Phone Pharming for Ad Fraud

Interesting article on people using banks of smartphones to commit ad fraud for profit.

No one knows how prevalent ad fraud is on the Internet. I believe it is surprisingly high—here’s an article that places losses between $6.5 and $19 billion annually—and something companies like Google and Facebook would prefer remain unresearched.

Posted on August 6, 2019 at 6:20 AM37 Comments

Comments

Kevin August 6, 2019 7:46 AM

The article said they don’t virtualize because it seems to be cheaper to use real devices. From the article: “One farmer said they do sometimes virtualize phones on their PC, but due to how resource intensive that can be on the computer, it works out as more cost effective to have a selection of cheap phones instead.”

Sed Contra August 6, 2019 8:28 AM

Kind of like cryptocurrency mining, a complicated way of doing nothing, with nominal “value” tacked on as an afterthought.

Clive Robinson August 6, 2019 9:46 AM

@ Bruce,

… that places [Ad Fraud] losses between $6.5 and $19 billion annually

From the things I’ve heard from people involved with the industry those estimates are conservative. I’ve heard as high as “90-95%” of the money paid in effectively gets fraudulantly churned out in some areas. Which might explain,

… something companies like Google and Facebook would prefer remain unresearched.

In part because they know the fraud figures and who is siphoning it off…

SocraticGadfly August 6, 2019 10:30 AM

@Clive: I’ve not heard “as high as 90-95 percent” but I have heard “above 50 percent,” and even that would be well above Bruce’s high end amount. (I work in the media biz, so some of what I hear is from journalism analytics websites, etc.)

Tatütata August 6, 2019 11:22 AM

here’s an article that places losses between $6.5 and $19 billion annually

That might be an overall gain for all the users who aren’t foisted advertising…

But how are these numbers arrived at? Does it take the potentially altered economics of advertising once the leachers are taken out?

I’ve heard as high as “90-95%” of the money paid in effectively gets fraudulantly churned out in some areas.

John Wanamaker (1838-1922) is credited with coining the phrase “Half the money I spend on advertising is wasted; the trouble is I don’t know which half“.

But a 2016 Forbes item added: Wanamaker Was Wrong — The Vast Majority Of Advertising Is Wasted.

So who is morally entitled to that wasted money? GAFA? The end users? The leaches? The advertisers?

Alyer Babtu August 6, 2019 12:53 PM

From the first linked article:

“there’s nothing wrong with someone deciding to be compensated for their attention”

Sure, there is everything wrong with. That someone is participating in a failure of civic virtue and polluting the common good. Why offer to pay to have your crummy ad watched ? Because you deem not enough would otherwise look at it. Why ? Because it’s annoying and/or (probably and) the product is marginal. So, why not instead work with a valid product and a real informative and minimally intrusive ad ? Just because spend happens doesn’t mean something economically real occurs.

Theo August 6, 2019 12:55 PM

Is this “fraud” in a legal sense or “fraud” in the sense of going to the bathroom during the ads?

SocraticGadfly August 6, 2019 2:41 PM

Theo, I’m not a lawyer, as noted above, but, IMO (since I’m not part of the ownership class in the media world, in part) it’s fraud in the sense of going to the bathroom. Even if it were fraud in the legal sense, how would you prove anything?

Antistone August 6, 2019 2:53 PM

I’m VERY unclear on what “ad dollars lost to fraud” actually means.

I haven’t studied this area in depth, but I would intuitively think that the existence of bots interacting with ads will not alter the number of real people who interact with them; i.e. the number of real people using the service is not changed, and the amount of ads you can show to each real user is not changed, so the bots only create “extra” interactions that would otherwise not exist.

If the bots are selectively interacting with certain ads, then those particular ads might suffer in relative terms, but if you look at the sum of all advertising, the total combined effectiveness should be unchanged.

Assuming that the amount of money that advertisers are willing to spend to get ads is based on the effectiveness of those ads, then the total money being spent should also not change. Advertisers might pay per click or per impression, but what they ultimately care about is sales, so if sales per click/impression decrease, then the amount the the advertiser is willing to pay per click/impression will proportionately decrease.

So at the level of the entire industry, to a first approximation, I would expect the same amount of money is being spent and the same audience is being reached. So exactly which dollars are “lost”?

I would imagine the real costs of ad fraud are probably in the areas of:

  • The market becomes less efficient because the effect of advertising becomes harder to measure or predict
  • The people selling ads have to pay for higher bandwidth to serve the bots
  • Fraudsters make the entire world incrementally poorer by consuming resources in a negative-sum endeavor

But it’s exceedingly rare that I see pundits even attempt to put dollar figures on things like those.

It’s also interesting that their polls show advertisers are more worried about fraud than about the difficulty of measuring impact, since I would think solving the latter problem would pretty much nullify the first.

Peter A. August 6, 2019 4:02 PM

Sometimes I think most of the ads are lost money for advertisers. Maybe I just extrapolate from a few really bad cases of ad placement but that’s just me.

Two notable cases:

Some time ago a huge billboard next to my place showed an ad of a company building high-voltage power lines. How many of the passers-by would order a 400 kV line for themselves? None. Such an ad would have its place in an industry periodical, maybe – but in the street? Ad money lost.

I’ve seen Lockheed Martin advertising F-16s in all-page colorful ads in a major daily newspaper. Who of the readers would buy himself a fighter jet? None. (I know it was a political ad – but would it affect the decision-makers in the government? I heavily doubt it, and it wasn’t election time!) Ad money lost.

Peter A. August 6, 2019 4:06 PM

@Bruce: nice unconventional orthography – or a typo? I’ve seen ‘farming’ and ‘pharming’, but never ‘pfarming’ 😉

SocraticGadfly August 6, 2019 4:58 PM

@CPM: It’s very simple. Ad payments to a website from an advertiser are normally made on a CPM (click per thousand [M]) basis, as you note.

Measuring effectiveness is:
A. Difficult. From the print media/website media business, I know this. Many advertisers use the “effectiveness” claim as a stick, or schtick, already anyways.

B. Even if not difficult, behind the curve.

SocraticGadfly August 6, 2019 5:01 PM

@Peter A: The electric company, if you live in a deregulated market, wasn’t selling you 400kV lines. Rather, it was selling you itself as an electricity provider, with the idea being service reliability.

Ad No. 2? An NDAA is voted on every two years and usually not close to election season. That ad was intended for your Congresscritter. Given the bloated DoD budget, Lockheed Martin most certainly “won.”

SocraticGadfly August 6, 2019 5:03 PM

@Antistone (and sorry for calling you CPM in the first comment):

Ad effectiveness isn’t discussed even more than fraud isn’t discussed because it’s even more of an embarrassment. In today’s era of targeted, programmatic buys, both buyers and sellers of ads still don’t know THAT much more about real-world online ad effectiveness than Wanamaker did about his print ads a century ago.

Clive Robinson August 6, 2019 7:38 PM

@ SocraticGadfly,

<

blockquote>I’ve not heard “as high as 90-95 percent” but I have heard “above 50 percent,”

As I said it’s “in some areas” but not all.

Overly simply as an example,just one of many ways this is done is through a “chain of agents” trick (which is also what crashed Lloyds Insurance of London with the “LMX Spiral”).

It works like this a “face” agency sets up a series of agencies that look like they are independent but actually feed back through each other in various ways. Thus an advertising budjet comes in at one end to the face agency, and just to make the maths easy lets say the custom pays 1USD per add seen. The add gets passed down a chain with each step taking a 50% cut. Five steps later the website owner gets 1/32 ~3cents to display the add. Or to put it another way 97% of the money gets taken at various stages in a quite deliberately set up chain or spiral.

Technically not necessarily fraud, but certainly deceptive practice.

However in some cases the last agency on the chain decides they want a larger slice, so they set up a series of fake websites full of “striped content” etc. The web hosting company then using a variety of tricks fakes the display logs in essence the add gets seen by one set of eyballs and nine “virtual eyeballs in the cloud”…

The tricks are not exactly new you can find their earlier “real world” examples if you know where to look (Lloyds being a very public one, but banking and brokering are full of “faux markets” to “rentseek fees without cause”. You may remember what caused Banking Crisis 1 “BC1” and “BC2”). The fact they’ve moved into the more lucrative “Online Marketing” game is hardly surprising. Marketing is after all the words biggest industry where on average 90% of “new to market” efforts fail anyway.

Obviously there are all sorts of other paper shuffling excercises and tricks out there (collecting info on them is kind of a hobby).

However the reality is many people along that chain have a pretty good idea of exactly what is going on down stream of them, they are not exactly daft. But importantly “it’s not in their interests to say anything” back up the chain. So like a bunch of modern day Nelson’s they set their course and put the spyglass to their blind eye and say “nothing to see”.

There is the old joke about the founder of a business showing his heir around for the first time, and saying to him,

<>”Son we’re going down to marketing, if you can tell the difference between one of our execs and a con artist, let me know… and I’ll sack him for not being upto the job.”

Mark August 6, 2019 7:45 PM

@Bruce

something companies like Google and Facebook would prefer remain unresearched.

Why this comment? Google and Facebook have invested heavily into fighting ad fraud. Google semi-frequently posts about click fraud botnets they take out. Are you suggesting that’s just cosmetics?

SocraticGadfly August 6, 2019 8:17 PM

@Clive, got it, and if not clear before, I was speaking primarily within the media world (where a fair chunk of this takes place). But, as you note, there’s plenty of advertising elsewhere, and in today’s world, a lot of this shades into public relations, marketing, etc.

That said, the “in their interest” comment applies across the board.

@Mark Clive’s comment right there is why you shouldn’t read too much into Google & Effbook. They fight ad fraud when it’s in their best interest, which ain’t always the case.

To riff on Clive’s old joke with an old cliche: “There is no honor among thieves.” I.e., Cambridge Analytica in Effbook’s case. Seriously, you would trust anything it says? Likewise, Google’s “Do no evil … well, let’s trim sails in China … well, let’s …”

And, per my comment to Antistone, you’re also assuming Google and Hucksterman are that good at catching fakes. Are they?

Clive Robinson August 6, 2019 8:24 PM

@ Mark,

Are you suggesting that’s just cosmetics?

I doubt it.

Look at the process as a “game” where the opponents have two different objectives. The first is to “get an add infront of as many real eyballs as possible” the second is to “get as many adds as possible infront of their virtual eyrs”. Thus the game is “Real-v-Virtual eyeballs” with the actual game play on how well you do it.

Thus Google has to work out how to tell real eyeballs from virtual eyeballs “WITHOUT” upseting real eyeballs who will then nolonger play.

The farmers have to work in that gap so their eyeballs look real to Google whilst being virtual.

If you think about it, the problem is whilst Google could detect more virtual eyeballs it would loose them real eyballs to do so.

Worse each time Google or whoever change their technology it will not take long for the farmers to make mods to beat it…

Back in the 1990’s a UK Satellite company had an issue. It’s monthly subscription card which contained a CPU and custom algorithms was getting duplicated and allegadly that was hitting their revenue. The company would come out with a “technical fix” every few months only to see it getting cracked withon days… They ended up haveing to do a whole new design virtually from scratch with security built in at all levels.

It’s actually not in Googles or their advertisers interest to go to hard after virtual eyeballs because of the collateral damage in numbers of real eyeballs. As neither loss is linear to the measures you end up with a “sweet-spot” where you accept a small number of fakers for a much larger number of real eyeballs…

SocraticGadfly August 6, 2019 9:31 PM

As far as how much knowledge sellers have about their ads effectiveness?

I suspect it’s less than they did five years ago.

I don’t know absolute numbers, but I suspect a lot more people today use Ghostery and other tracking blockers. Remember, Firefox just came out with its add-on a few months ago to block Facebook tracking you across the web.

Thomas August 7, 2019 12:35 AM

@Clive Robinson, SocraticGadfly,

“The tricks are not exactly new you can find their earlier “real world” examples if you know where to look (Lloyds being a very public one, but banking and brokering are full of “faux markets” to “rentseek fees without cause”. You may remember what caused Banking Crisis 1 “BC1” and “BC2″).”

It may be difficult to distinguish “fraud” because had the industry itself not created out of thin air.

The entire “marketing industry” is based on metrics invented in the MBA schools of thoughts which pre-date back to the early television & radio days, which evolved out of newspapers. This is related to the banking cause because it create a new industry into which “bubbles” can be inflated using fiat money. By creating “value” out of thin air, as in objects of abstract existaniality, the schools of MBAs have created livelihood or professions for laymen to build their careers on, which contribute to “the cause”. In the not so distant past, we saw this in “dotcom” boom which created various professional career paths as outlined by a web of certificated qualifications based on the techincally outlined undertakings of the time.

The con game goes on…

Thomas August 7, 2019 1:00 AM

@Antistone,

I believe in some ad network instances, you get paid for the amount of click-thrus originated from your particular web page. The fraud is on the amount paid out to these hosts.

65535 August 7, 2019 10:36 AM

In Finance and accounting they have a saying “It is a long way from the top line to the bottom line of the Income Statement” [Gross Revenue down to net income].

All of Vice’s [Motherboards] testimonials contained no hard data or documentation.

“For most of the week-long test period… In all, we made 50 cents worth of Perk points.” -Vice

[and]

“I am no longer using Supervank since they slashed earnings by 75 percent,” one user in Mr. E Media’s Discord wrote earlier this year…One of my reasons of [sic] taking a long break was the time needed to manage it didn’t seem worth it,” CallMeDonCheadle said.” -Vice

ht tps://www.vice-c0m/en_us/article/d3naek/how-to-make-a-phone-farm

I am wondering if one adds up all of the costs, capital investment, bandwidth, monthly cell phone contracts, and taxes, if there are any real “net profits” – other than increased YouTube click through money and website income. I am skeptical.

Has anybody run the numbers?

[Links broken to hamper bots]

Andre Maciel de Amorim August 7, 2019 11:25 AM

@ Sed, That’s why I believe in electricity as proof-of-work. Energy is a fundamental asset to our modern society and that is the price to keep the blockchain secure and avoid the double-spending problem. Bitcoin mining only can be considered an environmental disaster if the source of the energy is not eco-friendly, on that sense, bitcoin mining is agnostic. If I am not mistaken at the current difficult it cost about $8.000 to mine 1 btc at the USA.

I just picked a comment from physics.stackexchange

“How is energy related to entropy?

Temperature is the increase in a system’s energy when an entropy bit is added. … No matter how you define entropy as hidden information or diffusion of energy or log of microstates or as heat divided by absolute temperature, the arrow of causality is from energy to entropy and not the other way around.”

Clive Robinson August 7, 2019 12:49 PM

@ Andre Maciel de Amorim,

causality is from energy to entropy and not the other way around.

That is not correct.

The process is called “entropy” and it is the movment of the duality matter/energy from “the organised to the disorganised” or if you prefere from “coherent to incoherent” states.

But the inverse of entropy is rather more interesting, because it makes entropy a method of possibility.

Think of the physical world like lego bricks (yup the universe is granular). Originally it was highly coherent/organised but there was very little that could be done with it as there was no redundancy in it. Think of all your lego bricks put together as one hugh block, all you can do is move it up, down, sideways and rotate it. Split into two large blocks and your posabilities go up accordingly but also you get a series of relationships with respect to each other. As you keep going the possibilities go up as do the relations. Thus your ability to do things likewise goes up, the more redundancy or entropy the greater the possabilities

When the universe has become a soup of particles, there is actually no reason why it can not in the main become a single coherant whole again[1], it’s just that the probability is very very very small. Obvioisly way less than the posability of a dropped and now smashed glass jumping up back into your hand whole again.

If you think about it living creatures take less organised matter and make it more organised. However the process takes more energy thus the process does follow the rules of thermodynamics.

[1] As we know from going from a crystal into a liquid you do need to put energy in to break the bonds. It’s why when you make icecream the old way where you have mixed the ingredients into the custard in your bowl that is down at 0C, because it is sitting in a lot of crushed ice and a little water. When you add salt to the ice the temprature drops by around 5C causing the energy to come out of the “custard mix” causing it to freeze,

https://www.science-sparks.com/how-to-make-ice-cream-with-ice-and-salt/

Sed Contra August 7, 2019 2:34 PM

@Andre Maciel de Amorim

Blockchain methods may be capable of important uses, but cryptocurrency seems like an unreal belief system. Energy is expended but for no purpose. It all seems reminiscent of Hesse’s Glass Bead Game, a utopian solipsistic nominalism.

NoName August 7, 2019 2:47 PM

I work in a very specific IT field, as a consequence I can pretty much track all of the potential customers (entire field is sub 100 organizations) and target them directly. This is how we normally do BD – direct outreach and through conferences. A few years back as an experiment I created Google AdWords account and created a simple and very specific search term based advertising campaign. Initially I observed huge, unrealistic engagement coming from third-party (100s of clicks per month) sites. When I restricted advertising to only Google search, clicks reduced to sub 10 per month, a more realistic, but still inflated estimation of plausible. However, after I cut off third-party clickfraud Google retaliated, penalizing relevance score of all ads (they are 100% targeted, as search terms I used is an exact match to what we do) and by refusing to show my ads on the first page of search results and also increasing my per-click cost drastically (from $0.25 to $5.00+). Ironically, there is no competition for these search terms and it is easy to check/observe. So this created a strange situation where NO ads would be shown, but my ads would be somehow outbid/suppressed to second page.

TL;DR Google AdWords by default are 99%+ click fraud, if you try to limit it yourself by being clever with restrictions Google will jack up your per-click costs and penalize position of your ads. That is, Google expects you to pay for click fraud, or else it will stop showing your ads altogether.

Humdee August 7, 2019 6:53 PM

@Mark

“Why this comment? Google and Facebook have invested heavily into fighting ad fraud. Google semi-frequently posts about click fraud botnets they take out. Are you suggesting that’s just cosmetics?”

If @Bruce isn’t, I am. A point I have made in the past. But more importantly is a first order problem which @Clive hinted at…how do you tell what is cosmetic and what is not in a virtual world? Google could be botting their own servers and how would anyone know?

Dom August 8, 2019 1:31 AM

@65535, “Has anybody run the numbers?”

In our present financial system, turning a profit is apparently not as important as getting the “mission” or “paradigm” down correctly. It took Amazon more than 20 years to “turn a profit” while we saw its “valuation” skyrocket over the years.

Dom August 8, 2019 1:36 AM

@Humdee,

Likewise, it’s very difficult to calculate the impact of a 5 second Super Bowl commercial. The whole industry is based on a perceived “paradigm” that gets pushed thru. When you look at the overal retail market, a lot of outlets are “cornered” by middlemen entities making it very hard for small entrants. What Amazon brings to the table is a way for the middlemen to be cut thru their structured “direct sale” formats. The whole retail industry appear to move in that direction so we’ll continue to see smaller and medium channels get squeezed out until there’s only one or two big players left. Google plays this game very well because they’ve cornered the online ad market, so if you want an online “brand presence” you must pay Google its hefty ransome.

Alyer Babtu August 8, 2019 3:18 AM

I promise to watch ads and you pay me. What about the dual (adjoint ?) process: I promise not to buy anything and you don’t show me (ever) any ads ?

Clive Robinson August 8, 2019 6:29 AM

@ Alyer Babtu,

What about the dual (adjoint ?) process:

Do not ever assume that marketing people know what logic is…

Hence they can not reason out you would not be interested in what they have to say.

That is their logic is,

1, It’s of interest to me,
2, I’m human
3, You are human
4, Therefore it’s of interest to you.

The fallacy in their argument is obviously point 2 😉

Alyer Babtu August 8, 2019 10:04 AM

@Clive Robinson @Wael

Belated realization, the dual fraud – I sneak out and buy something while you continue to not show me ads. But wait …

David August 10, 2019 4:09 AM

The concept of “fraud” is of elusive nature and varies by perspective. What “fraud” is committed is determined solely by the system designers derived from the “intended usage” doctrine. We’ve seen this done in the past when a “system” isn’t used as its designers intended they either modify the system or change the rules to force its participants to behave differently. In some cases, outright legal action is taken against its participants who fail to use the “system” as “intended” by the designer. Thus, “fraud” is an arbitrary concept that is not based on solid predefinitions, that is the definition of what constitutes fraud changes based on time, perspective, and system designer. Thus, I am of the belief that “ad fraud” isn’t a crime.

joergen August 13, 2019 9:08 PM

Would not surprise me if some of the pfarming is done on other people’s phones, through cheap or free apps that users install on their phones

…and through that give access to who-knows-what capabilities to the developers of those apps

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.