The Internet is a dynamic and powerful medium for marketers to reach and engage with consumers. As advertising budgets continue to flow into digital channels, online advertising will continue to attract the most sophisticated cyber criminals looking for ways to counterfeit audience, ad inventory and performance.
The complexity of 3ve’s operation is an illustration of fraudsters innovating around many of the protective measures introduced by the ad industry over the past few years. It comprised three sub-operations with a variety of monetization schemes primarily focused on fabricating fake ad inventory and fake audiences. And it went to great lengths to go unseen including the avoidance of third-party invalid traffic detection tracking and mimicking the behaviors of the real people’s machines that it had infected with specially designed malware. As a result, the operation was able to generate three to 12 billion attempts to sell fake advertising a day within programmatic advertising platforms.
Great strides in combating ad fraud have been made by the industry over the past few years, but one deterrent that has been missing is criminal consequence. The arrests and indictments associated with 3ve and Methbot have changed that.
Key Recommendations for Advertisers after 3ve:
Transact with DSPs that have automated, dynamic, adaptive and comprehensive invalid traffic (IVT) prevention filters. Most platforms have dedicated teams and stringent policies designed to flag and filter bad supply sources across brand safety, viewability and invalid traffic. Existing non-human traffic processes should be complemented with automated, dynamic, adaptive and comprehensive invalid traffic prevention filters in order to deal with fraud of the immense scale and diversity of operations like 3ve. 3ve’s operators built sophisticated measures to go undetected, notably avoiding third party invalid traffic measurement tags, mimicking the Internet browsing behaviors of malware infected computers and the rapid cycling of up to 40,000 IP addresses/day. This gave the whole operation a real-time shapeshifting effect that was extremely difficult to identify based on anomaly detection alone. DSPs that run real time dynamic and adaptive invalid traffic prevention across all supply mitigate instances where fraudulent inventory seeps into media buys regardless of whether they are open-web RTB, PMP or programmatic direct buys.
Double down on protecting your video investments. Digital video’s higher CPMs and demand for inventory have made it particularly vulnerable to invalid traffic. Digital video advertising is consistently 2x+ higher in IVT rates than traditional display. Whether by design or organically, 3ve’s operators profited immensely from the demand for premium video advertising. They primarily capitalized on this by counterfeiting ad inventory on over 10,000 domains of prestigious publishers where the systems being used to deliver and track ads were tricked into thinking they were serving on premium content only to be served up to a bot on a bogus website. As TV budgets continue to flow into digital and programmatic buying platforms, marketers should carefully examine their own protective tools and video buying strategies as well as IVT protective measures of the publishers and platforms they are buying video inventory from. For example, aggressive, unrealistic high reach/frequency goals at low CPMs running on non-transparent supply sources – regardless of whether they are desktop, mobile or connected TV – should be cause for scrutiny.
Be mindful of time- and audience-specific direct to publisher buys. Even while parts of 3ve were faking premium content in programmatic environments, all three sub operations were making money by selling fake audience visits to real websites. Often unsuspecting publishers source traffic from intermediaries who are ultimately getting traffic from bot operations like 3ve. The evidence of sourced traffic becomes most obvious when a marketer is doing direct to publisher buys that are time and performance sensitive. When executing direct to publisher buys, marketers should be wary of accepting (or pushing for) unrealistic performance goals. Additionally, marketers should request and review sourced and syndicated content practices from publishers prior to contracting in addition to reporting post-campaign launch.
