detecting fraud through traffic analytics

Sven [email protected]

Example Company Inc.

• Monthly Marketing Spend

$ 150.000

• Commission Payout

$ 5

• Percentage of Fraud

15%

Annual Financial Damage

$ 270.000

AN OVERVIEW OF FRAUD

IS YOUR TRAFFIC HIGH-QUALITY?

Our research suggests that 18% of all Paid Web Traffic is Fraudulent.

It goes further than that with Mobile where Fraud can be as high as 40%.

Clean82%

Fraudulent18%

COMMON BEST PRACTICES

• ARPU Analysis

• Referer URL Checks

• Affiliate Screening

• Conversion Rate Analysis

• IP Address Checks

THE NETWORK DIAGRAM

ADVERTISER

Network 1 Network 2

Affiliate 1 Affiliate 2 Affiliate 3

Your traffic presumablycomes from a limited number of affiliate ID’s.

Only a careful and complex analysis can bring your business back on the right track. FRAUDSTER

BUT IN REALITY …

ADVERTISER

Network 1 Network 2

Affiliate 1 Network 3Affiliate 2 Affiliate 3

Sub-affiliate 1 FRAUDSTER

Networks are very often signed up as affiliates to other networks.

Fraudsters can only be driven away for a limited time.

ISSUES WITH TRADITIOANAL SCREENING

• Analysis require at least 300 conversions• Precious time is wasted• Affiliates sign under multiple fake accounts• Networks exchange offers on a daily basis• Having to deal with cancelation isn’t helping

and fraudsters simply keep at it …

FIRST STEPS TO TACKLING FRAUD

Check your affiliate’s IP on sign-up, as it might be a proxy.

Limit countries that can join in.

Ask for SMS validation of their new account.

Stop wasting money

START SIMPLE.

CONVERSION RATE ANALYSIS

Gain new insights by checking daily and hourly conversion rates.

You can easily plot similar graphs in Excel or Google Sheets.

Clicks

Convs

Hours

PROXY DETECTION

Proxies are very often identifiable just by their name.

There are a variety of free resources on the web to check IP info such as whoer.net or freegeoip.net.

COUNTRY DETECTION

Pixels should only be fired after performing a GEO IP Check.

If possible, also store city names in your data for later analysis.

IP PATTERNS & DUPLICATES

Lead campaigns should never total more than 3% in duplicate IP’s.

IP patterns are more subtle and result from Modem or 3G resets.

Excel’s Pivot Tables are a great tool in the absence of specialized software.

USER AGENT ANALYSIS

Real traffic comes from a balanced mix of browsers and operating systems.

Anomalies are always the result of fraud or unwanted traffic.

Fraud Profile for Affiliate 5738

SESSION TIME

Session time includes the duration a user takes to download and install an app or make an account on a website.

Below-average registration times indicate automation/ bots.

REFERER URL

Direct affiliates should always have referral links when the product goes through a webpage.

If this isn’t the case, then you talk to your affiliate.

WHAT TO WATCH OUT FOR

High conversion rates at unusual times or extremely high (>30%) or low (<0.1%) conversion rates is always suspicious.

An increase in traffic without prior notice from your business partners should be carefully analyzed.

Affiliates with dubious profiles signing up, generally shortly after some other affiliate just joined is a bad sign.

THANK YOU!

Subtitle

• List item• List item• List item• List item Slide has a

CONCLUSION

Sven Hezel

E-mail: [email protected]: +49 8941613283

QUESTIONS?

You can Download this presentation here:

http://www.24metrics.com/downloads/