How to detect and investigate click fraud--and to ensure that the precious traffic from your PPC campaigns is of the highest quality

By Mark Simon

The issue of click fraud has haunted the paid search marketplace since its inception, and has created extraordinary tension between marketers--those who buy clicks from the search engine--and the search engines that profit from the sale of those clicks. This tension has resulted in lawsuits, legal settlements, the promulgation of numerous committees dedicated to fighting click fraud, an entire cottage industry of click-quality monitoring services and even the advent of search engines that eschew pay per click (PPC) for the more fraud-resistant model of cost per action (CPA). Unfortunately, most progress on this issue has been "too little, too late" for marketers, who understandably have a zero tolerance view of click fraud.

How large is the click-fraud problem? According to click fraud research firm Click Forensics, click fraud accounted for 16.2 percent of all paid clicks in the second quarter of 2008. This figure has been discounted by the search engines, which claim that click fraud represents a far lower share of overall paid clicks. But even if the actual figure is only in the single digits, if you're a small marketer in a competitive vertical, click fraud costs may still represent a crushing penalty that can make or break your PPC search campaigns.

While many PPC marketers are aware of the destructive potential of click fraud, research conducted by SEMPO (the Search Engine Marketing Professional Organization) shows that almost half of PPC marketers do nothing to track it, and that nearly a third of PPC marketers are either not concerned about click fraud or--worse--completely unaware of the threat. Given the magnitude of the damage that a click-fraud attack can cause, this complacency is alarming, bordering on egregiously negligent.

"Click Fraud" vs. "Invalid Clicks"
The term "click fraud" is one that the search engines don't like to use, preferring instead to include this behavior within the category they refer to as "invalid clicks." This category includes:

1Clicks made by human beings--usually competitors--whose intent is to inflate advertising costs. Victims of such conduct may be forced to lower bids or withdraw from the market entirely. The damage inflicted by such fraudulent clicks may be severe, especially for verticals in which keywords are of high value. For example, in the legal profession, certain keywords (such as "mesothelioma," which may command prices as high as $50) are so expensive that even five or 10 phony clicks per day may quickly exhaust a law firm's daily PPC budget;

2Clicks made by human beings who are looking to cheat PPC ad networks, which share their click revenue with publishers. These publishers' sites belong to PPC ad networks; the publishers click on ads on their own sites--so that the networks will charge the advertiser for their clicks--and share a portion of that click cost with the unscrupulous publisher. The victims of such attacks are advertisers using the search engines' large contextual networks or other PPC networks;

3Clicks generated by non-human means--including automated scripts or other tools--deployed to drive up competitors' ad costs or to inflate publisher revenue. According to Click Forensics, 25 percent of click-fraud traffic currently originates from so-called "botnets"; and

4Clicks of no value to advertisers, often attributable to user error--such as clicks which occur in a short space of time to the same paid listing, which are due to habitual double-clicking or some other user mistake.

The search engines claim that they do everything they can to filter out such invalid clicks, both proactively--using automated filters to detect suspicious activity--and reactively, employing teams of analysts to investigate complaints from advertisers about potentially fraudulent clicks. But search engines are naturally hesitant to reveal exactly how these systems work, arguing that disclosing too much data will give click fraudsters exactly the information they need to avoid detection.

While the engines' reluctance to reveal their detection methods is understandable, it results in the unfortunate situation where the engines are effectively telling marketers, "trust us: we're smart and we known what we're doing"--an attitude which does little to mollify marketers convinced that they are victims of fraud. Instead, the onus for detecting whatever fraction of click fraud successfully evades the engines' detection methods falls to the marketer, adding yet another job to the complex series of tasks required to run profitable PPC campaigns.

What To Watch For
There are several telltale signs to watch for that may indicate that you've been victimized by click fraud. They include:

1Sudden increases in click volume that occur spontaneously and are clearly not the result of any deliberate modifications you've made to your PPC campaign;

2Sudden unexplained decreases in conversions, ROI or ROAS;

3For marketers whose campaigns are budget-capped, unexpected exhaustion of daily budgets without a corresponding uptick in conversions;

4Sudden increases in clicks from overseas IP addresses or from other IP locations that are not within the geo-targeted range of your campaign;

5Sudden increases in clicks on specific keywords from a certain contextual network, with no corresponding click spike on similar keywords on other networks; and

6Duplicate clicks from the same IP address. This phenomenon may be innocent (several ISPs, including AOL, routinely assign the same IP address to multiple users), but it may also indicate that a click-fraud attack has occurred or is underway.

What To Do
First of all, don't panic if you believe that you're a victim of a click-fraud attack. But you will likely need to take fast action to prevent further damage, as costs can add up quickly. Here are some steps you should take immediately to stem the bleeding if you have cause to believe you're a victim of click fraud:

Disable paid listings on the search engine's contextual network. Doing so will immediately eliminate your exposure to any fraud carried out as an attempt to inflate publishers' site revenue.

Run an invalid clicks report using the search engine's own tools. These reports summarize the number of invalid clicks that are automatically filtered out by the engine's methods. In Google's case, you can see reports dating all the way back to January 1, 2006. The number of invalid clicks reported by these tools should be more or less constant. Any anomalies should be reported to the search engine.

Initiate a click-quality investigation with the search engine. Obviously, search engines have a lot to lose if advertisers lose confidence in their ability to ferret out click fraud--and the engines have the resources to pursue and legally prosecute fraudsters. While there are no guarantees that the engine will find the bad actor or be able to prevent future fraud, launching a formal investigation is the best way to protect your interests (and those of other marketers who may also be victims). Be prepared to provide detailed server logs, a list of suspicious IP numbers and any other data that can help document the alleged fraud.

Finally, consider hiring a third-party auditor, either a specialized click-fraud monitoring firm or an SEM agency whose tools include click-fraud auditing in its service offerings.

Thinking Beyond Click Fraud
Given that the PPC model is a standard fixture of all the major engines, marketers cannot escape its peculiarities--which include click fraud--if they want to reach the vast majority of searchers. Fortunately, marketers can take steps beyond those required to ferret out and/or investigate fraud to ensure that they're buying the highest possible quality traffic from search engines. The most important of these steps is to leverage engine-provided or third-party listing management tools to limit exposure to non-converting clicks. These tools include powerful segmentation technologies that allow marketers to target their ads' exposure to audiences deemed the most valuable.

For example, if you are selling luxury cars, you obviously do not want children surfing for toy cars to click on your ads. To avoid this unwanted searching population, you might use day-parting technology to remove listings during those times that these children are active online. Geo-targeting and the appropriate selection of match types (including the all-important negative matches) can further limit your exposure to searchers who have a minimal or non-existent chance of actually buying your products or services. You may also want to revisit the issue of whether it is efficient for you to be aggressively advertising within a given search engine's contextual network, or whether those dollars might be better spent on targeted placements on a secondary search engine.

Will Click Fraud Always Be With Us?
Because of the unique nature of the PPC marketplace--which reward the engines for serving clicks, whether or not conversions actually occur--it is unlikely that click fraud will ever be completely eliminated. Several entrepreneurs, including Bill Gross (who invented Overture, the original PPC search platform subsequently incorporated into Yahoo) have argued that the click-fraud problem will be solved only if marketers move to a completely new model based not on cost per click but on cost per action, which entails marketers only paying search engines once a conversion has occurred. Despite the promises of CPA, the model is not popular with publishers, who obviously stand to gain more from a system that charges advertisers--and pays publishers--according to advertisers' clicks, and not according to the more infrequent conversions arising from those clicks.

Some have argued that stakeholders in the health of the search ecosystem need to do more to fight the problem. This group includes the engines, which ultimately have the most to lose if advertisers lose confidence in them. Other stakeholders include search and online industry organizations, like SEMPO and the Interactive Advertising Board (IAB). In recent years, SEMPO has teamed up with Fair Isaac Corp. in joint studies whose purpose it is to better understand click fraud and click quality. The IAB has launched a similar initiative.

But while there has been much talk about click fraud in recent years, at least for the foreseeable future, marketers will continue to be on their own when it comes to combatting the click-fraud problem. That's unfortunate, as the time spent monitoring click-fraud inevitably takes marketers away from other, more directly profitable tasks. But as the saying goes, "eternal vigilance is the price of liberty"--and constant watchfulness over your PPC campaigns to monitor their exposure to fraud is the only way to ensure that you're not being ripped off.

Mark Simon is the vice president of industry relations at Didit, a leading search and interactive marketing agency based in Rockville Centre, New York. He can be reached via e-mail at mark.simon@didit.com.