#MediaSnack MEETS

#MediaSnack Meets: Dr. Augustine Fou, Ad Fraud Researcher

February 21, 2019 ID Comms Episode 28
#MediaSnack MEETS
#MediaSnack Meets: Dr. Augustine Fou, Ad Fraud Researcher
Show Notes Transcript Chapter Markers

Everything you wanted to know about ad fraud but didn't know who to ask or even what to ask...Don't suffer from FOFO (fear of finding out).

This extended #MediaSnack Meets with Dr. Augustine Fou lays out the key parts of the ad fraud challenge and gives marketers the priority actions you can take right now to better protect your media investments from fraud. 

Dr. Augustine Fou is a leading ad fraud researcher and one of the most widely published and quoted authorities in the space. 

We get back to basics to learn:

  • Who are the bad guys?
  • Where does all the money go?
  • How big is the problem really, who should we believe?
  • If you get rid of fraud do media prices go up?
  • How can you work directly with publishers?
  • How does ad fraud actually work in technology?
  • How can you use Google, facebook and YouTube more effectively to cut fraud?
  • What should you be asking your media agencies to do to help?



Episode Links

Dr. Fou LinkedIn

Dr. Fou Twitter

Dr. Fou SlideShare

Dr. Fou's Report on Ad Fraud and Cyber crime

Tom Denford:

Hello everyone. I'm Tom Denford, co-founder of ID Comms. Welcome to episode 28 of#MediaSnack MEETS: recorded each week in New York. We get to meet the individuals and organizations doing great work to inspire success and drive change within the global media and marketing industry. In each episode, we find out what is behind that success, what it takes to make change in the industry, and what the rest of us can learn from that experience. My guest for this episode is Dr. Augustine Fou, the independent ad fraud researcher and founder of Marketing Science Consulting Group based here in New York. Is ad fraud really a big problem? Why hasn't the industry solved the problem yet and why do the estimates around ad fraud just keep getting bigger? Research by the World Federation of Advertisers in 2018 suggested that ad fraud will become the second biggest source of income for organized crime. Ad fraud has become an industrial enterprise-scale criminal activity, so who should we believe and what can we really do about it? I first met Dr. Fou a few years ago. We both attended a meeting at the United Nations building in New York to discuss transparency in the media industry, and at the time, he seemed to me to be the only person in the room who really knew what he was talking about. Not surprisingly, being a scientist, Dr. Fou approaches the problem with research and data. He says,"Marketers, stop distracting yourself. Focus on ad fraud first." In this interview, we get back to the basics to understand what ad fraud is and isn't, how it works and what marketers really should be doing about it. Plus, we learn more about what drives Dr. Fou with such persistence to educate the industry, which has really been slow to react to this growing menace. To paraphrase a well known US advertiser, the next 45 minutes could save you 45% or more on your digital advertising budget. Please enjoy this highly insightful interview with Dr. Augustine Fou. Welcome to#MediaSnack Meets.

Dr. Fou:

Thanks Tom. Good to be here.

Tom Denford:

So, I'm really, really interested in the whole ad fraud discussion. I know you've been very generous with your time to me and to the industry and trying to educate us on this. I want to start right at the basics. So, just to clear up if there's any confusion, what exactly is ad fraud? When we talk about ad fraud, what does it actually mean? What are we talking about?

Dr. Fou:

It's very simple. Digital ad fraud is basically ads being shown to bots and not humans. And bots are basically software programs that bad guys use to repeatedly load webpages or repeatedly load the ads themselves. So in the early days of the Internet, ads were shown on big websites like Yahoo.com, so typically when a person goes to a website and they view a page, the ads load, so a lot of marketers think that's still the case. But now with these long-tail sites that you've never heard of--it's not the big New York Times or Wall Street Journal--it's some long-tail site, like a blog, viral site or whatever. No one's ever heard of that. So, there's probably not a lot of humans going there, but yet they're selling billions and billions of ad impressions into the programmatic exchanges. How are they able to do that? It's basically they bought all the traffic and the traffic is generated by bots or software programs, not by humans visiting webpages.

Tom Denford:

Wow. Okay. And what does that mean for a marketer with a hundred-million dollar media budget, let's say, what does that actually mean for them? What's happening to their money and where is it going?

Dr. Fou:

Their money is going into digital media and they're going for reach and frequency, just like they did in TV. But unlike in the physical world, where there are actual physical limits to how many TV spots you have, how many TV shows you have, or even how many billboards you can put by the side of the highway. In digital, because it's all virtual, the bad guys can literally create unlimited inventory, right? And what they do, is they create fake websites to run ads; they create fake mobile apps to run ads. So, all of those are designed to just run ad tech: write a little short piece of code that allows them to run digital ads. So, when they do that, it's all generated out of thin air. It's not, again, a human visiting a webpage or using a mobile app. So in that case, for a brand marketer, their dollars are going towards ads that are never seen by people. So, there isn't even the branding effect, let alone people clicking through or direct marketing or sales or anything; it is completely wasted and all that money is going to either the ad tech middlemen or straight into the pocket of the bad guys.

Tom Denford:

Tell me about the bad guys. We're all familiar with the idea of hackers from remote lands, in dark, deep dungeons of servers and things like that. But what actually do these people look like? Who are they?

Dr. Fou:

These days I'd like to say bots don't come from Russia anymore. They don't have to come from China anymore. They come from data centers right here in the US, because these days it's so easy to create bots, right? These are software programs that load webpages--

Tom Denford:

Which are perfectly legitimate things, right? These tools to create the fake traffic, they just misused, is that right?

Dr. Fou:

Yeah. So, the tools--these browsers/software programs--are typically used by web developers to test their websites, right? By loading it, by doing various stuff on it...but again, these open source tools are being abused by the bad guys, right? And so they're just used to repeatedly load ads. So basically, the bad guys, there's not a whole bunch of hackers doing this, right? There could be only a few hackers needed because they manage vast botnets. You can think of everyone kind of renting time on those botnets because you can say,"I need 100,000 page views on this website," because the website was paying for the traffic. So, basically it's just one line of code. You instruct the botnet to go load pages on this website 100,000 times. So, there only needs to be a few bot masters that manage these botnets. And then there's traffic sellers, who basically are middlemen. They're brokers; they're traffic sellers that will happily sell traffic to any website that wants to buy it, right? And so those websites will now have traffic to then generate the ad impressions. So then they say,"Oh, well here's my inventory." They can now sell it through the ad exchanges. And then the exchanges sell it to the agencies that buy low cost media, because they're really addicted to low CPM: large quantities of display ads and that kind of stuff. And then the agencies will then tell their clients,"Oh look, we got you hundreds of billions of ads this month and we even got you a lower CPM for it." You used to have to pay legitimate publishers like Hearst, Conde, Meredith and so on and so forth. Pretty high CPM's. And that's correct, because they actually have writers, journalists and editors that create the content. And that's not cheap, so they have to sell it at higher CPM's. But with the rise of programmatic technology, we've seen CPMs go down and that's because the bad guys can create infinite quantities out of thin air. It doesn't cost them much, because now they're even renting servers on AWS. So, in that case, they don't have cost of content, they don't have to buy server hardware; they can just pay as they go and cloud compute centers and that kind of stuff. It costs them very little, so they can sell i t a t very low CPM's. And that's become the drug of a lot of the agency media buyers; they want to buy more quantity at lower costs and b ecause t hey're actually engaged on that, they're judged on that. And a lot of the agencies and some of the marketers think that that's ROI."Oh yeah, we got you more quantity at lower average costs." That's not ROI. That has nothing to do with business outcomes; because now when you're buying 10 times the quantity, maybe at 1/10th the CPM, most of it is fraud because t here literally aren't all those h umans sitting around loading webpages and causing all those ad impressions. We've far outstripped that years and years ago.

Tom Denford:

Thank you for the explanation. What you're saying, is that also this ladders back to the responsibility of the marketer, which is something which on our#MediaSnacks show--listeners, if you want to check it out on Youtube, just look up"media snack," which is a weekly show--you know that David and I do talk about that a lot. It's the responsibility of the marketer often, to set the right brief. The risk is that they've become conditioned and addicted to lowering price and that seems like a win; and that's been perhaps the root of all of this success of ad fraud and the bad guys is because maybe because the advertiser's obsession with finding cheaper and cheaper without necessarily putting in place the guard rails to test the quality or the impact of that money or that investment; or maybe the agencies in response are doing whatever they can to try and cheaper and cheaper inventory every day. Is that leading them to maybe not ask enough questions? Do you feel that agencies are not doing enough to challenge ad exchanges?

Dr. Fou:

Yeah. So, to me it boils down to basically conflicts of interest or where their incentives lie. So, the agencies always want to buy more quantity, and the more budget that they handle for the client, the more they make. It has to do with quantity. It really has nothing to do with transparency or quality or business outcomes. The agency's objective--and I'm not talking about the individual people there, I'm talking about the holding companies and the agencies as companies--their objective is to maximize their own revenues and profits so that their stock price goes up. So, unless the marketer asks them and asks hard questions, they're not going to voluntarily do this. It's not their job. So, it really goes back to the responsibility of the marketer. Unfortunately, too many marketers don't know what to ask and it doesn't help when they get fraud detection reports that say,"Oh, everything's fine. It's 0.53%. Don't worry, keep buying." It's not because the fraud is low, it's because the fraud detection technologies didn't catch it. So, for the marketers, they need to actually ask hard questions and also look at their own analytics because in that, they'll start to see there should be a direct correlation between their own analytics and business outcomes. And too many marketers are not focused on business outcomes. I'll tell you, I've encountered many brand marketers that will say,"Oh, well, because our sales don't happen online, they happen offline and in grocery stores. We can't track the performance anyway, so we're just going to do this reach and frequency stuff and maybe brand lift studies." But that is so far removed from the actual business outcomes and it provides a convenient cover for the fraud to continue. So, I would characterize it as either the marketers don't know enough to really push the envelope on this or they're just not asking enough questions and they're assuming that the agency took care of it.

Tom Denford:

But fraudsters love that, right?

Dr. Fou:

They love the opportunity to create more impressions out of thin air and even charge you lower CPM because that just means they make more money. And there are certain industry verticals that are particularly at risk and particularly targeted by the bad guys; it's all named to financial services and the movie entertainment industry. So financial services, they tend to do a lot of branding, right? They want reach and frequency. And sometimes they have to do a lot of that marketing before year-end or end-of-quarter because they have to hit their number. So, when they have to spend a lot of money and get as much reach as possible, that's the ideal scenario for the bad guys because again, there aren't enough humans to generate that many ad impressions. So, the only way you can get that much inventory is if you created it fraudulently, and bad guys can do that till the cows come home. And the same thing with the movie and entertainment business. Imagine if they have a movie launch date and they have to promote that movie. They have to spend all their budget before launch date to maximize their exposure, so the bad guys can now generate unlimited quantity to absorb all of that budget and they love the fact that the movie marketers have to spend it all by a certain date.

Tom Denford:

We will get into your specific advice from marketers in these kind of scenarios and I think I asked you a question a few weeks ago on Twitter, actually, because--and just sticking with the basics of this for the moment, just so people understand--how big is this problem? That's one part of the question and also, the question that we frequently get asked--I was teaching a class at NYU Stern a few weeks ago and I was talking in my very primitive way of understanding, relative to your deep knowledge in this area, about this problem facing the industry, and this is to the Marketing class at NYU--somebody rightfully put their hand up and said,"Where does the money actually go? How does it get out of the system?" Because if you talk about bad guys and hackers, is there a tap that you can turn off somewhere where you can just see it's illegal and just stop bad money flowing out the system? So, if you're a bad guy or you're organized crime or whoever it is that's benefiting from this, how does the money get out? How does that get into somebody's bank account?

Dr. Fou:

That's a common question. Advertisers and marketers don't pay hackers, right? They don't pay them directly. They never see them. So, basically the marketer pays their agency, sometimes in large chunks,"Here's$100 million to spend for the year." And the agency's job is to go spend it all. So, then they're looking around for as much quantity to buy as possible, right? So, then they look at multiple ad exchanges and then they would say,"Oh, we'll give"x" tens of millions over here and another 50 million over there," or whatever. So, they spend it with the exchanges; these ad exchanges have hundreds of thousands of sites that are part of the exchange. They're kind of like Wall Street, where you have buyers and sellers and they do the auction and all that kind of stuff, but they have hundreds of thousands of sites that are part of that exchange, which means they run ad tech from that exchange to show ads. So then, when those sites run the ads, the exchange has a count of how many ads they showed and a typical CPM. So then, the exchange would pay each individual site owner and there might be owners that own multiple sites that are a part of that, right? So, they pay each site after the ads are shown and each individual site--getting back to what we talked about in terms of source traffic--if those are long-tail sites that don't have a lot of humans, most of their traffic, if not all of it, is sourced traffic, which means they bought it all, which means it's generated by bots and software programs. In those cases, the sites would then pay the traffic sellers who sold them the traffic and then some of those traffic sellers are probably just resellers themselves, right? They bought it wholesale from someplace, right? They bought the traffic wholesale from someplace and now they're marking it up and selling it retail to have a site. So, there are many, many traffic brokers. There could be unknown numbers of layers there, in terms of traffic sellers and brokers. And then ultimately, like I said before, they're kind of renting time on that botnet, because you don't need a hundred-thousand machines for your particular site, you just need a portion of it. Because that site just bought 100,000 page views from you. So it's almost like renting a bit of time on that big botnet. So the Botnet, it's almost like a self-serve thing. You can even go to fiverr.com and find all these people selling. You are happy to sell you traffic or just Google the term"buy real traffic online" or"buy valid traffic," and you'll find hundreds and hundreds of people selling traffic. And they'll even tell you,"Oh, all our traffic is high quality because it's going to get by all of these fraud detection technology companies," because they have actually A/B tested their bots and they know for sure it gets by every single fraud detection company.

Tom Denford:

And I love this idea that it's considered valid traffic even though it's nonhuman; it's considered valid because the system validates it, right? Because it's just bypassing all of the--

Dr. Fou:

--Checks, yes. Valid doesn't mean human. It just means valid, which means the fraud detection companies could not detect it as invalid; but valid doesn't mean human. And there's a lot of other problems in that. We won't get too technical about that, but you know, a lot of the data is simply not measurable, because some of the more advanced bots are, I would say, any bot worth its salt is going to block a detection tag. Just like humans block ads. The bots are not going to let the detection javascript tag load because they don't want to get caught, so why wouldn't a bot block those detection techs? So, that leads you to wonder what the heck are they actually detecting if they are detecting something; it's probably a bot that's not smart enough to not load their tech.

Tom Denford:

Could we get in tech technical now? You've just reached the limit of my technical understanding. I think I'm just going to bring you back, because my question is how do you know so much about it? That's what I'm kind of interested in. How do you become--because you're regarded, rightly--as one of the preeminent ad fraud researchers and a real go-to voice for marketers in the industry wanting to understand this. So, what's your journey and then how did you get to become one of the world's experts on ad fraud?

Dr. Fou:

Well, I kind of fell into it because I'm a digital marketer, and I have been for 23 years. And when I Left Omnicom in 2012 and started doing projects for clients and started looking at my own analytics, I started seeing really strange things like 30% click through rates. As a marketer that has been doing Digital for a very long time, click through rates on banner ads should be 0.1%. And Google has years and years of studies that show it's in that order of magnitude; click through rates on search ads are probably 1%. You're not going to see 5%, 10%, 30% click through rates on ads because humans are just not that interested in your damn ad, right? But yet, we saw that in the data. So I started asking,"Okay, well, how is this possible? Why are we getting that high of click through rates?" And no one could tell me. So that's when I started building some technology tool to help me collect my own data so I can see what the heck is happening. Because things like Google Analytics, they'll tell you quantities, but they can't really give you enough details for you to figure out why it's happening or where it's coming from. So, we built some tech; it's also based on javascript, so that we can actually go collect some data, we can analyze it. And when you have the data--I'm a scientist, so I love--and when someone tells me,"Trust our numbers," and they don't show me any backup data, I'm not going to trust them. So when we see it in the data, it becomes very obvious. It's common sense, in fact. So, when you see a website that has 100% Android 8.0.0 traffic--not any other variation of Android and no computers, no iPhones, no iPads or anything--humans use all those other devices. They don't just use Android 8.0. So, in this particular case, when we showed that evidence to the client, I'll say,"Oh, well that's kind of obvious, right? How did that get through?" And so these days, when I help clients, look at the data, I'll show you the evidence, and then they can decide whether they want to keep buying from that site or not, and then they can just choose to turn it off. So, I kind of fell into this because I take a scientific approach and when something doesn't look right, I investigate. Then once we have the data that we collect ourselves, it becomes very clear where the fraud is or what kind of fraud it is, so you can actually do something about it.

Tom Denford:

That leads nicely into helping me understand then, what is the start point? There's obviously a huge amount of information that you have to look at. Are you spotting just anomalies and trends? Is that the thing? And that then guides you where to dig in deeper? Like you said, this doesn't make sense; it's better to use your common sense. That's the first filter.

Dr. Fou:

Absolutely. Look at your own data. First, you have to look at your own data. There are too many marketers that don't because they assume their agency took care of it. So, when the agency sends them rolled up reports in excel spreadsheets, it'll just say,"Oh, we bought you this many billion and here's your average click-through rate that doesn't do anything. Because the fraud hides easily in the averages, when you're just getting a rolled up report, you can't tell anything from that. So, first step is for marketers to actually look at the details of their own analytics and ask for details in the digital marketing reports that they get back--not a rolled up number by the month or rolled up number by the day. They need to look at various things, like hourly reports. This is something I published years and years ago in 2013; if you look at the hourly data, you can actually see the botnets back then were not that sophisticated. So, it was very clear when something was a bot versus a human, because we'll see the same exact amount of traffic every hour of every day, 24 hours straight. Okay, that's not human, because humans sleep at night and they don't serve webpages in the middle of the night. So, we should see more volume during waking hours, when people are actually surfing the web versus in the overnight hours, we should see lower volume. But back then, the botnets were not tuned that way, so we could easily see the same exact straight horizontal line in hourly metrics; that tells you it's not real. All right, so back then, even just by looking at your own analytics--these were Google Analytics--we could already tell what was bought or not. And now, the botnets are smart enough to actually tune down the volume--.

Tom Denford:

--That's what I was going to ask you. Presumably they figured this stuff out?

Dr. Fou:

Yeah. Those are things I publish. And they read my reports too, so now they're actually, faithfully tuning the volume down. But in that case, it's a good thing, because they're actually making less money. They have to work harder, because now they have to program their botnets to do that and they're making less money. So that's a win for the good guys. So, certain things I do publish, other things I don't, because I don't want to make it easy for the bad guys to just go hack their way around something else.

Tom Denford:

Actually, on that point, I know you've been hosting a number of briefings with journalists, which I should mention are invitation-only, because you want to keep the bad guys out. Exactly to that point too, so that they don't understand your secrets or your techniques. So, what's the purpose of those, because I have one observation--and you'll see this in the show notes, by the way, and if you want to read the show notes with lots of resources you can go to mediasnackpodcast.com--I mentioned just how prolific you are at sharing information. I mean, it's an altruistic cause you are fighting here, right? You give away a lot and if anyone wants to follow you, we'll link in the show notes your Linkedin and social feeds as well, because it's on a daily basis you're kind of sharing reports, giving away ideas and things to look at...What are you trying to do here?

Dr. Fou:

I'm trying to get back to real digital marketing. I've been a digital marketer for a very long time and what we're doing today is not digital marketing. It's all messed up by the bots, the fake traffic, the fake impressions, the fake clicks, so we're not even doing real digital marketing. My hope is that we can all be aware of this issue, we can all look at our own data, we can all take actions ourselves and not be dependent on ad tech companies to do it for us. And then if we can solve fraud, we can go back to real digital marketing. The reason I call myself a researcher, is because first of all, I see the data, right? It's all very clear as night and day. But I'm also not a fraud detection technology company because early on, when I started building these tools, obviously a thought would be,"How do I make money from this? And how do I charge for it?" It could have been to be a fraud detection technology company, like the many that are out there right now. But in those cases, there's a built-in conflict of interest, because those companies rely on fraud to continue; so that they continue to have a business and continue to make more money. In my case, I call myself a researcher, because my objective is to help the clients. And in fact, I show them the data. The other companies have their secret sauce; they don't want anyone to know. Whether it's a good guy or bad guy, they don't want to talk about it. So, in those cases, all they will tend to do is tell the client,"Trust us, our numbers are correct." Whether it's high or low or whatever, they'll just say,"Trust us." But they won't show any supporting evidence. What I do, is when I show the supporting evidence to the client--because I'm a researcher and I don't have to protect a secret sauce--they'll see it in the data. Like that example earlier, if you see a site that has 100% Android traffic, something's wrong with that. So then, the client will say,"Oh, now I understand why you're saying it's suspicious or fraudulent," and then they can take the action of simply turning that site off in their campaign. So in that case, when I do measurement for clients, I can't cover the cost of the hosting on AWS. So, they tend to help me cover that cost. So, we break out measurement and they just cover the cost and then they pay me for my consulting time. And in my work as a digital marketer, I'm mainly a consultant, so I get paid for my expertise. That way, whether it's 9% fraud or 99% fraud, I don't make more money or less money; they just pay me for my expertise. And then, I also have the ability to teach them, so that they know what to look for so they don't have to keep paying me. If they can figure out how to do this themselves, what to look for, where to look for it, they can solve a lot of this fraud themselves using basic common sense. And then over time, some of my projects are front-loaded, in the sense that I helped them a lot more in the beginning, but once they're able to do some of these techniques themselves, then they don't need me as much. So we can tone down the time that I spend with them and then they can simply escalate the more difficult stuff to me to analyze and look at. And I could talk a little bit about the journalist briefing. A lot of the ad tech writers and journalists in general, they may or may not have a very deep understanding of the technology of ad tech. Sometimes it's from their own research, sometimes it's what they read. So, there are often nuances about the tech that are simply missed. My purpose in doing these journalist briefings is when they come on, I ask them to sign on with a pseudonym. I don't want to know; I don't need to know who they are because the entire briefing is almost like an AMA, right? Ask me anything. People would just ask the question and I'll answer the question. It's only about the topic, not who they are. So, in that case, journalists can feel free to ask about some of the harder questions or even basic questions that they don't understand yet. And that's how I can help them, so that they can write better and understand the nuances and report on this important topic better.

Tom Denford:

That's true. And that's really helpful and well-attended. You're doing more of these and you can follow that as well. We'll link to yourTwitter, that's@ACFou so, let's just say journalists are right. Let's just say journalists are writing better pieces with your help and you're putting out lots of research and I'm a marketer, I'm a CMO; let's just say a big CPG business with a large investment in media. I've seen my digital investment increase over the years and then I start to get interested in this stuff, right? I'm reading your things and I hear you say"hourly reporting" and"all the bad guys" and it's very easy for me to think,"I'm just not even going to open this box." Right?"This sounds like a huge distraction for me. I know you're probably right. I'm sure it's a risk to my business in the sense that some money is trickling out some bad guys, but that's not my problem. That's an industry problem. I've got all these agencies and technologies and all these things that I pay for, where do I start?" Do you get marketers come to you, almost with paralysis, saying,"I can't admit that I have a problem". You've got to kind of reassure me that I'm not going to go to prison here or I'm not going to be seen as a guilty party here--what's the start point for a senior marker?

Dr. Fou:

There's a couple of things here. Alcoholics Anonymous, their tagline is: the only way you can solve the problem is by admitting you have the problem, right? So, first step, I look at intention. It's kind of like an intervention. It's not so much you admit that you have a problem, it's more that you want to find out more to see if you have a problem. I can tell you there are some marketers who are vigilant about this stuff and also knowledgeable about this stuff that don't have a big fraud problem because they are vigilant. But there's yet a whole lot of other marketers who suffer from"FOFO." I call that fear of finding out. And that happened a few years ago when they heard about ad tech; everyone was rushing into ad tech and programmatic and all that. So, fear of missing out drove into,"Let's go adopt this as fast as possible." But now they're suffering from FOFO, which is they don't want to find out about the fraud. So, the way I helped them is,"Let's have a look." When I go in there, I can tell you that I see 99% fraud, 100% fraud every day. But that doesn't mean that this particular marketer is going to be affected by that. What we need to know is how much fraud actually affects their campaigns. And the only way we can know is by doing some measurement. So what I typically do for a marketer is,"Let's go take a look." Let's put in the javascript tag--my tag--in your ads and or on your websites that click, where the ads click through to. Or, if you just tag your ads, we can already get a sense of how clean your campaigns are running. When we tag those ads and we get some data within the first hour of the tag running, I can really show them a first look because we can see it in the data. It's obvious. When we see in the data, I'll show them here's the stuff that's going right and here's the stuff that you really should look into. So, it kind of boils down to"don't assume." Don't assume that everything is fine, even though the agencies keep telling you it's fine; even though the fraud detection and technology reports that they get tell you it's fine. Have a look. And when we look, then we know where the fraud is coming from. First of all, if there is fraud, then second, where the fraud is coming from and what it is, so that then third, we can go do something about it. So, in this case, even if we find there's a lot of fraud, it's not like we're going to wipe it out immediately, because the bad guys keep evolving and they keep finding new ways to get around our defenses. So, what we typically do is we turn off the most egregious ones first. You've heard me talk about the flashlight app that's generating 60 billion impressions per month. Okay, how's that possible? In that case, they are an egregious offender. So, you turn those off by literally turning them off in your campaign so that you're not wasting money on those first. It really doesn't matter. You know there could be 100,000 sites committing fraud, but if one site is only eating 50 impressions, that doesn't matter to your budget. But if there's a flashlight app that's eating 50 million impressions, that does matter. That's material. So, we turn off those first. And here's another important point, which is we're turning them off while the campaign is running. So I call the other fraud reports"postmortem reports," because you typically get them after the campaign is over. Imagine if you had this flashlight app that's eating up 20% of your impressions during the campaign and you don't turn it off. The campaign is going to run very poorly and you won't know that until after the campaign is over, when you get the fraud detection technology report. So, isn't it much better if we can turn that off while the campaign is running and maybe even within the first day of the campaign? Just last week I was working on a case where the top apps combined were eating 68% of this particular movie marketer's budget. So, we turned them off in the first day. Imagine if we didn't. I don't have to know their CPM's, I don't have to know their total budget; they know the percentage of impression volume that was being eaten up by just the top 20 apps. By turning those off while the campaign was running, the rest of the campaign can run more cleanly. So, that's how we can have a material impact on the quality of the campaign while it's still going on.

Tom Denford:

So, you talked about the consulting work that you do, which is to help guide and reassure marketer's things to look for, right? And make sure that they're set up for--I was going to say set up for success--but it's just kind of to mitigate failure, let's call it the other way around, but then you might be engaged in a realtime basis to help them make some better decisions as they go along.

Dr. Fou:

Yeah, that's important because again, if the marketer doesn't know what to ask, they may be asking that after the campaign is over or when they see a fraud report that said everything was fine, but it still got no sales from this. So, all of that happens too late when they need help or when the campaign is running. That's the best time to help.

Speaker 2:

Tell me about the ratios, I love these kinds of numbers, because when we talk about the scale of this--and I've heard you explain this before--I found that really helpful.

Dr. Fou:

Yeah. I talk about 10/90 and 1/99, and if I just talk about those, it's going to be too scary. I don't want to scare the marketers because it may not be that in their own campaigns. So, still it goes back to just measure, take a look at your own campaigns and see how you're affected so you know what to do. And the other thing is, I never cite a number, like$9 billion or$16 billion, because every single one of those numbers is extrapolated from a small slice, because those fraud detection technology companies can only see a slice of the universe; they don't see the entire universe. So, it would be an extrapolation and approximation. So, it's not accurate, but some ratios might help you understand the scale of the problem. The 10/90 comes from the 100 billion dollars spent in digital in the US alone. That number is 300 billion worldwide. But let's just use the round number of 100 billion here in the US according to Jason Kent, over at the DCN, Digital Content Next, their mainstream publishers, the big publishers, collectively make about 10 billion in a year. So the 10 billion out of the 100 billion is where I get that 10/90. So, the good publishers, we have some visibility into the revenues that they make. That's the 10. The other 90--all I can say is it goes somewhere else, right? I'm not saying if it's fraudulent or not, it just goes somewhere else. And you can imagine a lot of that flows through Google and Facebook, but because Google has ad tech that is used by hundreds of thousands of sites to run ads and so does Facebook as part of their Facebook audience network. Those are all things where the money goes into all these long tail sites into the exchanges. So, it's just somewhere else, not fraudulent or not--just somewhere else. That's the dollar ratio, the 10/90, in terms of the impression volume, meaning the quantities of ad impressions. There are now trillions upon trillions of ad impressions, whether it's display ads, video ads and things like that being served every year. I can only say that 1% of that--I'm just using a round number because it probably is 0.01% or something like that--but 1/99, right? 1% of those ad impressions could possibly be served by the good publishers because they have a finite human audiences that generate a finite number of page views that therefore generate a finite number of ad impressions. They just can't generate that much ad impressions. So that's the 1%. The other 99% is somewhere else. So again, I'm not saying if it's fraudulent or not, it's just somewhere else. And then when you consider it to other important ratios, that's the number of domains and the number of apps. So Verisign tracks the number of domains registered: 330 million domains. How many of those domains do you think humans actually go to? I just use a very simple ratio. You've heard of the Alexa top million, right? The Alexa says,"These are the top million sites by volume." So you can safely say that those are the sites that humans actually go to or have ever heard of. And that includes big porn sites as well. So, if you take that 1 million, then there's 329 million more--like 300 times more--other sites. Again, I don't have to say if it's fraudulent or not, and maybe not all of them carry ads, but those are something else that may or may not have that many humans going to them. Yet how are they able to generate trillions upon trillions of ad impressions per year? They're probably buying traffic. So, that's the site ratio or domains ratio. And then now, there's apps. Most people can name up to five pretty quickly and then they start to struggle with the sixth, seventh, eighth, right? They can't even get to 10 apps. So, there's 7 million apps on Google Play and iTunes combined. How many of those do you think humans actually use? There's been studies by Comscore, by Forrester and all that. And most of those say,"Humans might have up to 30 apps on their phone at any given time, but they probably use five to eight regularly." And there may be some big hit ones like Pokemon Go or Candy Crush or something, those things that you've heard of over the years. But again, that leaves 6.99 million more apps that nobody's ever heard of. Again, how are they generating all those impressions and selling them in exchanges.

Tom Denford:

As a marketer it's easy to think,"I know about the TV stations, I know about magazines, I see them and I know about websites, b ecause I see them." Where's all the bad stuff?

Dr. Fou:

In the digital world we don't have the limits of the physical world. So, just like TV ads, there's a finite number of them; just like billboards, there's a finite number of them; just like pages in the magazine, they're finite, right? So, in those cases, we actually saw normal economic dynamics. When there's more demand and there's limited supply, prices go up. I think Superbowl ads have kept going up because there's more and more demand going after them. But in digital, the exact opposite has happened for the last 10 years. The macroeconomic analysis will show you that CPM's and prices have gone down in digital, even though there's a lot more dollars flowing into digital. So, digital has grown steadily according the IAB reports for 15 years, because marketers have brought money in from TV and other offline channels into digital. But despite this growth in demand, the prices have still gone down. And that's because the supply has grown even faster. And if you think about all the Comscore numbers or Pew internet numbers, the number of humans going online has already plateaued many, many years ago. And furthermore, the number of humans using smartphones has plateaued many, many years ago. So, the growth rate on those are single-digit percentages, if not flat or starting to decline. That's the humans actually using the internet and using smartphones. So, how is it possible that we're generating so much more inventory? In terms of quantities of ad impressions, now video ad impressions, now mobile ad impressions and all this kind of stuff...Again, it just doesn't add up. Literally, if you just look at some of those numbers--I did that back in 2013--Comscore was showing maybe 2% to 3% growth rate in terms of human time on-site and things like that--yet the curve of the ad serve was still a hockey stick. It was still pointing straight upwards. So again, it was already obvious years and years ago where the quantities of ad impressions are just completely out of whack from reality in terms of humans actually causing all of those things.

Tom Denford:

You mentioned FAN; this is the Facebook Audience Network. Tell me about that. I think I heard you discuss a case study. Was that a music company?

Dr. Fou:

Yeah, this is a great example that a small business owner shared with me. It was his example. So, I'll first set the context by talking about walled gardens. You've probably heard that term"walled gardens." It's basically ad tech trying to blame Google and Facebook for evils because,"Oh, in the walled gardens we can't measure stuff and they won't show us stuff and whatever, whatever." But you have to think about the walled gardens in two parts. For Google, you need to think about the part that goes on google.com. For example, the search ads that load on Google.com, if the ads load and someone clicks on it, Google makes the money. So, the kind of fraud bots that we're talking about are not rampant there, because they can't make money. Whereas the display network--which are basically all the sites outside of Google, but run Google ad tech to show ads--those sites have a financial motive to increase their own revenues by using bot traffic. So, that's where most of the fraud is. So, you have to differentiate the part on Google proper versus everything outside. Similarly, on Facebook, you have to separate into two parts. When the ads load on Facebook.com and its app, Facebook makes the money. So these kinds of fraud bots are also not going to waste their time there, because they can't make money from it. Whereas Facebook Audience Network, similarly, is all the other sites that run Facebook ad tech to show ads. Again, they have the motive and the means to inflate their own ad revenue using fraud. So in that case, it's really important when you're doing Google advertising and you're doing search, focus on the main site, because then you're going to be far more immune to these kinds of fraud problems. And then when on Facebook, you also should focus on the main site. This gets us to the story of the small business owner. He had been doing Facebook advertising by himself for the last five years and when he first started, he would see clickthroughs on his ads, come to his website and he could see sales on his music; he was a musician. He could sell his music. Over the course of the next five years, he saw his number of impressions go up, number of clicks go up...Yet the number of clicks that arrived on his website go down; to the point where he reached out for help, was when he saw that there was a 90% discrepancy. So, just using round numbers, the Facebook campaign interface, we tell them,"Oh, we sent you a thousand clicks," or,"You had a thousand clicks on your ads." But in his own Google analytics on his own site, he only got a hundred, which is a 90% discrepancy. He couldn't understand what was happening. Long story short is after he told me about the case, I asked him one question: Is the checkbox checked that says"Allow My Ads on Facebook Audience Network," which means everything else outside of Facebook. And he said,"Yes, it's checked by default," obviously. So I just said,"Uncheck it," and then within the week, the number of impressions cratered--went through the floor. And then the discrepancy between the Facebook campaign interface and his own Google analytics evaporated--went away. So, basically what happened was that in the course of that five years, the ratio of his ads that were shown on Facebook itself versus outside had completely flipped at the beginning. Most of his ads were shown on Facebook. And then once Facebook rolled out Facebook Audience Network and allowed other people to run ads, by the fifth year, vast majority of his ads were shown outside of Facebook. And that's where all the fraud was. So, even though he might've gotten the clicks or the impressions and all that kind of stuff, it was all fake, so he couldn't get any sales from it anyway. So, once we unchecked that checkbox, that meant his ads were shown on the Facebook main property and then also Instagram and things like that. He was much less at risk of this kind of fraud and he saw his sales go back up. And the discrepancy between the two systems resolved itself.

Tom Denford:

I want to ask you about how that then affects the cost, because that's what the marketer might say. So, in that example, if there's a ratio between Facebook saying,"You got a thousand clicks," and only seeing a hundred actually on his site, and then by making the changes that you recommended, that discrepancy disappears, right? So then I'm presuming in that scenario, Facebook is saying,"Oh, you got a hundred clicks," and I can see a hundred clicks, but the cost, presumably, is going up because you're not buying this kind of cheaply subsidized non-existence stuff.

Dr. Fou:

Exactly. So, let me tell you a common question I get asked, or claim that marketers like to believe. They say,"Oh, well fraud is priced in." They'll say that because they used to pay$30 CPM's to good publishers, now they're paying$3 CPM's on exchanges. So, they think,"Oh, well my CPM's went down so I'm okay paying for fraud because it's priced in." But that's a complete misconception, because right now they're buying 10 times more volume. So, they used to pay$30 and they would buy a certain quantity of ads. Now, they're paying$3 and they're buying 10 times the quantity. So, they didn't save any money, but now they've just exposed themselves to way more risk because the only people who can sell them$3 CPM's are the bad guys. Because again, like I said earlier, the real publishers have costs of content; they have to pay journalists and writers and editors and things like that. Bad guys don't, they can literally make up the inventory out of thin air. So, even if they charged$3, they're still profitable. So then, you're actually exposing yourself to more fraud. The whole"priced-in" thing should be thrown out the window right away. And if I hear a marketer say that, I'm definitely not serving them because they don't know what they're doing.

Tom Denford:

Okay. So here's the killer question: It's your money--what would you do? Is it go direct? Is that the only way to be genuinely reassured?

Dr. Fou:

Yeah, that's a great question. I'm a small business owner and I basically learned all this stuff by doing my own marketing. I look at my own Google Analytics, I do my own Facebook marketing, I do my own Twitter marketing...so all of these things I've learned by doing. If I were given a budget, whether it's a$50 budget or a$50 million budget, there are a lot of simplifying things you can do to avoid most of this fraud in the first place. Like I said earlier, if you want to do search advertising, do it on Google and make sure you turn off everything else. Don't let your ads go somewhere else, then you're relatively insulated from the rampant fraud bots, because again, if the ad loads on Google, Google makes the money and these fraud bots are not going to spend a lot of time there. If you want to do display ads, do it on Facebook and only allow it on the Facebook main property and in their apps, because they have very good audience segments and targeting and things like that. Just don't let your ads outside. If you want to do video ads, do it on Youtube. But make sure you select your channels carefully and you either white list or blacklist certain things so that you avoid brand safety issues. So, you know that those are basic things. But the reason marketers are not doing that these days, is because their agencies have convinced them to go after quantity. You're not going to get the vast quantities when you lock it down like this, but you are going to get better returns because as a small business owner, if I spend$50 and I can't get any return audit, I can't spend the next$50. So, you have to think like a small business owner and manage your money that way. But again, some marketers, like the brand marketers, their sole job is to spend it all. And that's not a good scenario, because those are the ones who don't want to hear anything about this fraud stuff because that means if they find out there's fraud, they have to go figure out how to spend the rest of the money that was given back to them or refunded. I would beg even the brand marketers, look at it; don't be afraid of finding out, because it's better for you to find out now and do something about it rather than waiting until your CEO finds out or your CFO finds out and you get fired for not doing anything about it.

Tom Denford:

We talk about this a lot on the#MediaSnack Youtube show: advertisers seeing the media budgets as an investment in growth, not a cost to the business. And when you start to view it as a cost to the business, then these are the behaviors that you're talking about. Which is that you start the beginning of the year and you just hand it off to agencies and vendors and publishers and just kind of get get rid of it. But, if you view it as an investment in growth, then you become more accountable then, for the impact that that investment has potentially on the business. So, going more direct for a marketer, I can understand that might make a lot more sense. And I think we probably are observing more marketers building more direct relationships with publishers to understand this and circumvent some of these risks.

Dr. Fou:

Yeah. What I forgot to say earlier was that go-direct part. I was just talking about the typical Google search, Facebook display and things like that, but going direct to the big publishers--it's almost like buying media as if it were 1995, because back then there was a lot of these relationships where for example, humans would go to a Hearst website so they had the first party audience. If the marketer then wanted to reach that audience, they would go to Hearst and say,"I want to play some ads on your websites." And so they would pay them the media dollars and then give them the creative and Hearst will actually run it. So, that's kind of the ideal situation where we won't actually get back to that, because in the intervening 20 years, from 1995 to say, 2015, ad tech has inserted themselves between the marketer and the publisher and ad tech now promises hyper-targeting audiences and all of that kind of stuff. But what in essence they are doing, is basically siphoning dollars to maximize their own profits. They are middlemen and according to the WFA study and an ANA study and several others, probably 40 to 60 cents on the dollar actually ends up going through to the publisher for the purpose of showing the ads. The rest goes to the ad tech middlemen as their revenues and profits. So, if a marketer were to go back to a Hearst, go publisher-direct, not only will they reduce the risk of fraud--because Hearst is not out to commit fraud--it would also increase the working media. More of the dollar goes towards actually showing the ads. So, there's two huge benefits to going back direct, to the good publishers. And the other thing I can tell you, is that over the years, when I've measured these good publishers, they don't have the bot problem. And again, it boils back down to common sense, because if an ad loads on Hearst, Hearst makes the money. So these fraud bots are not going to waste a lot of time loading ads on Hearst. They will go spend the time on sites that pay them for the traffic. So consistently, over years, these big publishers have less than 1% bot problem. There's other stuff going on, like crawlers, but they typically have a very low bot problem. So in that case, when you're buying from these good publishers, you're going to be far more immune to this kind of fraud that we see rampant everywhere else.

Tom Denford:

The good news for the market. So, for the many hundreds of millions or billions of dollars that these companies invest, trying to get a handle on where money's wasted then allows them to reinvest in the craft or reinvest in the creativity. So, as a marketer, this is not all bad stuff. I appreciate you when you say you need to make sure that you don't get the phone call from your CEO or CFO on this. And that's good--just good diligence on how you manage the company's money or the shareholder's money. But also as a marketer, this could be quite an empowering or quite a cathartic process that you go through, but it will give you more marketing dollars to invest in the craft and the creativity in your brands. There's an opportunity here for marketers.

Dr. Fou:

Yes. Not only better business outcomes, but also the opportunity to invested correctly. Because right now--I think you know--you've heard the term"simplifying the supply chain," right? And you've also heard the term"crime hides in the shadows." In digital marketing, crime hides in the complexity. So, when you have many, many layers of middlemen, you kind of lose track where things go, even though you think you have a lot more data and metrics and whatever--all of that can be faked. You lose track of all that in the complexity. So, if you can simplify and shorten the supply chain--literally, like I said before, if you go back to 1995, the marketer paid the good publisher, the good publisher has the audience--that's going to work, right? That is the way digital marketing was supposed to be. It's not that right now, because there's way too many complexities in there. And because of ad tech and because of the complexities, it has created the opportunity for fraud and it's allowed fraud to continue to flourish. So, for the marketers, what they can do, is take back control and literally start running their own experiments, start trying these direct media buys and if they can see it's actually working better, or if they can take dollars out of programmatic and see there's no change in business outcomes anyway--whether it was fraud or not--it wasn't working for them anyway. So, like you said, there is a huge upside to that, not only for solving fraud and that kind of stuff, but you can now actually focus on your craft--actually focus on the thing you make and produce and all that kind of stuff and actually do good advertising. So, just like I'm trying to get back to doing real digital marketing, marketers have the opportunity to do that and it won't happen until they ask harder questions and actually start looking at their own data.

Tom Denford:

So finally, what change would you like to see in the next 12 months? What are you hoping that we will do now?

Dr. Fou:

The main change for the next 12 months, namely 2019, is for marketers to actually defend the spend. So, if you see my hashtags,#DefendtheSpend, marketers need to ask harder questions. For the last couple of years, I've worked with publishers and I know the good publishers don't have a big bot problem, but unless and until the marketers do their part, fraud is going to continue, because as long as marketers just keep handing off dollars to their media agencies and the media agencies keep buying as much quantity as they possibly can, and they use fraud detection reports that tell them everything's okay, fraud is going to continue. So, until and unless the marketers step up and do their part and get over the FOFO- and that's a term I borrowed from Mike Donahue, by the way- but get over their own FOFO. Just take a look. And once they do that, then everything else is going to get much better.

Tom Denford:

Dr. Augustine Fou. Thank you.

Dr. Fou:

Thanks Tom. Good to be here.

Tom Denford:

Who would you like to meet on future episodes? Please let us know a t mediasnackpodcast.com, where you will also find previous guests, including leading media executives from companies like P&G, L'Oreal, M ars, and many more, plus some of the industry's most provocative thought leaders--people like Professor Mark Ritson and Gary Vaynerchuk. You c an subscribe to get new episodes each week, and if you liked this episode and you think somebody else would, then please do share. Thank you so much for listening.

Introduction
What is Ad Fraud?
Who ARE the bad guys?
The focus on lowering CPMs
Where does the fraud money go?
"Fraud hides in the averages"
Educating people on ad fraud
The start point for marketers
FOFO The Fear of Finding Out
The critical 'ratios' to look for
How to manage the "walled gardens"
Google, Facebook & YouTube
Going direct to publisher
Hope for the future
Future guests