Custom fraud detection cut problem ad traffic more than 20-fold

Traffic-quality complaints despite an existing filter

The agency bought traffic from multiple sources for advertisers. On the way to the advertiser, visitors passed through landing pages, trackers and an off-the-shelf fraud filter. Filtering was active, but visitor engagement and purchase rates were declining. Several partners complained about large numbers of bots mixed in with genuine customers and imposed less favorable payout terms.

The popular fraud detection service already in place was not solving the problem. The agency asked me to investigate what it was letting through and address the issue before advertisers left.

Testing the filters against the agency's traffic

First, I needed independent data. I extended the backend at the stages the agency controlled, including landing pages and trackers, to collect detailed technical data on each click. Analysis showed that the existing filter was letting through a substantial share of unwanted traffic.

I then tested several other well-known services. None provided the filtering quality needed for this agency's traffic. Simply switching providers was not enough, so I began developing a custom fraud detection system.

Investigating invalid clicks and direct visits

There was no ready explanation for what was happening. After collecting data on tens of millions of clicks, I systematically tested hypotheses, from obvious signs of automated requests to visitor behavior at different stages of the journey.

• Signs of automation. Some requests contained header parameters that immediately identified them as bots.
• Conflicting technical details. Browser and device characteristics did not match on some visits. These inconsistencies exposed poorly implemented bots.
• Irregular click journeys. I examined the full sequence, looking for skipped stages and changes in visitor characteristics between steps.
• Requests outside the advertising chain. Some requests reached landing pages or advertisers directly, bypassing the paid traffic sources. Some originated in browsers. Others could be linked to particular subnets and repeated request sequences that followed specific visitors. A direct visit alone was not treated as fraud: problem traffic was identified by analyzing IP addresses alongside other characteristics. This allowed another portion of unwanted traffic to be filtered out.

I used these patterns to build a click-scoring system. It evaluates each click using a combination of signals and decides whether to pass it through or filter it out. The signal sets vary by traffic source.

Balancing stricter filtering with genuine customer traffic

The agency initially expected a simple, complete solution: install a filter and eliminate problem traffic. In practice, after the early gains, each further improvement required more work.

Once the obvious unwanted traffic has been removed, the remaining cases are rare. With less data available, reliable patterns are harder to establish. Stricter rules can mistakenly block genuine visitors, including buyers. Further reductions in residual fraud must therefore be weighed against research costs and the risk of losing valuable traffic.

For the agency, a false positive means losing a visit it would otherwise be paid for. For each major campaign, I compared the harm caused by problem traffic with the revenue from genuine visitors and used those calculations to choose an economically sensible filtering threshold. The goal was to balance the cost of further investigation, the amount of problem traffic remaining and the risk of blocking real visitors.

Retaining major advertiser relationships

The first substantial reduction in problem traffic came within 3-⁠4 months. Research continued, with new data helping me refine the scoring system. Following the launch of custom fraud detection, problem ad traffic fell more than 20-fold.

All traffic in the affected segment now passes through the system. The business outcome went beyond better filtering: the agency retained major advertisers who might otherwise have left, stabilized those relationships and kept important contracts.

The system remains in production. I explain how to investigate problem traffic and choose filtering thresholds in my article on checking ad traffic quality.