Richard Kahn
While a lot of ad fraud is committed using bot programs that fill out forms and generate fake leads, those aren’t the only tools that fraudsters use. To make their click fraud and other ad fraud schemes even harder to identify, fraudsters may also use human fraud farms (a.k.a. click farms) to conduct their schemes.
What is a click farm? How can they impact your ad campaigns? Most importantly, how can you detect and prevent click fraud from hurting your company’s bottom line?
Table of Contents:
- What is Click Fraud?
- What Is a Click Farm?
- Click Fraud and Social Media
- Ways Click Fraud Can Derail Your Ad Campaigns
- Tips for Click Fraud Detection and Prevention
What Is Click Fraud?
Click fraud is when bots, malware, or a human fraudster intentionally generates a bogus click on paid ads and links to steal money from pay-per-click advertisers or to exhaust an advertisers’ campaign budget.
What Is a Click Farm?
A click farm is a fraud organization that leverages large groups of cheap workers to manually click on paid ads online.
Like their bot counterparts, human click farms wreak havoc on the digital advertising ecosystem. Click farms have people clicking on ads with no intention of converting. They just visit sites and rack up worthless impressions.
Click farms may also sometimes leverage form bots to fill out forms with bogus information, generating false leads. This can be a real nightmare for online advertisers who need reliable leads.
How Click Farms Work
Watch this video to learn a bit more about how click farms work:
Reasons Fraudsters Use Click Farms
Click farms can be used to fill a variety of goals on the behalf of the farm’s customers. Some of the reasons that fraudsters have used click farms include:
1. Attacking Competition
Sometimes, outside “customers” hire click farms to sabotage their competitor’s digital ad campaigns. For a certain price, farm workers click through ads in an effort to eat up the competing advertiser’s budget. Once their competitor’s funds run dry, the farm customer’s ads have a better chance of appearing before consumers.
This is often used in Pay Per Click (PPC) campaigns to rapidly drain a target’s ad budget. The fraudster just has their “farmers” repeatedly click on the competitor’s Google SERP display ads until they’ve eaten up the whole ad budget. This PPC advertising scam allows fraudsters to run their own ads virtually unopposed even when they’re targeting extremely expensive keywords.
2. Generating Revenue from Ads and Fake Social Profiles
Click farms are also used to directly benefit the farmer financially. Some fraudsters create websites built strictly for advertising purposes, using networks like Google to sell ad space. Once legitimate ads run on the page, the farmer directs their workers to interact with the ads, in turn generating revenue for themselves.
In recent years, click farm antics have invaded social media too, as we’ve seen with click fraud on fake Facebook profiles. Clicks farms on Facebook may hit a lot of likes, but they can drive down engagement rates and hurt your company’s Facebook profile in the long term.
Look up “click farm Facebook,” and you’ll find a list of stories about click farms being used on Facebook, advice for avoiding click farms, and other information about these false click operations.
Instead of clicks, many farms now sell profiles, users, or accounts. Because these accounts are created by actual human users, often with seemingly legitimate information, they can successfully pass security filters on social platforms like Twitter and Instagram.
3. Obfuscating Their Fraud Activity
One of the reasons fraudsters use click farms is that human fraud detection is tough. Unlike bot activity, human behavior is more nuanced and less predictable. This makes it considerably harder for simple click fraud protection tools to reliably identify and stop click fraud from these farms.
In the early days of click fraud, platforms like Google and Yahoo quickly put filters in place to stop automated clicks. But the filters did a terrible job at blocking fake clicks made by what seemed like real site visitors.
So, click farms enabled fraudsters to bypass basic click fraud prevention measures to continue illicitly collecting ad revenue.
Click Fraud and Social Media
Introduced by Facebook in 2009, the like button quickly became a standard social media feature, with iterations popping up on Instagram and Twitter. Originally it was meant to show an emotional response; you literally “liked” the posted content. In 2010, the like button replaced Facebook’s “Become a Fan” feature on Pages, a move made to maintain consistency site-wide.
Now lauded as the currency of social media, likes are often used by marketers and advertisers to measure popularity and engagement. However, when it comes to garnering likes, quantity isn’t always better than quality.
In the previous section, we briefly highlighted how some fraudsters use click farm operations to artificially inflate their social media profiles—clicking on the “like” button on Facebook and other social media platforms to make themselves look as though they have a bigger following than they actually do.
Let’s delve into the problem of fake likes on social media and how click farms boost their fraudster customers.
The Problem with Fake Likes/Upvotes and Engagement
Facebook (and other social media sites) often use likes or upvotes and other user engagement data to gauge the popularity of a post. This, in turn, affects how that post is delivered to other users and what ads to run (if any).
High engagement rates tell social media platform providers that the page in question is legitimate or authoritative in some way—increasing the likelihood that the post will be promoted to other users.
For example, if thousands (or hundreds of thousands) of people click on the “like” button on a Facebook post and then add thousands of comments, that post may be recommended to more people in their feed.
However, if likes are all that your post gets and nobody leaves a comment, that could bring your engagement rate down and hurt the chances of your post being promoted to others. Unfortunately, when you work with a fraudster who’s using click farms to artificially inflate their engagement, the “fans” they send your way will likely just be the workers at the click farm: and they’ll just view and like your posts before quickly moving on to other things.
One of the major problems with getting fake likes from a fraudster’s click farm is that it skews your marketing data. The like button is a key tool in building user profiles. Facebook can map out a person’s demographic and psychographic info based on what pages and posts they like. This is a huge asset as you can easily drill into your audience stats.
However, if half the audience is built on fake likes, that data won’t be accurate. This means that Facebook (and other platforms) may start trying to put your content in front of an unsuitable audience.
Although purchasing likes isn’t technically illegal, the practice does go against Facebook’s terms of service. The platform has issued statements against phony likes, emphasizing they will “aggressively go after the bad actors behind fake likes because businesses and people who use [their] platform want real connections and results.”
How Easy Is It to Create Fake Profiles for Click Farms?
To generate a like, even a fraudster needs a social media account to associate with that activity. This means providing data like name, address, email, phone number, and birthdate. You might assume that this hurdle would be difficult to clear for a fraudster, but it really isn’t. Generating a Facebook, YouTube, Twitter, Reddit, Instagram, or other social media account can be incredibly simple.
Fraudsters often have access to a massive database of real consumer data that they’ve either stolen themselves or bought from cybercriminals on the dark web. They can simply copy/paste the data from the table and tweak the email address and they’re good to go.
With over 7 billion people on the planet, it isn’t unusual for Facebook and other social platforms to have a few repeated names or even addresses. You could even open up a second Facebook profile for yourself that uses all of the same information (including name, address, and phone number) with relative ease—all you’d really need to change is your email.
You would get a text message that looks something like this:
You might get a notification that your data was removed/changed on your main account because it was used and verified on another account, but that wouldn’t stop the creation of the second account.
So, creating fake accounts on Facebook is easy—and there’s nothing really stopping fraudsters from just creating a million “John Smith” profiles with slightly tweaked information using free Google email accounts, either. Fraudsters and their click farm operations exploit these flaws to the fullest.
How Click Farms Boost Fraudsters
An investigation by Doug Bock Clark for New Republic examined the underground world of click farms. In his visit to an “account farm” in the Philippines, Clark observed how fake users are made for commercial purposes.
A farm worker starts building a fake persona using readily available name generators. Some generators spit out only first and last names, but others go more in-depth, randomizing info like mailing addresses and birthdays. Next, the worker creates a throwaway email account for the “user.”
Then comes the actual Facebook sign-up. The “user” has a name and an email address, but Facebook wants a mobile phone number too, for verification purposes. No worries, the worker’s got that covered. A new SIM card in an old cell phone will do the trick.
Facebook sends a confirmation text, the worker types in the code, and, just like that, a new verified user has joined the network—adding to the estimated 81,000,000 fake users on the site. Farm owners can then sell the “user” for likes and follows.
We already know the text message test is easy to beat. But Facebook has other measures in place to weed out fake accounts. The network uses an algorithm -- one they won’t disclose -- to determine if users are real or bots.
However, depending on the account farm’s production standards, fake user profiles usually pass the test. The more legitimate the profile appears, i.e. the more information is filled out, the less likely Facebook will flag it as fake.
It also doesn’t help that actual humans, not software, are the ones setting up and controlling the accounts. Because real people are behind the scenes, account actions, such as liking posts, seem more organic compared to bot behavior.
3 Ways Click Fraud Can Derail Your Ad Campaigns
Pay-per-click advertising is often regarded as one of the best ways to invest your digital marketing dollar. According to Linchpin SEO, the average cost per lead (CPL) in 2022 for search engine advertising is $110, programmatic display advertising is $38, and traditional advertising (TV, radio, and print) is $619. In other words, generating leads through online marketing channels takes a fraction of the cost of generating them via traditional advertising.
In fact, Google states that: “businesses generally make an average of $2 in revenue for every $1 they spend on Google Ads.” This has led to the PPC advertising market growing significantly over the years. Fortune Business Insights projects that the PPC market will grow from its 2019 value of $12.58 billion to $28.62 billion by 2027—despite the impact of the COVID-19 pandemic.
And, of course, where there’s money, there will be fraudsters looking for an easy score. How does click fraud affect your ad campaigns? Here are a few of the negative impacts of click fraud:
1. Wasted Ad Spend
The most obvious impact of click fraud is the way that it wastes your online marketing budget. The falsified charges can quickly drain your ad budget without providing any real return on investment (since the clicks are coming from fraudulent sources that won’t convert into real customers).
Just how much does click fraud cost advertisers in a year? The estimated worldwide cost of ad fraud in 2021, according to Statista data, was projected to be roughly $65 billion. This includes not only the lost ad revenue that was wasted, but the additional costs that businesses incur in trying to deal with the other impacts of fraud. Click fraud represents a significant fraction of that total cost.
2. Distorted Marketing Results Data
When your company creates ad campaigns, it is common to use past marketing results to form the basis of future ad campaigns. But, what happens when that past data is faulty?
When you have faulty data and try to apply it to your pay on click advertising (or any other type of ad campaign), you will quickly find that your ads aren’t going to the right audiences at the right time, the messaging is ineffective, and that the leads you do get aren’t as good as you would expect.
Skewed marketing data that is corrupted with fraudulent activity from click farms can cripple your future ad campaigns unless you’re able identify it and exclude it.
3. Reduced Lifetime for PPC Ad Campaigns
One of the goals of click fraud, when used by an unscrupulous competitor, is that it can cut the duration of your PPC advertising campaigns short. For example, say you set a daily limit on your PPC campaign clicks to prevent cost overruns.
Using a click farm and bots, a fraudster could generate hundreds of thousands of clicks on your ads in mere minutes—effectively removing your PPC ads from Google search and other platforms. Then, the competitor can stop the fake clicks for the day as their own ads start to display.
This tactic prevents legitimate leads from seeing your ads so your ROI is minimized.
5 Tips for Click Fraud Detection and Prevention
So, what can you do to prevent click fraud in your current and future ad campaigns? How can you keep fraudsters from profiting or blowing through your daily advertising spending limits and ensure your ads generate a positive ROI?
Here are a few suggestions to get you started:
1. Don’t Buy Likes or Followers on Social Media
Artificially inflating likes, subscribers, followers, etc. on social media just isn’t worth it. You’ll spend money on an activity that pretends to make your social media presence look bigger than it is, but the skewed metrics from bought leads won’t help social networks accurately identify your audience so your content can be presented to them.
So, it’s best to avoid poisoning your own marketing data and resist the siren’s calls of bought likes and followers.
2. Spend Time Tweaking Your PPC Ad Targeting Parameters
Setting strong targeting parameters around your Facebook ad campaigns gives you another layer of protection against unwanted clicks. The social network made it easier than ever to target users specifically by metrics like location, age, gender, and interests. You can even use metrics to exclude groups of users from seeing your ad.
If you’re running a business page, it’s a good idea to periodically check your follower list for questionable accounts. In your Page settings, click on People and Other Pages to view a list of your followers. Here, you can individually remove or ban accounts you deem suspicious from engaging with your content.
This same advice can be applied to other marketing channels, too. Of course, to make your targeting as accurate as possible, you need to have good, clean data that is free from fraudulent activity.
3. Don’t Buy Ad Space from Publishers You Can’t Talk To
Unfortunately, not every publisher of ads or supply-side platform (SSP) provider will be on the up-and-up. There are fraudulent companies out there that specialize in taking your money and running your ads using click farms to make it look like they’re getting results when they really aren’t.
It’s not uncommon for some publishers to create a fake persona. If their reputation is already bad in the ad space, they need a cover because they’ve been blacklisted by several sites for providing bad traffic. So, they’ll pose as some other person or company, take your money, then run off.
By the time you’ve realized that they were a fraudulent advertising partner, it’s too late: they’re gone with the money.
When looking for an advertising partner, it helps to not only reach out to them directly and get a personal meeting (or at least a phone or video conference), but to reach out to other companies that they claimed as customers to ask what their experience was. Vetting ad partners can be a crucial step for ad fraud prevention, as it helps you spot a fraudster early.
4. Keep Track of Where Your Traffic and Clicks Come From
Do you know where your clicks are coming from? If you don’t, that can mean you’re an easy target for a click farm operation. “Leads” that come in from regions where your company doesn’t do business aren’t really leads at all since they cannot convert, no matter what.
So, if you’re operating primarily in Cincinnati, Ohio, but your clicks are all coming from an IP address registered to somewhere in China or Russia, you might be getting clicks from an overseas sweatshop running a click farm.
Of course, more sophisticated click farms might use virtual private networks (VPNs) to hide where their clicks are coming from. However, if you notice that a lot of your traffic that isn’t converting is all coming from a VPN provider’s data center IP address, that could be a good indicator of fraud.
Another issue with doing this manually is that it can take a lot of time to review your IP address info and determine if the activity really is fraudulent. This gives the fraudster a large window of opportunity to cut and run with your marketing money. Simply blacklisting IP addresses isn’t ideal either—since that risks throwing out the baby with the proverbial bathwater.
For example, say you blacklist an IP address used by a popular VPN service. What about all of the legitimate leads who use that service to protect their private data online?
5. Use an Ad Fraud Solution
To really put a stop to click fraud, you need to be able to flag fraudulent clicks as they happen. However, real-time ad fraud detection is virtually impossible with manual methods.
This is where Anura’s ad fraud solution can be a lifesaver for your PPC ad campaigns. Our ad fraud solution checks hundreds of data points about website visitors and compares it to a decade of real conversion data to accurately identify fraud while eliminating the risk of false positives.
When a lead is tagged as fraud in real time, you can proactively prevent payments from being disbursed to the fraudster. This is far easier and less resource-consuming than trying to hunt a fraudster down and reclaiming the ill-gotten money through a lawsuit.
Additionally, Anura gives you access to the data you need to demonstrate why a particular lead or click was flagged as fraud. This way, you can confront the fraudster directly and show your PPC advertising networks the reason why you’re demanding a refund.
For advertising platforms, the ability to spot a fraudulent click in real time can be a lifesaver, too—since it allows them to invalidate the click so it doesn’t count against their customer’s ad campaign in the first place. This reduces the risk of chargebacks, complaints, and lawsuits while making for happier advertising customers who will want to spend more money because they’re getting good< leads.
Why wait? Reach out to Anura today to start protecting your PPC ad spend!
