Marketers and publishers have been battling ad fraud on the web for years. Now, they may need to start worrying about getting ripped off by scammers on over-the-top and connected-TV devices, too.
The accelerated growth of connected-TV and OTT streaming has made the space a hotbed for ad fraud, according to verification company DoubleVerify, which just uncovered a new botnet specifically targeting connected-TV devices.
The fraud scheme was discovered after DoubleVerify saw a 40% spike in traffic from connected-TV devices, all driven by a new botnet. Botnets are created when fraudsters essentially infect armies of devices with sophisticated malware to impersonate internet users whom marketers pay their ad dollars to reach with online ads.
The connected-TV botnet specifically unmasked by DoubleVerify generated fraudulent ad impressions by spoofing real publisher URLs and sending false signals to ad servers telling them it's a connected-TV device, thereby making the impressions land on fraudulent sites instead of legitimate ones and fooling advertisers into believing that their ad was served on a connected-TV device.
According to the company, approximately one-third of the fraud signals originated from gaming consoles, and the remaining two-thirds originated from smart TVs, as they are the most generic and thus easiest to pretend to be.
"Networks of ad servers have been acting like legitimate sources of advertising but diverting revenues over from content publishers for a while," DoubleVerify CEO Wayne Gattinella said. "The news here is not the method, but the channel — which is connected-TV devices."
Ad fraud has started creeping into the connected-TV and OTT space
This ad-fraud scheme marks the first direct, scaled botnet attack that the company has identified in the environment, according to Roy Rosenfeld, head of DoubleVerify's Fraud Lab. Rosenfeld called it "the first concentrated attack of this kind, that specifically targets the connected-TV ecosystem." DoubleVerify's Fraud Lab is dedicated to continually analyzing ad-fraud trends across devices.
But the discovery of intensifying fraud activity in the connected-TV space isn't surprising, Gattinella said, given the explosive growth of video at large, OTT streaming, and, specifically, the connected-TV space.
Half of all internet users access an online-video subscription service at least once a week, and almost as many (49%) access a network-TV app at least once a week, according to the Video Advertising Bureau. Plus, streaming makes up 11% of all TV-viewing hours for people between the ages of 18 and 49 — more than doubling since 2015.
"Fraud tends to follow the money, and money tends to follow the eyeballs," Gattinella said. He added that the volume of ads and opportunity for ad fraud have grown for connected-TV devices with user adoption.
Ad fraud remains a perennial problem in digital advertising
To be sure, ad fraud has been perennial problem in digital advertising, with advertisers expected to lose $51 million per day and a whopping $19 billion through the year on ad fraud in 2018, according to Juniper Research. But the connected-TV space, which includes outfits such as Hulu, Dish, and other premier players, marks a whole new front where advertisers and publishers now must look to combat ad fraud.
DoubleVerify is not the only fraud-prevention company at the frontlines, either. Others, including Adobe, White Ops, and Pixalate, have warned against increasing fraud in the connected-TV environment, with almost 18% of programmatically sold connected-TV video ads in the third quarter of 2018 in the US being invalid, according to Pixalate, which this week received Media Rating Council accreditation for invalid-traffic detection in OTT advertising.
Once the scheme was identified, DoubleVerify extended coverage to its clients, including various demand-side platforms and supply-side platforms, shielding them from the attack.
"OTT environments pose some challenges that don't exist in other environments today," said Nick Frizzell, senior director of brand safety and inventory operations at SpotX, a supply-side platform and a DoubleVerify partner that remained unaffected by the attack. "Due to the Wild West nature of the space, the doors are open for bad actors to capitalize if purchasing isn't done with some due diligence."
While several initiatives to clean up digital advertising, such as the industry- and Google-backed ads.txt, have cropped up in recent years, the industry still has its work cut out for it.
Ads.txt, for instance, doesn't work for streaming apps and smart TVs. That's where individual players like DoubleVerify and Adobe are stepping in.
