Does the uncovering of Methbot fraud spotlight a glitch in the industry’s ability to self-govern?

“The problem is we are all (ad-tech companies, agencies, publishers, police) hopelessly outgunned by cyber criminal gangs with virtually unlimited resources – they are always one step ahead,” said Mark Finney, director of media and advertising at advertising body ISBA.

This is due to the processes currently in place to take action against fraud. Currently, fraud operations are closely monitored over an extended period of time and have to reach a certain level of threat before being flagged as something to kill or avoid.

“It’s an arms race,” claimed Dee Frew, senior programmes manager at the Internet Advertising Bureau (IAB) UK. “It takes a while for these things to ramp up.”

It took two months for cyber security firm WhiteOps to notify the industry of the Methbot ad fraud, in which time the Russian fraudsters had reportedly been diverting millions of publisher ad money each day.

That said, Frew believes the identification of the Methbot ad fraud - a complex technical operation that “was very well baked into the fundamental processes that run the internet” - was “as fast as it could have been”.

“The fact that it took two months to grow in scale and become identifiable and for White Ops to release the details, it feels like that was as fast as it could have been,” Frew adds.

However, the longer the growth of ad fraud is allowed to go on, the more difficult countering it becomes, said Matt Green, global lead for media and digital marketing at the World Federation of Advertisers (WFA).

The WFA reports increasing levels of concern among clients as Methbot has highlighted the scale of the threat. In a recent survey conducted by WFA, nearly 9 in 10 survey respondents had serious concerns about fraud in digital media, and a similar number (92%) believed that ad fraud is perpetuated by the structure and systems in place in the digital media ecosystem.

While fraud operations are getting ever more sophisticated, industry reaction speeds are maintaining the same level. “Arguably the industry has been slow to react to the threat of ad fraud, and we do believe that behaviour change is required,” opined Green.

“Most clients now use a counter ad fraud tech solution of some description and these undoubtedly help. But a silver bullet solution to the problem does not exist on the market,” he added.

This is especially concerning given ad fraud grew last year to become the largest form of online crime, according to consulting group Marketing Science, which reports fraud as a $31bn business per year, in the US alone. To put that in perspective, that number represents 44% of digital ad spend in 2016.

Programmatic purge

One ‘silver bullet’ solution would be a disinvestment from programmatic trading, a fast-growing automated digital marketing solution that by its nature has given rise to brand safety concerns. Finney reasoned the threat of disinvestment itself, with enough momentum behind it, would provide “a huge incentive for all concerned to take this matter more seriously”.

“Considering all the other problems stacking up: poor viewability, unsafe brand environments, and very high trading costs, maybe disinvestment is the most sensible option until the industry gets its act together,” he adds.

Green advised clients to deploy programmatic budgets towards private marketplaces (PMPs), where inventory quality can be better guaranteed, avoiding “buying blindly” on a run of exchange (ROE) basis.

Collaboration

The IAB believes greater collaboration between industry bodies is the answer, and will help all quarters become more effective at self-governing itself.

“We are all stronger fighting against a global threat like this through knowledge sharing and best practices, standardisation,” Frew said. “If everyone is speaking a common language there is less chance of people misunderstanding each other.”

Green voiced concerns about “pure propriety solutions” from counter ad fraud vendors that “risk becoming a game of whack-a-mole against the perpetrator at best, and an improved ability for the perpetrator at worst”.

“WFA believes that much could be achieved if vendors worked more collaboratively towards open source technologies and solutions,” he adds.

Government intervention

Despite the industry's best efforts, the trade bodies agree that it cannot tackle fraud on its own, and government action is needed.

"Very few prosecutions have been made against ad fraudsters and there is also more that could be done in terms of working with the authorities by reporting significant issues in the ecosystem and pushing for legal consequences to the perpetrators of fraud," Green said. "But admittedly this takes time and is extremely hard to execute against a threat which is untied to any specific geography."

Finney adds: "It is a massive issue not just for the advertising industry to mitigate (you will never stop it, just as you can’t stop all burglary), but also for authorities to tackle."

Scale

Since the IP ranges being spoofed by Methbot were within the US, UK publishers using geo-filtering are thought to be unaffected by the fraud, since those fake US browsers would have been filtered out by default.

However, it is not yet known if the same set up has been quietly running out of another country, and has not been identified yet.

Miranda Dimopoulos, chief executive and ambassador to South East Asia, IAB Singapore, said that ad fraud is a concern for all markets.

"Ad fraud is ultimately a global issue. It is a tech issue rather than one localized to particular individuals or organizations in various countries. A fraudster can be a 17 year-old in Canada or an organized syndicate like AFK13.

"In Asia, combating ad fraud – not just fake clicks and botnets but zero percent viewability and intentionally misrepresented ads – must have a place of importance in considerations as digital advertising matures and more ad spend comes into play. It needs to be seen as a necessary investment for the greater good and growth of the digital advertising industry," she added.

In Asia, the issue of ad fraud is rising as digital ad spend increases rapidly but it’s not yet as big of an issue as in the US or Europe.

However, the IAB in Singapore is already working with members on a number of initiatives to ensure the industry is aware of the risks. In South East Asia, the IAB has launched a viewability working group to establish where viewability standards in the region compare to mature markets, as well as hosting events alongside major regional businesses such as Medicorp and issuing whitepapers.

And while Dimopoulos shares the view with many that fraud is impossible to stamp out completely, she agrees with her UK counterparts that greater collaboration in the industry would help diminish risk.

"It is the industry’s responsibility as whole – from advertisers, agencies, DSPs, publishers to exchanges – to actively maintain a clean and trustworthy marketplace for advertisers and publishers alike.

"Many ad tech providers have recognised the issue of traffic quality and as a result are working on systems for detecting fraudulent traffic. Along with anti-fraud solutions, marketers need to be educated on the importance of quality inventory to better understand programmatic. Ad fraud will continue to thrive if the only metric of importance to auditors and advertisers is lower CPMs," she argued.

Additional reporting by Asia editor Charlotte McEleny.