Surviving Ad Fraud in Southeast Asia

Surviving Ad Fraud in Southeast Asia

This commentary from TrafficGuard’s COO Luke Taylor originally appeared on e27.

Here’s how Southeast Asian businesses can survive in the hotbed of ad fraud.

The digital advertising boom that’s taken place over the past decade has triggered a catch-22 situation. Media spend has grown exponentially – especially so in the Asia Pacific, where digital ad expenditure constituted 46 per cent of total expenses in 2018 and is set to rise to 55.1 per cent by 2022, according to eMarketer.

On the flip side, the lucrativeness of the industry, coupled with the relative ease in which nefarious players can get away scot-free, has unfortunately made adland very arable for fraudsters. To put it in perspective: the World Federation of Advertisers (WFA) predicted that ad fraud would grow to become the second biggest organised crime enterprise within the next decade, pipped to the top spot only by the global drugs trade.

More recently, the industry has been left reeling by the dismantling of 3ve – a massive botnet operation that infected at least 1.7 million computers with malware, generating high volumes of fake traffic. As many as 60,000 fake accounts were created to swindle money from marketing campaigns. The fraudsters also hijacked IP addresses at corporations, redirecting them to their own servers.

Over four years, 3ve is thought to have collectively defrauded brands and businesses out of millions in advertising dollars through various fraud networks, with the biggest among these costing businesses US$29 million in ad spend. These are staggering numbers, but relative to the US$34 billion lost to ad fraud globally in 2018, and US$17 million lost to ad fraud in APAC on a daily basis, it’s a drop in the ocean.

And as fraudulent practices become increasingly sophisticated to evade detection, we’re likely to uncover many more 3ves, while more sophisticated operations continue to go under the radar.
‍

The vulnerabilities of Southeast Asia’s startups

The digital behaviours of Southeast Asian people put it, especially at risk.

According to eMarketer, all markets in the region saw the mobile ad spend grow by at least 50 per cent in 2018. This, along with with high mobile penetration growth rates in the Philippines (33 per cent growth, 2018-2022), Malaysia (14 per cent) and Thailand (10 per cent) would mean that fraudsters have even more avenues to target and infect devices. Meanwhile, more mature smartphone markets – such as Singapore – aren’t spared either.

Unlike the region’s emerging markets, however, it’s the high amounts of advertising dollars going through the nation that make the country a target. That puts small businesses and startups in the region in a tricky situation – because to achieve scale, these younger organisations are typically more reliant on digital advertising than anyone else, standing to lose the most from ad fraud.
‍

Shifting perceptions

Needless to say, the growth of ad fraud globally, combined with the region’s vulnerabilities, have been a major wake-up call. The speed and dynamism of said operations have cast a spotlight on the shortcomings of the prevailing industry attitude towards ad fraud — one which prioritises reactive detection when it really should be preventive and proactive.

If we compare ad fraudsters to bank robbers — by preventing fraud, you stop the robber from stealing the money. However, an approach that focuses on detecting fraud to reclaim ad spend is akin to watching the robber flee with the cash and wait for the insurance policy to kick in. The fraudster makes a clean getaway with their pockets lined and as long as they can make money, they will come back for more.

As such, every effort, and every decision made in dealing with ad fraud, across all levels of the industry, should be focused on stopping the flow of media spend to fraudsters, and removing the incentive for fraud — not waiting to fight among ourselves when the funds are gone. With that in mind, let’s go into the specifics of what a prevention-focused approach looks like.
‍

The ideal solution will be driven by AI

Fraud evolves at a startling pace. In 3ve, for instance, evasion tactics were found to be constantly mutating — detection of one tactic or blacklisting of IPs resulted in only temporary interruptions before the agile operation adapted and resumed in full force.

The unrelenting nature of the vice makes it tricky to envision the types of fraud we’ll face in the future. And if we don’t know what fraud is going to look like tomorrow, how can we stop it? The right antidote leverages on big data to inform decisions. Relative to traditional advertising, online advertising has a higher degree of accountability, due to the swathes of data available.

We get to see what ad led someone to a website or app download page, the location they accessed the ad from, the type of device used, and even the duration between the initial click of the ad and eventual purchase. However, the problem is there’s a lot of data — the scale of the data and the need for real-time insights puts this job beyond human analysis.

This is where machine learning comes in to play — it makes sense of data, removes noise and, by analysing the data to note patterns and correlations, determines what normal human behaviour looks like versus what fraud looks like. In doing this, it’s possible to invalidate traffic not by what the fraud tactic is (as this changes), but by comparing it to what normal traffic is.

By not relying on any single method of detection, which a sophisticated fraudster could easily reverse engineer to evade the next time, and instead, by utilising a complex array of hundreds of behavioural, device, and network indicators, we can effectively prevent fraud even as it mutates and evolves.
‍

A strategic alliance

Of course, while tools of the trade are important, there’s only so much a young business or startup can do by itself — and the ecosystem is only as strong as its weakest link. Remember our focus should be on prevention. That means we must share information so that upstream intermediaries don’t pay for fraud either.

The rise of other more sophisticated, and savvier ad fraud operations is inevitable — and it has never been more important for businesses, brands and ad intermediaries to show a united front. In-house fraud defences of media suppliers are just one line of defence. Transparency within the ecosystem of advertising is crucial.

Third-party verification, for instance, ensures that suppliers of media are accountable for the quality of their supply. When media suppliers and verification solutions work together, ad campaigns benefit from the specialist skills and tech of the verification vendor — who specialises in ad fraud mitigation — and faster optimisation for better campaign performance, offered by an informed media supplier.

By subsequently sharing this intelligence with the ecosystem — such as its partner ad networks and agencies — the different players can all work together to optimise fraud out of the equation, meaning the fraudsters don’t get paid.
‍

It doesn’t stop there

A culture of openness wouldn’t be complete without continuity and consistency between partners. The current, broken modus operandi is to drop an ad network when fraud is detected and find a new one. Real-time fraud prevention and shared fraud intelligence can actually help traffic sources optimise fraud out of their supply.

This means that every campaign benefits from the optimisation and insight of working with an experienced partner as opposed to cold-starting with new traffic sources. Ultimately, the prevailing attitude of dealing with ad fraud reactively is one which is complacent and does close to nothing to deter fraudsters.

Through a concerted industry effort to tackle the challenge, powered by technology, we can pull the carpet from underneath fraudsters’ feet and stem the flow of money to fraud. That means brands and traffic sources need to have access to the same set of data and analysis in real-time, not just at the time an invoice is raised.

The industry has to tackle the problem from its roots and begin by significantly eradicating vulnerabilities throughout the ad lifecycle — thus making ad fraud as risky and unappealing a business as it can be.

‍