Click fraud and ad fraud: traffic that only looks like customers

Names and definitions follow the OWASP Automated Threats to Web Applications project.

• Publisher fraud. A site owner sends bots to click the ads on their own pages, so the ad network pays them for each click.
• Competitor fraud. Someone clicks a rival's search ads until the daily budget runs out and the ads stop showing.
• Botnet traffic. Infected devices load pages and click ads in the background, with real addresses and real browsers; see botnets.
• Click farms. People paid to click, which defeats checks designed to catch automation.

The fraud is profitable because each click is cheap to fake and is paid for by someone who cannot see who clicked.

• Impression fraud. Ads loaded where nobody can see them: stacked, tiny, or off screen.
• Domain spoofing. Low-quality sites passing themselves off as well-known ones to sell ad space at a higher price.
• Install and conversion fraud. Fake app installs or sign-ups claimed by the wrong source to collect the reward.

These sit mostly in the advertising supply chain, between networks and publishers. A website owner meets them when buying traffic, and meets bots directly when their own ads or landing pages are the target.

• Click-through rate rising while conversions do not. More clicks, no more customers.
• Clicks concentrated at odd hours or from places where you do not sell.
• Very short visits. Landing page loaded, nothing else touched.
• Repeated clicks from the same networks or devices within a short time.
• Budgets exhausted early in the day with no matching rise in enquiries.

Even when fake clicks are credited back, the visits still reach your site. They inflate analytics, distort conversion rates and can trigger form submissions or sign-ups that look like leads.

Treat paid-traffic landing pages like any other page automation targets: watch for visits with no interaction, filter known automation in analytics, and protect forms behind them with the same measures as on spam bots.

1. Use the ad platform's invalid traffic reports, and request refunds where clicks are credited back.
2. Exclude places and networks that never convert, using the platform's targeting settings.
3. Measure conversions, not clicks. Bid on what produces customers, which makes fake clicks less attractive to buy.
4. Watch landing page traffic for automation. The same signals as on bot detection.
5. Do not rely on blocking addresses alone. Fraud traffic is spread across many; see IP blocking for the limits.