devices whose usage never resembles a real person's, and their installs are invalidated before payout.
Certified Fraud
Fake installs
noun. Downloads without people.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Installs are up. So why is engagement flat?”
you, probably, at some point this quarter
WHAT IT IS
The umbrella term for app installs generated by anything other than a genuine, interested user. Install farms, emulators, bots and SDK spoofing are different factories, but they all ship the same product: a number on your dashboard wearing a customer costume.
IN PLAIN ENGLISH
stadium tickets sold to cardboard cutouts. The seats are full. Nobody cheers.
HOW IT WORKS
1
A fraud operation picks its tool: farm, emulator, bot or spoofed signal.
2
Installs are produced at whatever volume the payout rewards.
3
Early engagement is faked just convincingly enough to pass basic checks.
4
Cost-per-install budget flows out. Lifetime value never flows in.
SPOT IT IN THE WILD
Install spikes with permanently flat revenue.
Cohorts with zero retention beyond the payout event.
Sources whose users never grant permissions, never purchase, never return.
THE TRAFFICGUARD FIX
TrafficGuard verifies installs across device, network and behavioural signals, separating manufactured users from real ones before the payout, not after.
Certified Fraud
Geo masking
noun. A fake passport for junk traffic.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Is international traffic more likely to be fraud?”
you, probably, at some point this quarter
WHAT IT IS
Fraud traffic disguising its true location using VPNs, residential proxies and data-centre routing, so it can qualify for geo-targeted campaigns it has no business entering. Your 'local' clicks may be arriving from the other side of the planet.
IN PLAIN ENGLISH
traffic wearing a costume of your target market.
HOW IT WORKS
1
Fraud operations route their traffic through proxy servers located inside your target geography.
2
The ad platform reads the borrowed IP and sees a qualified local user.
3
The click enters your geo-fenced campaign and is billed at local rates.
4
Your budget for one city is spent on nobody in that city.
SPOT IT IN THE WILD
Device language and timezone contradicting the claimed location.
Traffic arriving from data-centre networks rather than consumer ISPs.
Regions that generate clicks reliably and conversions never.
THE TRAFFICGUARD FIX
TrafficGuard combines IP intelligence with device and behavioural signals to unmask disguised traffic and invalidate it before it spends your geo budget.
Certified Fraud
Headless browsers
noun. A browser with nobody at the wheel.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How do bots browse without a screen?”
you, probably, at some point this quarter
WHAT IT IS
Real browser software running without a visible interface, driven entirely by scripts. Built for legitimate website testing, and beloved by fraud operations, because it renders pages, executes JavaScript and clicks exactly like a human's browser, at machine speed.
IN PLAIN ENGLISH
the pages load, the clicks land, the sessions look perfect. No human is present for any of it.
HOW IT WORKS
1
An operator scripts headless browsers to visit pages and click ads at scale.
2
Because it is a genuine browser engine, it passes checks that only inspect the surface.
3
It executes clicks, sessions and events around the clock.
4
Your analytics record enthusiastic visitors from an empty chair.
SPOT IT IN THE WILD
Sessions with flawless page loads and zero human variance.
Identical browsing rhythms repeating across thousands of 'users'.
Consumer-looking browsers resolving to data-centre origins.
THE TRAFFICGUARD FIX
TrafficGuard detects automation by how a session behaves, not what it claims to be, so a browser without a human fails the audition.
Certified Fraud
Hijacked devices and sessions
noun. Full MRC title: hijacked devices, user sessions, ad tags and ad creatives.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Can fraud come from my genuine customers' devices?”
you, probably, at some point this quarter
WHAT IT IS
Malware takes partial control of a real user's device, browser session, ad tags or creatives, and generates ad activity behind their back. The audience data looks perfect because the humans are real. They just never saw any of it happen.
IN PLAIN ENGLISH
someone borrowing your car every night and returning it before you wake.
HOW IT WORKS
1
A device is infected through a rogue app, extension or compromised ad creative.
2
The malware runs ad activity invisibly in the background.
3
Clicks and impressions register from a genuine, high-quality user profile.
4
Advertisers pay for engagement the device owner never witnessed.
SPOT IT IN THE WILD
Activity logged at hours the user is demonstrably asleep.
Ad engagement that never coincides with the device's real usage.
Sessions from one device overlapping in impossible ways.
Certified Fraud
Hyper engaged users
noun. Official taxonomy: repeat clicks. Also: excessive clickers.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why is my click-through rate suspiciously high?”
you, probably, at some point this quarter
WHAT IT IS
Real people who click your paid ads again and again: comparison shoppers running research loops, regulars using your ad as a doorway, the occasional rival with a grudge. Google's duplicate-click window only absorbs rapid re-clicks, so repeat clicks outside it are billed at full price, every time.
IN PLAIN ENGLISH
real people clicking your ad again and again without ever buying.
HOW IT WORKS
1
A user develops the habit of reaching your site through your ad.
2
They click the same ad repeatedly, across sessions, days and tab-hoarding sprees.
3
Every click outside Google's duplicate window bills a full CPC.
4
None of the repeat visits adds a customer you did not already have.
SPOT IT IN THE WILD
Repeated paid clicks associated with the same user or device across sessions.
Rising CPCs on the exact terms your regulars use.
Conversion paths containing dozens of paid touches from one person.
THE TRAFFICGUARD FIX
TrafficGuard applies click-frequency rules that identify hyper engaged users and stop the repeat charges, surfacing them in the non-incremental users report.
Not Fraud. Still A Bill.
Incentivised traffic manipulation
noun. MRC filing: incentivised manipulations of measurements.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Are my 'users' being paid to pretend they like my app?”
you, probably, at some point this quarter
WHAT IT IS
Traffic generated by rewarding people to click, install or engage, without the advertiser's knowledge or permission. The users are real and the actions genuinely happen. The motivation is the reward, not your product, so the numbers inflate and nothing behind them is real demand.
IN PLAIN ENGLISH
paying the audience to applaud, then calling it a standing ovation.
HOW IT WORKS
1
A publisher offers users points, coins or cash for completing actions.
2
Users click and install purely to farm the reward.
3
Conversion rates spike while quality quietly craters.
4
The advertiser funds an economy of professional pretenders.
SPOT IT IN THE WILD
Abnormally high conversion rates from a single source.
Retention collapsing immediately after the rewarded event.
Engagement that stops at exactly the payout line.
Certified Fraud
Invalid impressions
noun. The impression-side umbrella.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How many of my impressions were real chances to be seen?”
you, probably, at some point this quarter
WHAT IT IS
Impressions that fail quality or completeness standards: served to bots, produced by deceptive serving tricks, or otherwise never a legitimate opportunity for a human to see your ad. All fraudulent impressions are invalid, but not all invalid impressions are fraudulent. Either way, they do not belong in your counts.
IN PLAIN ENGLISH
counting empty seats as ticket sales.
HOW IT WORKS
1
An impression is served to non-human traffic, or through deceptive serving.
2
It logs alongside your legitimate impressions.
3
CPM budget pays for it like any other exposure.
4
Reach, frequency and viewability maths all drift quietly wrong.
SPOT IT IN THE WILD
Impression counts that outrun any realistic audience.
Reach analyses that never reconcile.
Heavy impression volume with no downstream lift, ever.
THE TRAFFICGUARD FIX
TrafficGuard scores impressions as well as clicks in real time, separating genuine exposures from invalid ones, so noise is invalidated before it wastes spend or corrupts the data your optimisation relies on.
The Parent Category
Invalid proxy traffic
noun. MRC category. Traffic that dialled in from somewhere else.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why does so much of my traffic arrive through anonymisers?”
you, probably, at some point this quarter
WHAT IT IS
Traffic routed through an intermediary, VPNs, anonymous proxies and relay networks, so its true origin, and often its true nature, stays hidden. One privacy-conscious human is fine. At volume, it is the disguise of choice for click spam, install farms and compliance fraud.
IN PLAIN ENGLISH
a crowd where everyone arrives wearing the same borrowed coat.
HOW IT WORKS
1
Traffic is routed through proxy servers or VPN endpoints.
2
Origin, identity and history are laundered along the way.
3
The disguised traffic enters campaigns it could never enter honestly.
4
Whole fraud operations hide inside the anonymity, at scale.
SPOT IT IN THE WILD
High volumes of anonymised traffic concentrated in a single source.
Click characteristics that do not match the installs they produce.
Overnight activity in what is supposedly the local timezone.
THE TRAFFICGUARD FIX
TrafficGuard scores proxy and VPN signals for every supply source and invalidates those hiding unreasonable volumes of traffic behind anonymisers.
Certified Fraud
.png){kind=icon}
Invalid traffic (IVT)
noun. The parent category. Official split: GIVT and SIVT.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“What is the difference between invalid clicks and click fraud?”
you, probably, at some point this quarter
WHAT IT IS
The industry's umbrella term for any click or impression that does not come from a genuinely interested human. All fraud is IVT, but not all IVT is fraud: an innocent search crawler and a malicious botnet both count. It splits in two. GIVT (general invalid traffic) is the polite kind: declared crawlers and known bots that announce themselves and are easy to filter. SIVT (sophisticated invalid traffic) is the problem child: malware, spoofed devices and hijacked sessions built to look human, which only multi-signal analysis can catch.
HOW IT WORKS
1
GIVT: a known crawler visits, identifies itself, and standard list filters remove it.
2
SIVT: engineered traffic imitates human behaviour and slides past those same filters.
3
Both inflate your reported traffic and corrupt the data your decisions rest on.
4
Platforms filter some of it. The sophisticated remainder is the expensive part.
SPOT IT IN THE WILD
A persistent gap between platform-reported clicks and your analytics sessions.
Visitors with no scroll, no dwell and no second page, at volume.
Reports that refuse to reconcile, month after month.
THE TRAFFICGUARD FIX
TrafficGuard detects both GIVT and SIVT across Search, Social, Affiliate and Mobile, reports transparently on what was invalidated and why, and, for eligible Google Ads traffic, supplies supporting evidence for refund claims.
The Parent Category
Known data-centre traffic
noun. Clicks from buildings where no consumers live.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I getting clicks from cities where I have no customers?”
you, probably, at some point this quarter
WHAT IT IS
Ad traffic originating from data-centre IP ranges: cloud servers, hosting providers and rented infrastructure rather than consumer devices. One of the clearest invalid traffic signals there is, because genuine customers do not browse from a server rack.
IN PLAIN ENGLISH
greeting cards from 'your customers', all postmarked from the same industrial estate.
HOW IT WORKS
1
Fraud tooling runs on rented cloud servers because it is convenient and scalable.
2
Its traffic carries IP addresses from known data-centre ranges.
3
Unfiltered, those visits enter your campaigns as ordinary customers.
4
Every click bills like a human, from a building that contains none.
SPOT IT IN THE WILD
Traffic resolving to hosting providers rather than consumer ISPs.
Server-grade origins behind consumer-targeted campaigns.
Regions in your reporting dominated by known cloud zones.
THE TRAFFICGUARD FIX
Genuine customers do not browse from server racks. TrafficGuard's IP intelligence recognises traffic coming from known data-centre ranges and invalidates it on sight, so your budget only meets real devices.
Certified Fraud
Location fraud
noun. GPS, creatively reinterpreted.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Are my geo-targeted campaigns actually reaching my geography?”
you, probably, at some point this quarter
WHAT IT IS
Falsified location signals: spoofed GPS coordinates, forged location headers and manipulated device data, used to smuggle out-of-market traffic into geo-targeted campaigns that pay premium rates.
IN PLAIN ENGLISH
junk mail with a first-class local stamp.
HOW IT WORKS
1
A fraudster manipulates the location a device reports.
2
The traffic now qualifies for your geo-fenced, premium-rate campaign.
3
Clicks and installs are billed at your local-market prices.
4
Your regional budget converts nowhere in the region.
SPOT IT IN THE WILD
Location claims contradicting IP, language and timezone signals.
Conversions that never materialise in the claimed market.
Coordinates suspiciously tidy, repeated or centred on landmarks.
Certified Fraud
Navigational traffic
noun. Your regulars, using your ad as a bookmark.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Would these customers have found me anyway?”
you, probably, at some point this quarter
WHAT IT IS
People who search your brand name intending to visit you, then click your paid ad simply because it sits one inch above your free organic listing. The visit was always going to happen. The invoice was optional. Unlike returning users, this is about how a visit arrives, not who it comes from: any brand searcher can be navigational, customer or not.
IN PLAIN ENGLISH
paying a toll to drive up your own driveway.
HOW IT WORKS
1
A loyal user searches your brand name.
2
Your paid ad appears above your organic result.
3
They click whichever link is first, which is the one you pay for.
4
You are billed a CPC for a visit you would have received free.
SPOT IT IN THE WILD
Brand campaigns with heroic ROAS and no incremental lift.
A high share of returning users inside your paid brand clicks.
Organic brand traffic falling exactly as paid brand traffic rises.
THE TRAFFICGUARD FIX
TrafficGuard identifies navigational and returning users inside your paid traffic, so you can stop paying for visits you already owned and measure what your spend truly adds.
Not Fraud. Still A Bill.
Non-incremental traffic
noun. Legitimate. Human. Still a waste of budget.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How much of my ad spend actually changes anything?”
you, probably, at some point this quarter
WHAT IT IS
Paid traffic that adds nothing you would not have had anyway: hyper engaged users, navigational visitors, returning customers mid-purchase. Every click is a real human doing something legitimate. And every click is spend that created no new demand.
IN PLAIN ENGLISH
advertising to people who are already standing in your queue.
HOW IT WORKS
1
Campaigns target broadly, sweeping up loyal customers and habitual visitors.
2
Those users click paid ads on journeys they would have completed regardless.
3
The platform books their purchases as ad-driven conversions.
4
ROAS looks superb. Growth does not move. Nobody can explain the gap.
SPOT IT IN THE WILD
Strong reported ROAS alongside a stubbornly flat topline.
Heavy dependence on paid brand terms.
Big overlap between ad-attributed converters and your existing CRM.
THE TRAFFICGUARD FIX
This is where TrafficGuard goes beyond fraud tools entirely: it classifies non-incremental traffic alongside invalid traffic, so you can shift budget towards clicks that create demand instead of collecting it.
Not Fraud. Still A Bill.
Pixel stuffing
noun. Advertising, but one pixel of it.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why do these placements rack up impressions but never a single click?”
you, probably, at some point this quarter
WHAT IT IS
Full-size ads compressed into a 1x1 pixel frame on a publisher's page. Every visitor triggers an impression for every stuffed pixel, and no visitor has ever seen any of them. It lets a bad actor 'serve' far more ads than a page could legitimately hold.
IN PLAIN ENGLISH
a cinema screening ten films at once, on a screen the size of a stamp.
HOW IT WORKS
1
A fraudulent publisher frames normal ads into 1x1 pixel containers.
2
Dozens now fit where one ad should sit.
3
Every page load fires impressions for all of them.
4
CPM budgets pay for microscopic, invisible inventory.
SPOT IT IN THE WILD
Impressions from placements with zero interactions, ever.
Viewability collapsing on specific publishers.
Ad density that defies the geometry of the page.
THE TRAFFICGUARD FIX
Pixel stuffing falls under the obfuscated ad serving category TrafficGuard classifies as sophisticated invalid traffic: impressions served with no genuine chance of being seen are identified and invalidated before they waste your spend.
Certified Fraud
Pre-fetch and pre-rendered traffic
noun. GIVT. Your browser, being helpful.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Can a page I never opened still load my ad?”
you, probably, at some point this quarter
WHAT IT IS
Browsers and devices request pages and ads ahead of human navigation to feel faster. If the user never completes the visit, the ad still loaded and the request still happened, and unfiltered it counts as if a person arrived. Not malicious. Still not a human.
IN PLAIN ENGLISH
the waiter bringing dishes to every table that glanced at the menu.
HOW IT WORKS
1
A browser predicts where the user might navigate next
2
It pre-loads the page, and its ads, in the background.
3
The user goes somewhere else entirely
4
The pre-loaded ad call sits in your numbers anyway.
SPOT IT IN THE WILD
Ad requests with no accompanying engagement, at volume.
Click-to-conversion ratios sagging on specific sources.
GIVT lines appearing in verification reporting.
THE TRAFFICGUARD FIX
Standard GIVT filtration: TrafficGuard recognises pre-fetch and pre-render signatures and filters them from your reporting, so requests without a human behind them do not read as demand.
Not Fraud. Still A Bill.
Price scraping bots
noun. Market research, at your expense.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why does my competitor match my prices within hours of every change?”
you, probably, at some point this quarter
WHAT IT IS
Automated crawlers sent by competitors and aggregators to harvest your prices, odds or stock levels. On their rounds they click paid listings and pollute your data, so somebody else's spreadsheet is refreshed on your advertising budget.
IN PLAIN ENGLISH
a rival's intern photographing your shelf labels, having come in through the paid entrance.
HOW IT WORKS
1
A competitor or aggregator schedules scraping runs against your site.
2
The bots reach you through search results, including your paid listings.
3
Each visit bills a click and registers as engaged traffic.
4
Your analytics now include a robot with strong opinions on pricing and no intention to buy.
SPOT IT IN THE WILD
Rhythmic, scheduled visit patterns that repeat to the minute.
Deep crawls of price and product pages with zero basket activity.
User agents changing identity between otherwise identical runs.
THE TRAFFICGUARD FIX
TrafficGuard identifies scraper bots in the paid traffic they ride in on and invalidates their clicks in real time, so competitor data-gathering stops burning your ad budget.
Not Fraud. Still A Bill.
Retargeting fraud
noun. Bots auditioning as your hottest leads.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why does my retargeting audience keep growing but never converting?”
you, probably, at some point this quarter
WHAT IT IS
Retargeting pays higher rates than regular display, so fraudsters manufacture 'high-value' audiences: bots browse your site, fill carts and abandon them convincingly, earning a place on your retargeting lists. You then pay a premium to chase software around the internet.
IN PLAIN ENGLISH
a mannequin joining your loyalty programme.
HOW IT WORKS
1
Bots visit your site and imitate interested shoppers.
2
They abandon carts and wander off, the classic high-intent signal.
3
Your retargeting lists absorb the fake audience.
4
Premium re-engagement budget performs for the traffic source, and nobody else.
SPOT IT IN THE WILD
Retargeting segments growing faster than site traffic can justify.
Re-engagement spend that converts at zero, indefinitely.
Audience overlap with sources already flagged as invalid.
THE TRAFFICGUARD FIX
TrafficGuard identifies invalid engagement before it distorts campaign measurement and retargeting decisions, so re-engagement budget follows real prospects instead of bots.
Certified Fraud
Returning users
noun. Loyalty, invoiced per visit.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Why am I paying acquisition prices for people I already acquired?”
you, probably, at some point this quarter
WHAT IT IS
Existing customers and regulars whose routine way back to you runs through a paid ad. Each return is charged like a brand-new prospect, which quietly inflates acquisition costs and flatters ROAS with revenue you already owned. Unlike navigational traffic, this is about who the visitor is, not how they arrive: a returning user costs you acquisition money on any keyword, brand or not.
IN PLAIN ENGLISH
paying the estate agent again every time you walk into your own house.
HOW IT WORKS
1
A customer already knows and uses your product.
2
Their habitual route back to your site runs through a paid ad.
3
Every return visit bills like a fresh acquisition.
4
Reported CAC and ROAS drift further from reality each month.
SPOT IT IN THE WILD
Paid conversions dominated by contacts already in your CRM.
LTV to CAC deteriorating as spend scales.
Branded ad clicks from users who are already logged in.
THE TRAFFICGUARD FIX
TrafficGuard identifies returning users inside paid traffic, so you can measure true acquisition, protect LTV to CAC, and stop re-buying your own customers.
Not Fraud. Still A Bill.
SDK spoofing
noun. Fake installs, no devices required.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How do fake app installs happen without any phones at all?”
you, probably, at some point this quarter
WHAT IT IS
Fraudsters reverse-engineer the conversation between an app's tracking SDK and its measurement server, then replay fabricated install and event signals directly from their own servers. No device, no download, no human. On the dashboard, it looks like a flawless install.
IN PLAIN ENGLISH
printing boarding passes for passengers who do not exist.
HOW IT WORKS
1
The fraudster intercepts and studies real SDK-to-server traffic.
2
They crack the format and signature scheme that makes a signal look authentic.
3
They generate fake installs, opens and in-app events at industrial scale.
4
The measurement platform records them as real, and you pay per install.
SPOT IT IN THE WILD
Installs with textbook-perfect event sequences and identical timing.
Whole cohorts that never spend a single dollar in-app.
Device parameters repeating in patterns real hardware never produces.
THE TRAFFICGUARD FIX
Fabricated signals still have to imitate a user afterwards, and they cannot. TrafficGuard's post-install monitoring flags installs whose events follow a programme rather than a person, and spoofed traffic is invalidated before payout.
Certified Fraud
Sophisticated bot driven installs
noun. Install bots, running on real people's phones.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“How can a real device produce a fake install?”
you, probably, at some point this quarter
WHAT IT IS
Seemingly legitimate apps carry install bots that download, open and even engage with other apps in the background of an unsuspecting user's real device. The click is real, the device is real, the download genuinely happens. The 'user' engaging with your app is a script.
IN PLAIN ENGLISH
someone's phone moonlighting as your newest customer.
HOW IT WORKS
1
A user installs an innocent-looking app hiding an install bot.
2
The bot downloads and opens target apps in the background.
3
It mimics human early engagement convincingly enough to pass basic checks.
4
Cost-per-install is paid for installs no human will ever touch.
SPOT IT IN THE WILD
Post-install events firing in identical, mass-produced patterns.
In-app purchases reported by the SDK that never reach revenue.
Retention curves with no organic shape at all.
THE TRAFFICGUARD FIX
TrafficGuard monitors post-install events per traffic source, comparing each source's whole footprint against the norm to expose programmed behaviour before payout.
Certified Fraud
User-agent spoofing
noun. Traffic with a forged ID card.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Is that visit really the device it claims to be?”
you, probably, at some point this quarter
WHAT IT IS
Every visit announces what it is, browser, device, operating system, through its user-agent string. Spoofing forges that announcement, so bots and servers introduce themselves as iPhones and laptops, slipping past filters that take traffic at its word.
IN PLAIN ENGLISH
an ID card printed at home. Convincing, right up until someone checks the hologram.
HOW IT WORKS
1
Fraud tooling overwrites its user-agent header with a fabricated one.
2
A server in a rack introduces itself as a phone in a pocket.
3
Filters that trust declared identity wave the traffic through.
4
The disguised visitors click, install and pollute your data at will.
SPOT IT IN THE WILD
Declared devices inconsistent with observed technical signals.
'Browsers' missing the quirks every real browser carries.
Anonymous, malformed or non-browser headers arriving at volume.
THE TRAFFICGUARD FIX
TrafficGuard verifies what traffic is by how it behaves, signal by signal, so a forged introduction gets nobody through the door.
Certified Fraud
Zombie devices
noun. Botnets: ordinary devices, moonlighting for fraud.
SNEAKINESS
BUDGET BURN
THE QUESTION EVERYONE IS ASKING
“Could my customers' own laptops be part of the problem?”
you, probably, at some point this quarter
WHAT IT IS
Consumer devices quietly conscripted into botnets: infected phones, laptops and smart TVs generating clicks and traffic on command while their owners notice nothing. It is fraud at scale, distributed across thousands of innocent living rooms.
IN PLAIN ENGLISH
a sleepwalking neighbourhood, all clicking in unison.
HOW IT WORKS
1
Malware infects consumer devices and waits for instructions.
2
The botnet operator sells clicks and traffic to whoever pays.
3
On command, thousands of real households generate ad activity together.
4
The traffic looks residential because it is. The intent is nowhere to be found.
SPOT IT IN THE WILD
Residential IPs behaving with industrial coordination.
Synchronised activity spikes across unrelated users and regions.
Engagement bursts at hours botnets favour and humans do not.
THE TRAFFICGUARD FIX
Botnet traffic is caught by real-time behavioural and source validation: devices that behave like code rather than customers are invalidated, however residential their addresses look.
Certified Fraud