CyberGroup/Jan 18
From Cyberlaw
Online Fraud
Types of Online Fraud In 2000, about two thirds of online fraud complaints were related to online auctions. Credit card fraud was only 5% of reported online fraud at the time. See Online fraud rife in the US. Online crime has been growing along with the Internet. The FBI and National White Collar Crime Center (NW3C) have joined forces to provide the Internet Crime Complaint Center (IC3).For information on more online fraud schemes, see Internet Crime Schemes. In 2004, nearly 10 million people were victims of fraud, resulting in about $1.2 billion in losses. Online fraud hits record levels
Phishing is one popular form of online fraud. In this fraudulent scheme, Internet users receive an email purporting to be from a bank or another company that conducts business online. Users are told that they need to provide information about their account and are directed to a page that has similar graphics to the original site and appears at first glance to be the official site of the company. However, responding to these requests put users's accounts and identity at risk as these phishing companies then have information needed to verify accounts as well as account numbers and passwords. See online fraud & Banks sound alarm on online fraud.
Another type of fraud is often conducted on Internet auction sites such as eBay. This can take the form of one user defrauding another, for which eBay has a report mechanism. See Online Fraud Complaint Reporting Form. Criminals are also able to obtain access to legitimate users's accounts to create bogus auctions. See EBay blames users for fraud. See also And the Online Fraud Goes On...
Click Fraud is another form of fraud. Originally thought to be contained in the early days of the Internet, see Exposing click fraud, it is still a common occurrence. Yet, click fraud is not typically listed with other types of online fraud. See, e.g., Internet Crime Schemes.
Click Fraud Defined
The pay-per-click model involves websites getting paid for every click to an advertisement coming from their site. Such a system accounts for over 90% of Google's revenue. (It should be noted that the combined advertising revenue of Google and Yahoo! is expected to rival the combined prime time advertising revenues of CBS, NBC and ABC. The Online Ad Attack in Economist) However, concerns are mounting that this advertising model is very susceptible to fraudulent clicking. Some estimate that over 30% of the clicks are fraudulent and others estimate that number to be over 50%. See Is Click Fraud Ruining PPC Ads? However, there is no industry-wide definition of what constitutes click fraud. See Google and Overture Define Click Fraud.
Potential sources of click fraud
- Competitors
- Third parties in contract with the ad-provider who have a stake in the number of clicks, like the Auction agency of the W.Post article
- Google/Yahoo itself
Our question: How, if at all, can and should click fraud be prevented?
Examples
CNBC profiled one victim of such click fraud last week who said he advertised on Google for his private jet company and set a particular budget for his ads. He would pay x amount to be put at the top of any Google searches related to private aircraft. Once the budget for clicks was expended, his ad would no longer appear at the top. One of his competitors got wise to this and deployed a program to click on the link a few thousand times to expend the daily budget and remove the ad from the top of Google searches. Some of the analysis was that unless Google can fix this, their business model might become worthless.
Cassie used to work for a web design company and one client had tried the Google method and was getting billed for a lot of clicks that he suspected they were coming from his competitors. He wanted other options, and those options were related to putting the site higher on the results list instead of doing more advertising under this method.
How Big a Problem is Click Fraud, Really?
- Pay-per-click seems to be more effective than TV or print ads because it can select what audience to target more precisely. Fraudulent clicks that are not filtered out may just be a cost of doing business, just like the copies of a magazine that are never bought are a waste of advertising dollars.
- As long as some filters are in place and advertisers are willing to keep paying, the system will continue to work. Cases such as the private airplane business do not seem to be a huge problem (since only that one made the news and there weren't too many similar examples). They can be resolved on an individual basis with perhaps arbitration, a refund or free time at the top of the search lists for a specified period.
- Kevin Lee, chief executive of search marketing firm Did-It, says that if click fraud gets much higher, "then we should all be getting worried." Exposing click fraud
- Google CFO: Fraud a big threat - Google exec calls click fraud the "biggest threat" to the Internet economy, urges quick action.
- Once high-flying Internet analyst Henry Blodget has predicted that click fraud could cause Google's stock price to fall to $100. Google's current stock price (as of January 17, 2006) is over $465.
Google's and Yahoo's Response to Click Fraud -- Our Attempt to Answer the Question as to Whether OSPs Alone Can Solve This Issue
- The answers from Google (or at least their FAQ):
- Does high click volume mean I'm getting invalid clicks?
- How does Google detect invalid clicks? -- which is particularly low on specifics. If you were an advertiser, would Google's explanation really assuage your concerns?
- Invalid Clicks
- Here is Google's multimedia presentation on invalid clicks
- Google Adwords
- One might assume that Google and other pay-per-click companies are at least screening out repeat IP addresses (or putting a maximum, of, say, 5 clicks per IP address). This, however, is not always the case (see Yahoo's explanation). Also, fraudulent clicking businesses may in any event know to continually alter their IP address. A major concern is that, examining just first-order effects, Google has no incentive to prevent such fraud because it helps them get paid. Then again, in the long run, allowing click fraud would undermine the search engine's business model.
- Yahoo's FAQ on fraudulent clicks (start from question 14).
- Google sued one company for click fraud and won
Ok, So Google Doesn't Specifically Tell Us What They Are Doing. What Are the Options for Changing the Code of the Internet?
Simple Recording of IP Addressess
- Record the IP address of where the clicks are coming from and discard if there are too many that are coming from the same one. Perhaps even discard those that are going through any sort of cloaking program if it is possible to detect because the average user has no need to be doing that.
- Problem with this is that some companies use proxy servers which make all their employees have the same IP address when they click. Some ISPs also assign a block of users to a server and they end up with the same ISP.
Geopositioning
- Once geopositioning is more precise than it is now, perhaps can weed out clicks coming from the same building which is likely to be a competitor's office or the owner of the site hosting an ad trying to earn a bit of money.
- With IP as it is, IPv4, you cannot identify the location of a user precisely and there really is no way for geopositioning to improve. Blocks of IP addresses are given out by regional organizations (US, Europe, Middle East & Africa, Asia/Australia). Thus, they can generally be linked to a continent (although even that isn't always true). Also, there is whois info for owners of specific IP's. But even that is rarely precise. If I'm on Lucent's network in Hong Kong and you do a whois search on my IP, you will see Holmdell, NJ because that's the address Lucent reports in its whois information.
- Users with dynamic IP addresses could not easily be blocked without blocking other traffic. If I click from my AOL or Comcast address, I stand a good chance of getting a different IP address every 24 hours because providers do not want users to benefit from having static IPs. Thus, an attempt to block one such user will not be effective and will, in fact, block another legitimate user.
- Of course, one doesn't have to block users at all. The fundamental question is whether their clicks are counted against the advertising budget.
- Rough geopositioning that already exists can weed out clicks coming from farms in India, China, etc. However, may need a way to recognize valid clicks coming from those countries. Perhaps can monitor the average number of international clicks per day or hour and raise a flag if that number spikes.
Modifications/Alternatives to the Pay-Per-Click Model
- Instead of pay-per-click, perhaps can keep a record of the average visits to a website and charge based on that for an ad to be up for a certain amount of time. This would be based on the assumption that a certain percentage of visitors to a site will click an ad. Of course, then there will be fraudulent visits to a site to drive up its average hits and thus the price, but perhaps guaranteeing that the ad will be up for a certain amount of time will be helpful instead of a few thousand competitor clicks removing an ad within a few hours.
- Good old flat rate model, like for all other media. A certain amount for a week/month of ad time, with variations for placement. Though Google determined it could make more money with the pay per click model. Maybe Google could charge more for more profitable sites, to extract more money from some advertisers.
- Pay per unit of time the clicker spends at the site. Maybe with different rates for the complexity of the page (How many sub-pages? How many goods offered for sale? etc).
- Pay-per-sale: Google could get paid a percentage of the sales per click that occur after a clicker links to the advertiser's website. This payment scheme could occur in addition to a flat rate. This has the side effect of Google's wanting to display the most profitable websites most prominently which could be a positive or a negative from an ideological perspective.
- Additionally, you could also set up the payment so that Google gets a certain percentage of sales divided by the number of clicks. This way, Google has an incentive to combat fraudulent clicking.
- The Wired article in the suggested readings hinted at some kind of Google-run payment scheme whereby Google could profit off of sales from clicks. It could be facilitated by a Google-run PayPal-like system ("Google Wallet"), which Google is already rumored to have initiated. See Google Plans Online-Payment Service in The Wall Street Journal; See also Pay Per Sale in Economist
- Another related alternative is a pay-per-action scheme, where advertisers pay based on the number of clickers who give some sort of contact or demographic information or purchase an item after linking to their site. This system makes it more expensive for competitors to drive up costs for competitors. However, competitors may still abuse this system by driving up costs or by misleading the advertiser by entering in false demographic information.
- A pay-per-action scheme should be priced higher than pay-per-click.
- As mentioned in the above Economist article, there are also steps being taken to implement pay-per-call schemes where links hooked up to telephonic systems like Skype will then connect you with the company when clicked. This makes it harder, or at least more expensive to engage in click fraud.
- links can be structured to 1) link you up directly to internet phone providers; 2) link you to a page with contact information; or 3) there may be no link at all, just a display of a telephone number.
- Pay-per-call should also be priced higher than pay-per-click.
- Google "AdSense": Google places links it thinks are relevant on third party sites and splits the revenue with the host. Google allows advertisers to pick and bid on whose websites they wish to appear. Advertisers pay for this based on how many people are expected to see the ad ("cost per thousand" basis). They must still compete with advertisers who choose a cost-per-click scheme. See The Online Ad Attack in Economist
Leave it to the Advertising Clients
There are some services popping up to help stop click fraud. Some examples include Klick Patrol, Click Fraud Detective, and Authenticlick.
If Code Isn't Enough, Should Government Step In?
Yes: If We Outlaw Click Fraud, Only Fraudulent Clickers Will Be Outlaws
- Can legislate that it is unfair competition to click on a competitor's ads. Monetary damages can be either a mandatory statutory amount (like $750 per click), to disgorge whatever profit someone made from clicking on ads on their site, or to reimburse the costs of an advertiser whose budget the perpetrator's fraudulent clicks wasted.
- It would be tough to establish that a company was doing this if it used anonymizers or third parties. Since a script clicking a Google ad 500 times is not bandwidth intensive at all (unlike downloading video), anonymizers like TOR seem perfect to accomplish such clicking.
- The party in the best position to recognize such clicking (Google or Yahoo) does not have a strong incentive to do so because it would be forced to refund advertising dollars.
- This might be the best argument for having statutory damages in such a statute. They would provide the direct monetary incentive for search engines to catch those committing click fraud.
- If this could be established against competitors, what about other third parties who click on the link until it goes away?
- It may be necessary to make Google or Yahoo stand in the shoes of their injured client for purposes of litigation because many clients do not have the resources to bring a lawsuit if they are the victims of fraudulent clicking.
- This is a very good idea. The only problem I see is there may be some threshold issue. Every ad will probably be fraudulently clicked at some point. You don't want advertisers running to court everytime the ratio of clicks to sales goes down.
- Another reason to make Google or Yahoo more responsible for fraudulent clicks is that in many cases, they profit from undetected fraud since advertisers pay them for every click. The better the filtering software becomes, the less revenue for Google's and Yahoo's coffers. This way, if enough fraudulent clicks go through to call for a lawsuit, G and Y will potentially lose more money litigating than they would have made from the clicks.
- However, if Google isn't doing anything out of the ordinary to propogate the fraudulent clicking, it seems to run counter to principles of good law to essentially penalize Google, especially when advertisers are entering a contract knowing fraudulent clicking is possible and/or likely.
Sort of: Legislate Click Advertising Transparency, To Increase Information in the Marketplace
- Google and Yahoo can increase transparancy and report to advertisers how many clicks there were, how many were weeded out as potentially fraudulent and how many were real to make them feel better about the bill.
- This will also lead to more efficient contracting as information becomes more symmetric.
- Part of the motivation for this regulation comes from the Wired article in our assigned reading:
- "[A] substantial number of those clicks came from Denmark, a country where CharterAuction did 'exactly zero' of its business. When McKelvey[, the company president,] asked Google and Yahoo! precisely which clicks he'd been billed for, neither company would tell him. All they'd reveal was how many clicks he'd paid for - not which ones or where they originated."
- Both Google and Yahoo claim that the software used to monitor clicks needs to be kept secret to either keep evil-clickers from coming up with ways to circumvent the filters or because it is proprietary. Yahoo has patents pending on the software. However, the information on both G's and Y's FAQ for advertisers is rather vague. It would be helpful if they provided examples of clicks they filter, or average numbers of fraudulent clicks they catch. Or even the size of the Click Security 'team' which might only consist of 2 people.
No: Government Action is Problematic/Unnecessary
- A major problem with dealing with this through legislation is that it effectively shuts down any bots for price comparison search engines. Neither Amazon nor B&N want their prices to be used by comparison search engines. They could use any legal solution to allege that the search engine was fraudulently clicking their site. If the law excluded price search engines, then businesses competing with Netjet could write a script to click on Netjet's ad as part of a comparison search part of their own site. They could simply argue that the comparison required up-to-the-second pricing information.
- Again, it's important to note that any legislation would be to outlaw fraudent clicking on advertisements -- not the mere visiting of websites. There is no problem having a bot roam through Amazon, the violation only occurs when a bot "clicks" on adverstisements that are part of a pay-per-click advertising campaign.
- I really don't like the idea of criminalizing fradulent clicking. I'm not in the "I want my gov't so small that we can drown it in my bathtub" crowd, but wouldn't this problem be better solved contractually between google/yahoo and their advertising customers?
- The main problem is that you don't have many other options. Google and Yahoo are huge so if they decide that they want the contractual benefit and won't release information, their advertising customers don't have any comparable options. Even if there's another company that provides more information, it's not going to provide the same market as Google or Yahoo would.
- Jurisdiction issues: Another major problem with legal solutions is a company can just set up shop in Tijuana or Moscow and realistically couldn't be touched by US law.
- There's a good chance that the market will take care of this problem and that any current problems in code will only be temporary. If fraudulent clicking becomes such a problem that it doesn't make sense to use pay-per-click as an effective conduit for advertising, search engines like Google should come up with an effective way to screen and block fraudulent clicks.
- This might just be a cost of doing business. Just as you can't protect against all fraud in a physical storefront, it may be impossible to do here. Businesses still operate even when they're the target of fraud or theft - a store would never close because of a shoplifter. Click fraud can be seen in a similar way - there's a lot of benefit to this form of online advertising and click fraud is just one cost associated with it, but companies will budget for this cost and won't stop operating entirely because of that cost.
Overall Lessons (i.e. how does this topic relate to the themes of the class)
- Generativity
- Certainly if online advertising becomes more lucrative and targeted, you may have more business expanding to online advertising, especially with the popularity of using TiVO or other forms of digital recording of television programs. With more businesses going online, theyâll look for ways to distinguish themselves through their âweb presenceâ and thus you may get more innovation so that businesses can keep ahead of their competitors.
- If this does indeed have the potential to hurt Google significantly, it will mean a substantial reduction in all the stuff they are generating on the web with their advertising dollars.
- Control through OSPs
- ISPs seem to be out of the picture entirely.
- However, while the DMCA seems to shield ISP's for copyright infringement, they may not be shielded from suits based on fraud. Thus, ISP's may end up getting sued just like ISPs that knowingly allow spam to be initiated through their mail servers.
- This issue becomes relevant if ISPs continuously allow companies to change their IP addresses in the situation where Google begins to block these users from clicking on a particular link, or stop charging advertisers when these users click. At this point, ISPs should be put on notice that fraudulent activity may be occurring.
- Itâll come down to a matter of how the companies count clicks
- ISPs seem to be out of the picture entirely.
- Control through Code
- Most of our solutions seem to be code based
- Who Controls Culture
- Is this going to be something like sharing music files where people wonât think that theyâre doing anything wrong?
- The issue here seems to be related to competing businesses
- The Future of the Internet
- Again, some of our ideas might come in here
- In terms of advertising, it seems like the ultimate goal is to erect a pay-per-sale scheme.
Other Thoughts
- Pay-per-action type schemes may cause inaccurate numbers as well because consumers might not buy something off a website the first time they click on it. For example, a lender advertising low interest rates will get clicks of people who are interested in getting a mortgage, but a user will have to think about applying and compare rates before they commit, which would probably be in a direct visit to the site at a later time. Perhaps there can be an intermediate approach (maybe using Ajax) to see what activity the user will show on the site. If they click around or scroll a bit, it would be likely that it is a legitimate user.
- When assessing the problem, we need to filter out the panic raised by 3rd parties who stand to benefit from scaring advertisers (the companies who offer services or software to monitor click fraud for a fee).
- This is an interesting advertising phenomenon that doesn't really have equivalents in the old world of advertising. Perhaps putting a competing billboard right in front of another one is an analogy. Or removing stacks of a competitor's flyers from public spaces.
- There are a few sites where I wouldn't mind a fraudulent click or two, like the free mammograms button at The Breast Cancer Site. Please click it :) I also think that should be part of the class assignment.
- The problem seems to parallel spam. Only, unlike spam, each fraudulent click costs an advertiser real money. Since legal and technical means have failed to stem the proliferation of spam, the situation looks dire for a company like google that gets 99% of its revenues from pay-per-click advertising.
- As long as there are only a handful of OSPs (like Google and Yahoo) with whom it's worth advertising, then they can require whatever payment schemes are best for them. Maybe this is why there aren't any advertiser-friendlier schemes out there. (Unless PPC is really the one that's best for advertisers)
Reading Assignment
Suggested reading for the class:
Washington Post article
The January 2006 issue of Wired has an article on click fraud.
"How does Google detect invalid clicks?" [1]
Additional References
Great, really recent article - Click Fraud
Exposing click fraud - 3.5 pages
Good overview - Click Fraud: the reality
Our favorite website Wikipedia also chimes in on this topic.
Pornographers Turn to Click Fraud
Metrix Search Engine Ratings as of August 2005
Who Powers Whom? Search Providers Chart from July 2004
Other Presentation Topics Considered
At least seven other ideas were considered by Cybergroup as potential presentation topics by Cybergroup and are preserved here for posterity.
Click Fraud Presentation
- The Basics
- Advertisers agree to pay Google or Yahoo for preferential placement in searches
- Advertisers also pay Google or Yahoo to place ads in third party websites
- When a user clicks an ad, Google or Yahoo recognize revenue from the advertiserâs budget and pay third parties a portion
- Prices per click run from a few cents - $84
- The Stakes
- Google earns over 95% of its revenue on the pay per click model
- 2006 est. $5.2 Billion
- Because of expectations of growth in this revenue it commands a P/E ratio greater than 100 vs. an average of 14 for the S&P 500
- At these high multiples, share prices can collapse on missed earnings. Yahooâs stock tumbled 13% Tuesday afternoon after only growing income by 39%
- Google earns over 95% of its revenue on the pay per click model
- How are Google and Yahoo Responding to Click Fraud?
- We donât really know specifically
- Google says it looks at IP addresses and timing patters, among other things
- Yahoo has a âClick Protection Systemâ
- Each click is evaluated along 90 data points. Some of the data points evaluated are:
- IP address
- User session information
- User cookie information
- The network to which an IP belongs
- The user's browser information
- The search term requested by the user
- The time of the click
- The rank of the advertiser's listing
- The bid of the advertiser's listing
- The time of the search
- The time of the click
- Each click is evaluated along 90 data points. Some of the data points evaluated are:
- Google does offer credits for invalid clicks, but only in the prior two months
- It is likely that fraudulent clickers and pay-per-click advertisement providers are engaged in continuous escalation and adaptation
- In November 2004, Google sued a company for hiring 50 people to click on ads on its own website, thereby generating false ad revenue
- Google was victorious and collected $75,000 in damages
- We donât really know specifically
- Google and Yahoo both assert that they cannot reveal how they combat click fraud
- They say it would undermine their fraud prevention systems
- Yahoo also says, âWe have two patents pending related to this technology, so we cannot currently disclose too many details about the methods we use.â
- Third-party auditors have stepped in to fill the click fraud gap
- Clicklab, WhosClickingWho, Click Fraud Detective, among many others
- Advertisers Could Monitor Click Fraud on their Ads
- A few lines of code in a web site can help gather information about visitors
- Browser/Resolution/other stats
- Referring page
- IP address
- This is currently available to advertisers
- Most do not track this information
- Most do not even keep track of their return on investment
- A few lines of code in a web site can help gather information about visitors
- Possible Solutions by OSPs
- If 3rd parties can do it, Google and Yahoo can too
- Filter using IP addresses
- Remove multiple clicks that originate from the same IP
- Proxy servers at work places or ISPs may assign the same IP address to several users
- Blocking IP addresses that are suspected of fraudulent clicks is not effective
- Serious evil doers will either mask their IP or use different addresses
- Other things to monitor: cookies, ad ranks, time of clicks and searches, browser information, etc.
- May need to increase the anti-click fraud team
- Use GeoPositioning
- Once GeoPositioning improves, can tell if clicks are coming from a competitorâs office or a company specializing in click fraud
- Now can probably tell what country clicks are coming from, so can monitor for suspicious traffic
- Team up with 3rd parties to develop new tools
- Alternatives and Modifications to Pay-Per-Click
- Other Formats Already in Place or In the Works
- AdSense
- Google places links it thinks are relevant on third party sites and splits the revenue with the host
- Google allows advertisers to pick and bid on whose websites they appear
- Advertisers can pay based on how many people are expected to see the ad ("cost per thousand" basis)
- But, they must still compete with advertisers who choose a cost-per-click scheme
- Pay-Per-Call
- Links hooked up to telephonic systems like Skype will then connect you with the company when clicked
- This makes it harder, or at least more expensive to engage in click fraud
- Pay-Per-Action
- Advertisers pay only when clickers follow up and provide requested demographic or contact information or purchase a product
- AdSense
- Flat Rate
- Model used for other media advertising
- Fee charged for certain period of time
- Variations in price for placement
- In order to match the revenue of pay-per-click, Google could auction off top placement for certain searches
- CPM (Cost-Per-Thousand) Model
- AdSense Advertisements
- Charge based on average number of visits to a site where link is hosted
- Agree to post the ad for a given period of time to circumvent competitorsâ use of fraudulent clicking to get the link off the site
- Advertisements on Google Search
- Charge based on popularity of search term
- Agree to post for a given period of time
- Variations for placement
- AdSense Advertisements
- Pay Per Time at Site
- Charge advertisers per unit of time the clicker spends at the site after clicking the link
- Pay-Per-Sale
- The âHoly Grailâ of Advertising according to some
- Google gets paid a percentage of the sales that occur after a clicker links to the advertiser's website
- Could operate in addition to a flat rate
- Could create a sales-per-click scheme where Google gets a percentage of total sales through Google divided by the number of clicks
- This way, Google has an incentive to combat fraudulent clicking
- âGoogle Walletâ
- Role of Government
- Outlaw Click Fraud?
- Enforcement?
- Incentives?
- Who benefits?
- Advertisers?
- Or search engines?
- Knowledge Problem
- Who benefits?
- Resources
- Will small advertisers pursue expensive litigation?
- A threshold?
- What if Google / Overture is already taking best efforts?
- Transparency Regime
- Require Reporting
- Standards
- Problems?
- Too much information?
- Outlaw Click Fraud?
- Government Action on the Fraudulent Clicking Problem is a Bad Idea
- Because it would be excessive/ineffective to outlaw click fraud
- Seems like a problem that should be resolved contractually between the relevant parties
- It would be difficult to enforce against particular competitors
- Jurisdiction problems
- Because the market will solve this problem itself
- Stores don't close their doors because of shoplifting. Click fraud is just part of the cost of doing business and advertisers will just budget for it
- Already there are some Google/Yahoo competitors with different models, like Snap.com
- If the problem gets so bad that advertisers can't afford PPC advertising anymore, providers may begin offering other models rather than lose advertisers altogether
- Because it would be excessive/ineffective to outlaw click fraud
- The Future of the Internet: PPC?
- Generativity:
- Will new ways to âoptimizeâ sites to get at the top of search results be developed?
- Will more companies move to an online storefront so that they can go to a pay-per-sale model?
- OSP Control:
- How will companies count clicks?
- Will Google/Yahoo create a new model?
- When click fraud occurs, will OSPs and ISPs be shielded from liability in the same way the DCMA provides a shield?
- Is click fraud analogous to other types of âreal worldâ or online fraud?
- Culture:
- Do people see this as fraud?
- Who will have the upper hand â the advertisers or the providers?
- Will PPC become obsolete?
- Create better fraud detection?
- Movement toward pay-per-sale?
- Generativity:
- Our special guests from Authenticlick
