The Hindu Business Line : Go for a mouse trap

Online advertising is a tempting medium to boost business. But companies and individuals alike need to stay alert to `click fraud.' Players in the space advocate certain basic precautions to play a profitable game.

Pranksters use cloaking, which involves hiding or spoofing their IP address, so they appear to be accessing your pay-per-click ads from a variety of IP addresses.

The online advertising industry in India would do well to keep a watchful eye out for what is known as `click fraud'.

This is an Internet scam involving the misuse of the pay-per-click advertising facility offered by players in the online space.

With the advent of online advertising on blogs, along with its uptake as a primary marketing medium by small and medium businesses, a resurgence of this racket has been noted, say some industry watchers. It is growing into a serious threat, with a recent study by research and advisory firm Outsell reporting that advertisers incurred losses of $800 million last year alone on its account.

The methodology behind click fraud goes like this. Let's say Kishore has registered as an advertiser with Google's AdWords program. Whenever someone searches Google for `India, paintings, renaissance' etc, a link to his company's Web site comes up alongside the search results, in what is called the sponsored links column. For every click on this ad, Kishore might pay Google 5 cents, or about Rs 2.50. A small amount, one could say, for drawing someone's attention.

However, it could draw his competitor's attention too. Let's say Varun, also an art distributor, clicks on the ad many times a day.

Now, Kishore had signed up for the pay-per-click model expecting that for every 10 people clicking on his ad, at least one would be genuinely interested in purchasing a painting from him. Varun has made sure that Kishore foots a huge bill at the end of the month for clicks that will lead to no sale.

Kishore now feels that Rs 2.50 per click is too much given that very few of those people who clicked bought something from him.

Online advertisers estimate that about 14.6 per cent of the clicks on ads for which they are billed are fraudulent, costing them about $800 million last year, according to the study.

Rediff's CTO, when contacted, refused to comment on the topic.

Google, while acknowledging the problem, calls it a `small' issue. According to the company, a study examining three ad campaigns and evaluated over a 10-day period, showed that one had 8 per cent of questionable clicks, the second 10 per cent and the third 30 per cent.

The company says it uses technology to stay one step ahead of the fraudsters but says it cannot divulge details.

CLICK FARMS

India's `click farms' are groups of unemployed people who are hired to click on selected ads, and paid in dollars. This is a less sophisticated method of committing click fraud. Now, automated methods are more in use. Many Web sites have been targeted. Take, for instance, Sulekha.com, an online community portal. Sulekha.com spends close to Rs 4 crore a year on online advertising. Depending on the campaign or ad, says Vineet Pabreja, Director, City Services Reach, Sulekha.com, "we spend from Rs 2.5-Rs 10 per click using Google's pay-per-click advertising scheme."

Recently, employees tracking the Web site's log suddenly noted that a single IP address was generating 10,000 clicks in a single day.

The company had taken the precaution of tracking the sources (IP address) of clicks on its advertisements every day. Hence, the firm knows the IP addresses from which interested users click on Sulekha ads. Suspicion arose at this sudden jump in clicks.

"Usually, in Web sites such as ours and media sites, the number of clicks can be expected to jump, say when it is the cricket season and people log on to check scores. However, this was unrelated and the company immediately alerted Google," says Pabreja.

Google, in turn, took measures and resolved the issue by not charging Sulekha for the 10,000 clicks. This saved the company Rs 45,000.

BLOG AND `EARN'

Smaller organisations, says Pabreja, and media sites use text links to attract visitors. Some bloggers who have signed up for Google's AdSense click the advertisements on their blogs a few times a day as a means of earning. Google has the technology (Google said in a response that it could terminate publishers for invalid clicks on a daily basis) to deal with this, but bloggers could get away with it, especially if a network of people prearrange to click on each other's sites.

"Some bloggers do try to monetise their blogs by committing click fraud," agrees Dr Subho Ray, President, Internet and Mobile Association of India (IAMAI).

"The first thing most bloggers do is to sign up for AdSense, Amazon or eBay's banner ads," says Rajiv Parikh, CEO, Position2 Inc, a US-based search and online marketing firm.

Let's say a college student begins blogging on travel. She learns that one can earn money from one's blog by signing up to Google AdSense.

This service places a relevant ad — say a travel agency in Kerala having a promo — on her blog. So, every time one of her readers clicks on that ad on her blog, Google pays her a small sum. After a while, however, she gets greedy and begins to click on the ad herself.Google has the technology to detect if it's the same person clicking on the ad. But if this student is devious and `cloaks' her IP address using software available off the Net, she could get away with it.

CLOAK OF DECEPTION

Pranksters use cloaking, which involves hiding or spoofing their IP address so they appear to be accessing your pay-per-click ads from a variety of IP addresses. This helps them avoid detection as most Web sites get alerted when it is a single IP throwing up a number of clicks.

`Spider' technologies, software that automatically and systematically click on sponsored links, are available for generating fraudulent clicks.

Click fraud perpetrators can download or develop a computer program that automatically `crawls' a search engine, looking for the competitor's ads and can then be used to generate clicks on the sponsored links.

Google says its team is able to detect invalid clicks, by keeping a watch on duplicate IP addresses, user session information, network information, geo-targeting and browse information. The company refuses to share more about its technology and methods, reasoning that "doing so would make it easier for fraudsters to try to defeat our systems."

RISKY BUSINESS

Pabreja warns that people opting for online advertising must realise that there is a good chance that 2-2.5 per cent of the spend might go in click fraud.

"Those who are ignorant of the risk of click fraud are in for trouble," he says.

"It is an issue ad agencies are aware of", says Ray. The Internet, in all its transparency, is also subject to more scrutiny than other forms of advertising, he says, adding, "The possibility of click fraud is always in the open and portals have to be vigilant."

The advice offered by Pabreja is to review one's account daily, and compare it to a daily average number of clicks the site received. Also, users of online advertising could opt for a safe `upper cap' for their daily budget.

If they noted an unexpected jump in the number of clicks on their ads, (as opposed to the expected jump to a news site during cricket season, for example) an e-mail to Google would save them from spending on worthless clicks.

If the firm/individual does not have the software for extracting IP addresses, then they would be dependent on Google's verdict.

However, in most cases Google resolves issues very well, he says. "When we identify a click as invalid, it simply means a click we won't charge for, in order to deliver the best ROI to advertisers," says a Google spokesperson.

Another way to detect immediately if you are a victim of click fraud, is to check for sudden interest from IP addresses in countries where your company does zero business.

COST PER ACTION

Google is currently testing its new offering, cost per action, which could be the solution, says Position2. This option allows the advertiser to pay the service provider (such as Google or Yahoo) only when a lead is generated. Google's spokesperson says the firm hopes the CPA model will give advertisers more flexibility and provide publishers another way to earn revenue through AdSense.

This concept, introduced recently, will help reduce click fraud, agrees Pabreja. Even though the ratio of leads generated is less than 5 per cent of clicks, advertisers still seem to take to online advertising.

The reason, says Pabreja , is exposure. Web sites are in a race to attract more visitors, and by placing a banner they hope to draw more surfers.

This reflects a trend in the industry too, says Position2.

"Now, online advertising has become more performance-oriented than percentage-oriented. The profit-sharing model also seems to be coming up," says the company.This would help reduce click fraud.

Ganesh Mandalam, CEO, Xerago, a customer and operations management company, says the cost per action model, while welcome, could be a difficult exercise to implement, given that any company looking to tap the online ad space would have its own e-commerce application, payment gateway, data from customers in that market, etc.

Clicks and costs

The online advertising industry in India was worth Rs 162 crore in 2005-06. In 2006-07, it is expected to be worth Rs 250 crore.

Three basic pricing models:

CPM = cost per 1000 impressions. Used primarily for banners.

Most commonly found in social networks and media sites; Most successful in India.

CPC = cost per click. The advertiser pays only when a surfer clicks through an ad.

Common in blogs and search engine Web sites.

CPA = cost per action. The advertiser pays only when a lead is generated — a form is filled up, or a transaction completed.

Preferred by software firms and financial services.

Common in B2B and niche sites; now picking up in high-traffic Web sites.

preethij@thehindu.co.in

More Stories on : Security | Internet | Online Marketing | Economic Offences