Click Fraud

The New York Times ran an article yesterday saying that Microsoft is suing three people in a click-fraud scheme.  The investigation took more than a year and the company is seeking $750k in damages.

Click Fraud is when people manipulate clicks on an advertisement on the web.  The more you click, the more money you can make but if you automate the process, you can end up making a lot of money.  Of course, the vendor who foots the bill pays for all of those clicks and if someone is clicking on it without any attention of purchasing, that’s fraudulent and is not the way web advertising is supposed to work.  According to ClickForensics, about one in seven clicks on an advertisement is estimated to be fradulent.  That sounds like a staggering amount… but I guess compared to the 97% of email traffic that is spam, it’s not so big I suppose.

Here is how Microsoft detected the anomalous patterns:

Microsoft said it found a pattern of click fraud on its search pages, where lists ranked by relevance and popularity appear alongside a handful of paid results. Advertisers bid on what they will pay to appear in the paid-search results for certain keywords. The more an advertiser pays, the higher they are in that list, and advertisers usually pay for each click on their ad.

In March 2008, several auto insurance advertisers began complaining to Microsoft that traffic to their ads was spiking suspiciously. Microsoft looked at the searches being conducted, and noticed that searches for keywords like “auto insurance quote” had sharply increased. And clicks to the advertisers appearing at the top of the paid-search results listings for those terms were high.

Microsoft investigators noticed there was an oddly similar pattern in a seemingly unrelated area, advertisements for the game World of Warcraft. Though investigators weren’t sure how the two were connected, they began to see some similarities. Although traffic appeared to come from different computers, it was actually coming from two proxy servers, which mask the original address of a click.

Microsoft began trying to stop the suspect traffic, but a little game evolved. Microsoft would block a server, or block a certain level of traffic for those advertisements, but whoever was on the other side of the clicks kept finding new ways around the company’s fixes. [tzink – This is almost the same tactics used by spammers and botnets, once a bot’s IP gets listed, the spammer drops the bot and moves onto another IP. A cat-and-mouse pattern like this is generally indicative of abusive behavior]

Microsoft didn’t know why someone would be interested in both World of Warcraft and auto insurance ads, though, until a third party told investigators that an advertiser for World of Warcraft keywords was also taking a fee for directing traffic to auto insurance sites. Investigators figured out that seven different accounts, registered under different individual and company names, were linked to the three defendants.

Microsoft’s theory is that Mr. Lam was running or working for low-ranking sites that took potential client information for auto insurers. The complaint said that he directed traffic to competitors’ Web sites so they would pay for those clicks and exhaust their advertising budgets quickly, which let the lower-ranking sites that he sponsored move up in the paid-search results.

When people clicked through to his site, it asked them to supply contact information, which he then resold to auto insurance companies, according to Microsoft’s complaint, which estimated his profit at $250,000. In the complaint, it also said it had to credit back $1.5 million to advertisers because of the Lams’ alleged fake clicks. Microsoft is seeking $750,000 in damages from the defendants.

Click-Fraud is much newer than spamming, but it’s still irritating all the same.  It remains to be seen whether or not it will become as popular as spamming.  The problem for “spammers” of click-fraud is that they are not targeting individual users, they are targeting large corporations like Yahoo, Microsoft and Google.  These companies have a vested interest in protecting their own financial interests. They have a lot of resources to expend when someone is abusing their services which they have to pay for.  It’s one thing to abuse something that is free, and quite another to abuse a paid-for service.

I would think that the latter has more inherent risk.