Sizing Up Click Fraud

NO ONE’S CLAIMING CLICK FRAUD NEVER HAPPENS, BUT THE LARGE SEARCH ENGINES say bogus ad clicks are a small, manageable problem, caught either before advertisers get charged or credited to the defrauded ad accounts once detected.

A report by the Search Engine Marketing Professional Organization found that 40% of online advertisers say they’ve discovered fraud among their clicks, 16% more than the previous year. Some monitoring firms have pegged the fraud rate as high as 30% to 35% of all pay-per-click ad clicks. Who’s right?

CLICK FRAUD IS DOING a bang-up impersonation of Keyser Soze, that shadowy master criminal from the movie “The Usual Suspects,” of whom it was said his greatest trick was convincing the world he didn’t exist.

No one’s claiming click fraud never happens, but some parties in the search marketing industry — particularly the large engines — say bogus ad clicks are a small, manageable problem, caught either before advertisers get charged or credited to the defrauded ad accounts once detected. Yahoo! CEO Terry Semel told CNBC in mid-May that click fraud was a “bug that needs to be fixed” but that “this has already gotten better and will continue to get better.”

In March, Google CEO Eric Schmidt dismissed click fraud as “not a material issue” for his company, thanks to detection systems and reimbursement processes in place. A few days later, the company offered advertisers $90 million in ad credits to settle a class-action click fraud lawsuit. Advertisers have until June 15 to opt out of the deal, but early reports suggest some of them consider the settlement — $30 million of which will go for legal fees — to be equally immaterial.

A December 2005 report by the Search Engine Marketing Professional Organization found that 40% of online advertisers say they’ve discovered fraud among their clicks, 16% more than the previous year. Some monitoring firms have pegged the fraud rate as high as 30% to 35% of all pay-per-click (PPC) ad clicks.

Sizing up click fraud has been difficult partly because of mistrust among the parties involved. Search engines can only see who’s visiting a site; they can’t know whether those visitors convert. So they use special algorithms to look for other telltale signs that clicks are not coming from ordinary random visitors. But they’re reluctant to reveal too much about those processes for fear of teaching felons how to defeat them. They’ve also intimated that some advertisers claim fraud any time their PPC conversion rates drop, when in fact the falloff might be due to subtle changes in ad text or other factors.

On the other hand, PPC advertisers have lots of data about how visitors behave once they arrive at their sites. But they don’t want to let the engines know too much about how well their keyword campaigns perform, fearing higher bid prices as a result. That suspicion is fed by the engines’ sometimes cryptic and almost arbitrary fraud compensation policies.

“On one side, you have Google and Yahoo! saying they’re doing everything they can to track this and refund clicks, but doing it in a very secretive way” says Andy Beal, president of search marketing firm Fortune Interactive. “On the other, you’ve got the advertisers who say it’s happening, and these small tracking firms that have appeared saying it’s occurring in ridiculously high percentages.”

During the last year, several interested parties have launched efforts to determine the size of the click-fraud problem. In January, SEM consultant Greg Boser embarked on a homegrown project to test the reliability of search engine fraud detection systems — an effort that also should be able to confirm or repudiate their fraud estimates. Boser is using automated software — “click bots” — to click on PPC ads he’s taken out for some of his clients and then watching to see how good the engines are at picking out the bogus clicks.

If they don’t do a good job, he’ll publish the results to prove it, Boser promised in a blog post. “[But] if it turns out they actually are doing a solid job catching the majority of bad clicks, we’ll publish that as well,” he said. So far Boser hasn’t publicized any of the project’s findings.

Fair Isaac, the credit-fraud detection company, has gotten involved as well. Enlisting the help of pioneering click-fraud expert Jessie Stricchiola, president of Alchemist Media, Fair Isaac aims to investigate what click data is needed from both advertisers and engines to determine if marketers are getting a fair return on their PPC spending — specifically, how much is being wasted on fraudulent clicks.

And in April, click auditing firm Click Forensics issued the first findings from a study of fraudulent clicks among its Click Fraud Network, a voluntary association of PPC marketers.

The network’s findings for March were novel enough to attract attention from both industry and press. According to the results, “high threat” click fraud among the network members ran at about 13.7% for the month.

Interestingly, the index also broke out fraud figures for three different search engine tiers. It found that fraud rates ran at 12.1% of clicks on the top-tier search engines Google and Yahoo!, and 21.3% on second-tier engines such as Ask.com and MSN Search. Third-tier engines like LookSmart and Lycos saw March fraud rates of about 29.8%, according to the index.

“We’d been looking at fraud data for about three years in our Web analytics experience and as a spinoff from our former parent company, [Web analytics firm] Optimal IQ,” says Click Forensics president Tom Cuthbert. “And it struck us that there really are no good industry statistics for what click fraud looks like. Our feeling was that collective data from multiple clients, across multiple search providers and industries, would be really beneficial in developing a highly accurate scoring engine.”

In joining the Click Fraud Network, Web operators either submit their log files or add a small tag to their PPC landing and conversion pages. The tag software then marks records and tracks visitors who come to members’ Web pages through PPC ads, analyzing the data on Click Forensics’ servers using a proprietary scoring algorithm and assessing the likelihood of fraud for each click. Members get a weekly e-mail update on threat levels for their own clicks and those of their wider industry category. Members that typically get fewer than 100,000 ad clicks a month aren’t charged for the tag software. Besides fraud analysis, network members receive detailed reports on suspect or high-threat clicks among their PPC traffic.

“We’ve never believed the click-fraud guesstimates of as much as 35% to 40%,” he says. “There certainly are instances in particular cases, or seasonality issues, that have caused increases in fraud on some terms. But we think those high numbers are exaggerated and anecdotal.”

Other industry figures disagree. Michael Caruso, co-founder and president of the Click Facts auditing firm, thinks the Click Fraud Network’s approach is flawed on several levels. The data collected is statistically unreliable, he says, because the network’s sample is undefined as to the size of the participants and the segments they market in. Giving the tagging technology free to low-click advertisers skews the results in that direction. “We have clients for whom fraud can be 1%, 10% or 20% during certain periods,” he says. “Sometimes it’s zero, because the bots are smart enough to vary their approach.”

Caruso also maintains that examining regular log files won’t yield information that turns up those smart click bots. “That method won’t look deep into the automated fraud an algorithm can pull out,” he says. “It will show the obvious spikes that a monkey could figure out.”