Fraud Prevention in Programmatic Advertising
The Shape of Programmatic Ad Fraud
Ad fraud in programmatic buying ranges from crude to sophisticated. At the crude end: bot farms generating fake impressions and clicks on throwaway domains. More sophisticated schemes include domain spoofing (a low-quality site misrepresenting its ad requests as coming from a premium publisher's domain via falsified bid-request metadata), ad stacking (multiple ads layered invisibly on top of each other in a single slot, all counted as served but only the top one visible), pixel stuffing (a full-size ad rendered in a 1x1 pixel iframe), and click injection/SDK spoofing on mobile, where fraudulent SDK calls simulate install attribution events without a real user action.
Industry estimates of programmatic fraud losses have ranged from hundreds of millions to low billions of dollars annually depending on methodology and year — the exact figure is less important than the structural fact that fraud scales with programmatic's automation and opacity.
ads.txt and sellers.json: Supply-Chain Transparency
The IAB Tech Lab's ads.txt standard lets publishers publish, at a well-known URL (/ads.txt), a public list of every company authorized to sell their inventory. Buyers and exchanges can cross-reference incoming bid requests against the publisher's actual ads.txt file — a bid request claiming to come from premiumpublisher.com that isn't listed as an authorized seller in that domain's ads.txt is a strong domain-spoofing signal and should be rejected before bidding.
sellers.json extends this up the supply chain: every exchange publishes its own /sellers.json listing who they're reselling inventory on behalf of, letting buyers verify the full chain of custody from publisher to exchange to DSP rather than trusting a single hop.
# publisher.com/ads.txt
google.com, pub-0000000000000000, DIRECT, f08c47fec0942fa0
indexexchange.com, 123456, RESELLER, 50b1c356f2c5c8fc
openx.com, 537143611, DIRECT
appnexus.com, 2392, RESELLER
# OWNERDOMAIN specifies the entity controlling ad sales
OWNERDOMAIN=publisher.com
# MANAGERDOMAIN specifies who manages the ads.txt file itself
MANAGERDOMAIN=adops-agency.comads.txt Is Opt-In and Unenforced
Fraud Detection Layers
| Layer | What It Catches | Example Tooling |
|---|---|---|
| Pre-bid filtering | Known bot IPs, data center traffic, domain spoofing | ads.txt/sellers.json checks, IVT blocklists |
| Post-bid verification | Viewability failures, ad stacking, pixel stuffing | IAS, DoubleVerify, HUMAN (White Ops) |
| Behavioral analysis | Click farms, non-human interaction patterns | Mouse-movement/velocity anomaly detection |
| Mobile SDK validation | Click injection, install fraud, SDK spoofing | Appsflyer/Adjust fraud protection suites |
General Invalid Traffic (GIVT) vs. Sophisticated Invalid Traffic (SIVT)
The MRC distinguishes two IVT tiers. GIVT is easily identified using known-list methods: data center IP ranges, declared bots/crawlers, pre-identified non-human traffic — relatively cheap to filter. SIVT requires active, ongoing detection: bots designed to mimic human behavior, hijacked devices running ad fraud malware, incentivized traffic disguised as organic — detecting this tier requires behavioral heuristics and continuous model updates, not static lists, which is why SIVT detection is the core value proposition of paid verification vendors rather than something you can replicate with a free blocklist.
Pre-Bid Filtering Beats Post-Bid Refunds
What's Next?
Fraud prevention is inseparable from supply path optimization — tightening the supply chain to trusted, transparent paths is often the single most effective fraud-reduction lever available to a buyer.
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.