Re: False Clicks/Click Fraud

From: David Yancey <dyancey_at_proactics.com>
Date: Tue 15 Aug 2006 12:42:32 -0500

We recently completed the Beta test for a new e-commerce site. Over a
five month period, we gained first-hand experience with clickfraud
coming from Google's Adwords program and several other PPC services. We
can confirm that clickfraud is a very serious and costly problem for at
least a percentage of e-commerce sites in sectors where competitive
pressure is intense.

I won't belabor the list readers with the months of painstakingly
detailed analysis we did. But I will share the highlights and
conclusions, in the hope that our nasty experience helps others use PPC
and similar paid search services more cost-effectively.

First, look at incidental, "web overhead" clicks -- Cliff's analysis
showing bot-triggered and other incidental useless "visitors" is
informative, but these sorts of clicks constitute what I call "click
noise" -- "traffic" that we simply have to be smart enough to ignore,
especially when quoting pages viewed to advertisers. Further, as Cliff
says, this kind of "traffic" can be expected to grow, as more
spidering-type tools are introduced.

We focused not on this "click noise", but on true "click fraud" -- since
the site used for our test is new, and has the potential to grow (as a
business) rapidly, we wanted to understand quickly if it was going to be
susceptible to click fraud. We therefore sent all PPC traffic to
dedicated landing pages, one for each ad class. Ad class is our way of
grouping text ads by ultimate target audience micro-segments. It's more
involved than simply grouping the PPC ads according to keywords, and
somewhat complex to explain, but it's a simple concept intuitively: if,
of, say, 20 ads for the site running at any one time, 3 are aimed at
folks who like widgets that *they* think will appeal to certain *other*
people, then those three ads make a "class". "Ad classes" extend
behavioral targeting theory a bit, by aggregating ads by (hopefully)
truer target criteria, to simplify the analysis and planning and
administration of aggressive, large, PPC campaigns.

Anyway, the point is that we were very rigorous in tracking traffic
against PPC source, using specific pages for each ad class within each
paid source. We were thus able to measure not only the number of
clicks, frequencies, and time-of-day, but the *comparative* visitor
behavior and ultimate conversion rates for each such clickthrough. This
means, for example, that we can see how alleged visitors coming from
Google "behave" as compared to those from other sites, for the *same ad,
at the same time of day*.

We also tried to be rigorous in terms of defining fraudulent clicks as
opposed to incidentally (ie, unintentionally) recurring clicks.
Differentiating among these is problematic, and I don't propose to
detail here how we approached it. There are many solid discussions of
this analytical problem available online for those who wish to learn
more. Suffice to say that we are 95% confident we can deduce if
multiple clicks from a given IP address are truly "fraudulent" or not.

For competitive reasons, I will not say here how many clicks we measured
over the Beta test, only that it was in the many thousands. I should
also add that we quickly eliminated AdSense ads from our test campaign,
feeling that these are much too fragmented (in our specific categories)
to allow qualified measurement.

Collectively, the Beta test showed that at least 30% of the Google
clickthroughs were fraudulent. I say "at least", because I am sure the
fraudsters are several steps ahead of us (and Google, too) in disguising
the fraudulent clicks. We are also very confident that if we had
allowed AdSense ads to stay in the test population, *and* if we could be
sure how to differentiate the bad AdSense apples from the good ones, the
overall fraud number might reach 50% or even higher (in our case).

Why is the fraud count so "high" in this test? Well, the fact is that
we don't really know if it *is* all that high. Most people who claim
that click fraud is not such a big deal have no actual statistically
valid evidence to back their claim, in our experience. And those who
say that Google is on top of this situation are perhaps naive,
technically. Give me a large enough network of zombies, a
spider-generated list of sites displaying selected AdSense ads, some
targeting keywords, and one solid scriptwriter, and I will produce many
thousands of clicks from many thousands of IP addresses in a few days.
These will seem to come from all over the map, but of course I would
weight them so that most will seem to be US in origin. I'll also time
the flow to match the proper day-part in the US market. And then I will
switch the whole operation to a different zombie network every few
hours. I'll further slice and rotate my hired zombies across all the
different PPC sites where the targeted ads appear, knowing that it is
certain Google and Yahoo and MSN will never compare their raw
clickthrough data. Believe me, folks, tracking *all* the clickfraud is
*way* harder than you probably think.

We should also correct another misconception, namely that the
click-fraudsters are employing a zillion Indians or Chinese or
impoverished Russians to pound their keyboards. Clickfraud is very
likely 98% automated at this point. That means that if you give my
baddies a chance to earn, say 10% of a PPC bid that averages just 40
cents, then I can probably clear at least 50% net per click. Figure
only, say, 100,000 fraudulent, automated clicks per day, and I have an
appreciable tax-free income if I happen to live in Romania or Brazil.
Or Omaha, for that matter. Raise the average bid level to, say, $1.00,
and I am making nearly two million bucks a year, untaxed profit.

But some ask what is the motivation for some bad guys to pay the
operators of click fraud networks to generate fraudulent clickthroughs?

The answers are, again, detailed, and will vary somewhat depending on
each industry, and, especially, on the prevailing keyword bid prices in
the individual market sector. Most simply assume that the bad guys are
trying to quickly consume the defrauded competitor's PPC budget, forcing
them to spend more, and hence raising their costs.

We are pretty sure this happened to us, since we are a brand new site
and company, and can be presumed to have a minuscule PPC budget. Any
competitor in our sector could quickly determine this, and also that our
particular targeting approach and products are uniquely fresh and,
according to our test shoppers, very appealing. So it makes sense to a
dominating competitor to try and kill off our budget out of the gate.
Like it or not, the PPC systems run by Google and Yahoo et al make this
kind of counter-marketing easy.

But actually, most clickfraud is probably much more subtle: the criminal
company uses clickfraud to *drive the victim company's ads off the
visible or upper end of the AdWords list on search pages*. The clever
bad guys simply work the rules used by Google to determine which ads are
the most "popular", to make sure the target company's ads don't show up
at the most desirable times of day. It's really more about
*positioning* the bad company's *own* ads, than simply trashing a
competitor's ad budget: If I were a bad guy, I'd be only too happy to
spend, say, an extra 15% or even more per click to *keep your and any
other serious player's ads from.ever showing up in prime net time*.

Plus, there is the very substantial pay-off: if I can zap your daily ad
budget quickly, and drive you off the search pages, I can then *lower*
my own bids, possibly even enough to pay *less* on average per
clickthrough to my own site. It's called eating you and having your
cake, too.

In our case, and this must be true for many thousands of businesses,
this seems to be the explanation. As a brand new small, but potentially
major site in an intensely competitive sector, casual fashions and
accessories, it seems certain that at least one major competing vendor
went after us as soon as our Google Adwords ads began to place in the
top 3-6 positions. We found that lowering the bid to move the ads down
the right-side list significantly cut the level of fraudulent clicks.
This lends credence to the presence of automation I described earlier.
Our ads which measured highest in "pulling effectiveness" were the ones
most targeted for fraudulent activity. Ads for more specialized, less
pricey keyword phrases attracted less fraudulent activity, which makes
sense for a number of reasons.

(If the List is interested, I will gladly publish a substantial
follow-up post on the promotional action plan this unhappy test of PPC
has led to, and how we are proceeding to build this new business without
throwing most of our promo budget away on ineffective PPC services.)

As to Google's alleged ability to track fraudulent AdSense clicks, this
too is a common misconception, I fear. Imagine for a moment the same
sort of dynamically- rotated-IP-based clickfraud operation outlined
above. Now, suppose I am a scam-prone "publisher" who has set up a few
*thousand* cookie-cutter "web sites", and spread them over a few dozen
or perhaps one hundred different AdSense accounts. If my cut of
Google's revenue per paid click on these sites averages, say, just 10
cents, I'd be happy to split that with the clickfraudster guy,
especially if our scam produced revenue from tens of thousands of
virtually un-trackable clicks per day.

If you doubt that there are hundreds or even thousands of these
so-called "AdSense arbitrageurs" out there, don't take my word for it:
read what one of the top ten SEM experts on the planet has to say:

http://www.dmnews.com/cms/dm-opinion/columns/37863.preview

Does this make *all* publishers who use AdSense bad guys? Of course
not. But the great majority of mostly non-technical publishers out
there may want to learn more about the nefarious operations of the few
really slimy ones, since these bad guys seriously threaten the AdSense
golden goose. (They also threaten the long-time future of Google and
other crawler-based, PPC selling search sites, too, but that is another
post...)

This post is about the *probably inevitable percentage of waste in PPC
campaigns due to clickfraud*, NOT about Google, or any other particular
PPC operator. Still, I must comment on the issue of Google's and other
leading PPC services' publicly-stated views on the relative prevalence
of clickfraud. If it can be shown that from 20% to 40% or more of a
search companies PPC revenues are of a (possibly criminally)
anti-competitive nature, or are simply outright fraudulent, we'd expect
that company to be nervous, right? We'd not be surprised when they try
to buy off the potential fraud claimants with a $90 million dollar court
settlement, for starters. We'd then assume they'd do everything possible
want to stop clickfraud immediately.

Well, it might seem so at first. But then, we have to think about the
potentially massive sell-off in G's stock, along with the (less
vulnerable) shares of Yahoo and MSoft, *if and when it can be
demonstrated, then, the tough part, simply explained to lemming-like
investors, that perhaps 50% of net PPC earnings are unsustainable in a
truly mature interactive economy*.

Finally, our experience with Google's PPC service is not that uncommon,
apparently: the Search Engine Marketing Professional Organization
(SEMPO) announced a major study of click fraud yesterday:

http://www.sempo.org/news/sempo_in_the_news/sempo_teams_with_fair_isacc

Along with Google and the PPC operators, the fast-growing SEM industry
has apparently awakened (publicly at least) to the huge threat of
clickfraud, and understandably doesn't relish having to explain to
advertisers and marketers why perhaps 30%-50% of a given campaign's SEM
budget is being wasted, or even stolen outright. Hmmm, I wonder if
complicity in and funding of demonstrable fraud constitutes corporate
mis-management or Board negligence...

David Yancey
Managing Partner -- 22Graphic -- http://www.tootoographic.com
CEO -- Adjunction LLC -- http://www.vivante.com





Received on Tue Aug 15 2006 - 12:42:32 CDT