In this short article we explain the basics of click fraud, and describe two click fraud techniques and how to detect them. We then tell you the easiest and most cost effective way to detect and prevent click fraud.
What is click fraud?
Click fraud is an online scam which steals billions of dollars from advertisers every year. It typically works like this:
- A criminal creates a website which can display search results. For example, the website might contain articles about technology, and at the top of the page will be a search box for finding content on the website.
- The criminal contacts an advertising network like Microsoft Ads, and requests a publisher advertising account. The publisher advertising account allows the scammer to monetize his website by displaying advertisements every time someone does a search. For example, if a visitor searches for "antivirus software" on the criminal's website, adverts relating to antivirus software will be shown.
- Instead of waiting for real people to visit his website, the scammer hires a bot programmer to create a click fraud bot. The programmer uses bot software such as Puppeteer-Extra to mimic a real internet user, and a residential proxy service to disguise the fact the bot is running on a server in a data centre.
- The bot visits the criminal's website and searches for high value ad keywords, such as "buy laptop online". The bot maintains a list of high value ad keywords, and randomly selects one every time it does a search. The bot visits the website thousands of times per day, and clicks on an ad roughly 10% of the time.
For every ad click, the advertiser pays money to the advertising network, and the money is then shared with the scammer. If the bot is well made, the criminal can earn six figure pay-outs every month.
Part of the problem is most advertising networks have less than ideal click fraud detection capabilities, with some doing no click fraud detection at all. It is a mistake to rely on the advertising networks to protect you from click fraud.
How to detect click fraud?
Detecting click fraud isn't straightforward, and typically requires programming and cybersecurity skills. Let's discuss the two simplest forms of click fraud, and how to detect them.
It's possible to automate your browser using a technology called webdriver. For example, you might automate your browser to visit your website and repeatedly click on the ads. Detecting webdriver is easy.
When a browser is being controlled by webdriver, a setting in your browser called
navigator.webdriver is set to
if (window.navigator.webdriver && window.navigator.webdriver === true)
console.log("Browser is being controlled by webdriver");
We can even use a 0 x 0 pixel iframe to display the Polygraph website:
You can't see it, but it's there.
Detecting iframe related click fraud is easy, as you can check if the advertiser's website has been loaded inside an iframe, and can also check the size of the iframe:
if (window.parent.location && window.self == window.top)
console.log("Advertiser page is not inside an iframe");
if (window.innerHeight === 0 && window.innerWidth === 0)
console.log("Advertiser page is not visible (page is 0 x 0 pixels)");
Although the two examples above are the most basic forms of click fraud, a major advertising network is unable to detect them.
Polygraph is able to detect every click fraud technique, including bots created using Puppeteer-Extra.
The easiest way to detect click fraud
Instead of building your own click fraud detection system, it's much simpler - and cheaper - to use a click fraud detection service.
Polygraph are experts at detecting click fraud, and can even detect "undetectable" click fraud bots. Additionally, Polygraph provides strategies for avoiding future click fraud, including:
- Telling you which websites are generating fake clicks on your ads, so you can block click fraud websites from displaying or clicking on your ads.
- Listing the ad keywords which are being targeted by click fraud bots (click fraud isn't random, but instead targets specific ad keywords), so you can remove the high risk keywords from your ad campaigns to avoid future click fraud.
- Providing details of every fake click, so you can apply for click fraud refunds from the ad networks.
Detecting fake clicks on your ads is a requirement if you advertise online. The advertising networks often have less than ideal click fraud detection capabilities, so it’s important you don’t rely on them to protect your ads from fake clicks.
Polygraph are experts at detecting and preventing click fraud, and can protect your advertising budget from being stolen by online scammers.
Try Polygraph today, free of charge, to start protecting your ads from click fraud.