Aided by Kochava Experts, Uber Recovers Millions from Ad Fraud Scheme

OTT Fraud: hot advertising platform, same old fraud

Advertising on over-the-top (OTT) and connected TV (CTV) channels have become a surefire way to reach a broad and engaged audience. But with the good, comes the bad, and fraudsters are up to the same tactics to nab attribution credit (and your ad dollars) through click flooding.

Unfortunately, no channel is safe when it comes to fraud. The amount of money spent in advertising attracts too many opportunists looking for a way to cash in from a loophole in the advertising infrastructure, and OTT and CTV channels are no exceptions. With a surge in campaigns on these two channels, our Kochava Foundry^TM experts are seeing fraud from the ad signal, the data stream of impressions and clicks sent from partners, in the form of click flooding.

What is click flooding?

Click flooding (also called click spamming) is a fraud tactic wherein a rogue publisher entity may use programmatic scripts, bots, or other mechanisms to send a “flood” of fake clicks for a specific campaign offer. In some cases, ad networks may even trigger click tracking tags when serving impressions. This manipulates the attribution waterfall by reporting low-intent impressions as high-intent clicks, which have a greater chance of winning attribution for a conversion. Although the install conversions may be from legitimate users, the attribution is not because credit has been stolen from the true source through a flood of fake click signals. Click flooding is no different with OTT campaigns and marketers utilizing Kochava can monitor click flooding in the Kochava Fraud Console. 

Mitigating fraud through your OTT media buying strategy

How you buy your media is one way to protect your OTT campaigns from excessive click flooding. OTT ad buying methods include programmatic, platform direct, and publisher direct, and each method of OTT media buying has its pros and cons. 

Programmatic buying occurs on an exchange via an ad partner. Platform direct means you are buying directly from one of the major platforms, such as Roku or Vizio, whereas with publisher direct, you’re buying from one of the major publishers, such as Hulu or Paramount+. Of the three, programmatic is the most cost-effective. Although it has the broadest audience reach with cross-platform, cross-service, and cross-device addressability, programmatic also carries the highest risk for click flooding. The main reason for this method’s vulnerability is because there is no instructional file, such as an ads.txt or plist, to act as a manifest of who’s allowed to serve ads for the advertisers. Its absence makes it easier for anyone, including fraudsters, to operate on a programmatic exchange.

On the other hand, while platform direct and publisher direct cost more and have limited audience reach, advertisers can better negotiate their terms. As with media buying on mobile channels, build strong relationships with the partners working on your behalf with these methods. Request transparency by having site/publisher IDs displayed and unobfuscated in their reporting to see where ad interactions are actually coming from. 

Other mitigation strategies

Keep an eye on your click-to-install (CTI) ratio. If a click represents a viewer actively engaging with an OTT ad and showing intent (eg, tapping an ad with their finger, or clicking on it with their CTV remote), then it’s reasonable to expect they’re far more likely to install the target app. Hence, would you expect that it should take 10,000 clicks to drive one install? Unlikely to say the least. Find your baseline CTI ratio and then keep an eye out for specific partners or sub-publishers that far exceed the normal threshold average. Exorbitantly high CTI ratios are a sign that something’s amiss.

Catch Jailbroken Device Fraud

Fraud wears many masks, and fraudsters are using jailbroken devices with no or customized operating systems on them to perform a variety of fraudulent tactics. 

“Jailbroken” iOS phones or “rooted” Android ones are devices in which the operating system has been deleted, replaced, or has had restrictions removed so that the user has access to features normally prohibited. Users may jailbreak devices intentionally to have more control over their device, customize its look, and/or download apps outside of the mainstay app stores (called “sideloading”). However, it’s no surprise that these phones are also more susceptible to fraud through malware. Fraudsters have used jailbroken devices to automate ad fraud through emulators and custom scripts that execute app installs and in-app events.

Identifying fraud

The Kochava software development kit (SDK) uses proprietary processes to identify jailbroken devices. Since these devices are still able to download apps legitimately from the app store, they’re not considered fraudulent by default. It’s actually quite normal to have a small amount of jailbroken devices in a campaign. The Kochava Foundry^TM team has observed that between 3% and 5% of normal campaign traffic may come from jailbroken devices. When jailbroken and rooted devices occupy a much larger share of total traffic, suspicion should arise. 

How many jailbroken devices is too many?

Fraud detection tools can only go so far and are not designed to catch all anomalies because a fair amount of legitimate traffic would be omitted too. As such, identifying fraud is often a collaborative effort between an app marketer and the Kochava Foundry team. In the case of one client, their team detected several jailbroken devices on their end and asked the Foundry team to validate their findings, research further and obtain intel about the media partners involved.

 Further analysis uncovered a small cohort of media partners, whose acquisition traffic showed 35% of iOS installs and 65% of Android installs were jailbroken or rooted. Compared to the average percentage of jailbroken/rooted devices among other media partners and organic traffic, this was a major outlier. Drilling down further to a publisher (site ID) level, the Foundry team observed that around 18% of the media partner’s sub-publishers on iOS campaigns had 100% jailbroken devices. Separately on Android, 10% of sub-publisher sites had 100% rooted devices. This intelligence enabled the marketer to collaborate directly with the media partner to root out (no pun intended) the bad publishers from the batch.

How the Kochava Foundry team uncovered an install farm for a fintech company

Fraud isn’t always blatantly obvious at first but can creep into campaigns, hiding in plain sight as good traffic. Thankfully it does, however, always leave a trail. Real-time mitigation solutions stop the lion’s share of fraud from the most common tactics, but marketers need to remain vigilant of data anomalies nonetheless—although they don’t immediately signal fraud, it pays to have experts dig in. If something stands out as different or strange in your data, don’t let it go. It could be an indicator of a much larger fraud being committed.

That’s exactly what happened to a fintech services app running a large campaign in EMEA, and it all started with a grouping of fake emails linked back to what had appeared to be a successful acquisition campaign. The fintech marketing team contacted Kochava Foundry^TM to determine the cause, but how the Foundry analyst investigated may surprise you.

The anatomy of a fraud investigation: First, attempt to explain anomalies

When presented with an anomaly, Kochava Foundry analysts do not immediately suspect fraud because if initially set on proving fraud without much evidence, that could cloud the investigation and overlook simple data errors or alternative explanations. 

In the case of this fintech company, our analyst first worked on the assumption that the campaign traffic was legitimate (innocent until proven guilty) and sought potentially reasonable explanations for the anomalies. Developer testing, event tracking implementation issues, and other errors were reviewed and eliminated as potential causes. 

Next, the analyst looked at the app’s traffic during the campaign. The campaign was running on a cost-per-engagement (CPE) model, and it drove an impressive amount of signups, the target event. As the analyst probed further, he saw a disproportionate number of the signups within the campaign time frame had absolutely no subsequent money transfer events. By segmenting the newly acquired audience cohorts by attributed network and sub-publisher, it became clear that the exponential spike in signups with no transfers was isolated to a specific grouping of sub-publishers. While the typical rate of signup-to-no-transfer was 30-40% across most paid and owned media, these cohorts displayed a signup-to-no-transfer rate of 99%. This was a major outlier and highly suspect. It became the first red flag that install farm fraud was likely at play behind these publishers. The hypothesis was that an install farm was clicking campaign offers, quickly installing the app, then completing the target CPE event with a fake email before then uninstalling the app to rinse and repeat the process. 

Get a FREE fraud assessment to help prevent future losses

As we head into a new year and all the changes it will bring, now is a good time to evaluate your fraud prevention strategy with our free Mobile Ad Fraud Assessment tool.

Fraud prevention may have taken a backseat with all the news coming about Apple’s data privacy policies with iOS 14, but you can still take steps to prevent fraud now. While identifying fraud will change for iOS, there are still ways to mitigate it on all OS platforms. By identifying fraud now, you can implement prevention strategies for future ones.

Get your free fraud score

Just like you should check your credit score periodically, as marketers, you should be regularly assessing your fraud score.

Grant Simmons, our resident expert on mobile ad fraud and VP of Client Analytics here at Kochava, recommends checking for fraud by starting with a cohort and seeing what kind of signal you’re receiving because if not, fraud can easily “creep in” and be stealing attribution even before you notice a big problem.

“You should always be listening, but I recommend doing ‘stress tests’ to understand what’s likely happening. Take a cohort and see what ad signal is being received and what the credit is being given to that ad signal. Based on that, you might identify some opportunities for improvement,” Grant said during a recent livestream with the Mobile Marketing Association.

He said that often, marketers focus more on the real-time data they receive and don’t take the time to step back to assess the bigger picture.

With our Mobile Ad Fraud Assessment tool, you can do just that—assess your most recent campaign and get a fraud report of the most common types of fraud identified. With a minimum requirement of three months and data from at least three networks, we’ll run your data through our fraud algorithms and flag up to 12 types of fraud.

You’ll receive your fraud score in less than 24 hours. What’s best is that we won’t leave you alone to determine how to mitigate any damage identified. We feel strongly about fighting fraud and enabling a transparent ecosystem, and we’ll help you stop the fraud identified and help prevent it in the future.

Get educated!

An informed marketer is one who continually is learning how to spot fraud. When fraud is identified, it is an opportunity to know how to prevent that type in the future whether it’s being more vigilant about insertion order (IO) requirements or setting custom thresholds in traffic for prevention.

Keep in mind that the wider your audience reach, and the cheaper the cost per install (CPI), the more likely your publisher sites may exhaust their inventory and include more marginal, low-quality, and potentially fraudulent traffic.

“Every DSP [demand-side publisher] out there has a great list of publishers, but as they try to reach the acquisition goals required, traffic starts to get more marginal and can cross over into shark-infested waters. Make sure you have that real-time mitigation in place as soon as possible,” Grant said.

Get started today with our free Mobile Ad Fraud Assessment tool by filling out the form here.

Diagnose ad fraud under the hood with a free Attribution Fraud Assessment tool brought to you by the MMA and powered by Kochava.

The many faces of ad fraud have wreaked havoc on the digital marketing industry with bad actors stealing ad spend wherever possible. Industry experts believe that as much as 50% of the signal for purposes of attribution is fraudulent in some way or another. To combat this, Kochava has partnered with MMA Global to offer a free attribution fraud assessment tool highlighting the primary forms of fraud in a marketer’s ad campaigns.

Fraudulent activity frequently hides in plain sight behind seemingly successful campaign outcomes. Fraudsters have become adept at manufacturing the data that marketers want to see, making it difficult to discern from what is real. Within Kochava alone, we still see approximately 8% fraudulent installs across the traffic we process even after a litany of anti-fraud filters. Without any in place, nearly 50% of traffic would be fraudulent (Source: Flattening the Fraud Curve livestream).

Ad fraud prevention made simple

The industry’s reliance on last-click attribution, focus on low cost per install and/or cost per action, and quest for a broad user base have made itself vulnerable to opportunists. That said, exposing fraud not only protects ad spend,  it’s an essential part of running efficient and transparent campaigns. 

As complicated as the tactics may get, preventive measures often boil down to common sense. If, for example, your paid media yields the same or better-quality installs than your organic ones, something is likely amiss. Other red flags include having a disproportionate clicks-to-install ratio (eg, 10,000:1), not reporting impressions or reporting them as clicks, and low-quality installs.

So, what do you do? In spite of the fraud mitigation tools on the market, not all are created equal. For instance, a demand-side publisher (DSP) working with Kochava suspected fraud from several publishers after seeing high click-to-install ratios and abnormal time-to-install outliers on certain sites. However, the DSP could not prove any wrongdoing with the client’s other mobile measurement provider. This led them to request a fraud audit from Kochava which showed several of the client’s ad partners were stealing conversions. The DSP used the audit as evidence to receive make-goods and re-evaluate their ad partners.

So, what’s your ad fraud score? 

Don’t assume that all campaign data is valid—you need sophisticated anti-fraud tools in place to mitigate fraud as much as possible. Use the attribution fraud assessment tool to see what areas need improvement so you have the most accurate data. With it, you’ll get an initial estimate of the amount of attribution fraud based on an aggregated make-up of your advertising. It’s a start in enabling you to take action in decreasing fraud and getting a better return on your marketing spend. 

To learn more about how Kochava tackles fraud, or for more information about the free attribution fraud assessment tool, click here, and see how we can help.

How many clicks should it take to drive an app install? Should it take 100? 500? 1,000? 1,000,000?

Before answering, let’s define what a “click” means. In marketing, a click represents a mobile user seeing an ad and being interested enough to show their intent to convert by tapping on that ad. The click sends them to the app store where they can install.

If intent is what a click represents, then we should never see a media partner or publisher sending thousands or millions of clicks that result in only 1 or 2 installs. It’s implausible that 1,000,000 real people clicked on an ad but then 999,999 of them abandoned their interest once they reached the app store, leaving only one real install. And yet, all too often, we see these unreasonably high CTI (click to install) ratios.

The number of clicks matters because you want to see results based on the actions of real users, and you want to know if there are fraudulent clicks muddying your traffic. If you’re only focused on installs, you’re blind to click flooding which leads to misattribution or the stealing of organic installs.

Clicks should correlate with installs

Mobile marketing is a cause-and-effect strategy game. When a media partner drives up click volume, we expect to see a similar rise in conversions. This is good correlation—the strength of the causal relationship between clicks and installs (top image). If we see major peaks and valleys in a partner’s click volume, but no impact on the conversion trend line, correlation is weak or absent (bottom image).

Having a weak correlation indicates a problem that should arouse suspicion. Unfortunately, as a measurement provider, Kochava regularly records a CTI ratio of 1000:1 from media partners, which is unrealistic (and we’ve seen beyond that!).

The myth of CPI is that clicks don’t matter

There is a common misconception in marketing that if a marketer is paying on a cost per install (CPI) price model, the number of clicks isn’t important, only the final outcome of those clicks (i.e., the install count) is important.

Let’s say partners A and B both drove 1,000 install conversions. Partner A delivered 1,000 installs by driving 10,000 clicks (a CTI ratio of 10:1). Partner B drove 1,000,000 clicks to deliver the same number of installs (a CTI ratio of 1,000:1). Should partner A and B be considered equally successful in their campaign execution because their CPI outcome was the same? Or should the question be, why did it take partner B 100x the click volume to deliver the same amount of installs as partner A?

By ignoring the CTI rate, marketers are frequently paying the wrong partners. It also means that organics are likely being stolen/misattributed, which translates into marketers paying for installs that their brand equity—not their paid advertising—drove.

Additionally, not removing fraud from campaigns means that return on investment is skewed, and marketers are basing their decisions on erroneous data. The most likely cause for having a misaligned correlation is click flooding—when publishers send fake clicks to win attribution.

Smart marketers can protect themselves by:

• Monitoring click volume and CTI ratio in the Fraud Console. If there are low conversion rates and high CTI ratios, they request an improved conversion rate and/or blocklist offending site IDs to prevent misattribution.
• Consulting the Kochava Traffic Index report (for free each quarter) to see which partners are ranked high for correlation.
• Consulting the Kochava Traffic Index for partners with good signal clarity and requesting they send clicks and impressions separately.

Ensure good signal clarity for a strong correlation

A clean signal with a strong click-to-install correlation is the only way to predict the number of installs from a planned campaign.

Work with your Client Success Manager on how to approach partners if the correlation metric is off and how to customize lookback windows to mitigate fraud and increase your signal clarity for stronger correlation.