5 ms·

The fascinating thing here is that Google's systems are required to make a judgement of intent. Is this ad fraud ordinary fraud that's intended to increase payo

by skymt 7y ago

The fascinating thing here is that Google's systems are required to make a judgement of intent. Is this ad fraud ordinary fraud that's intended to increase payouts, or is it intended to be caught so the account is suspended? From the scammer's perspective, there's no reason not to play both sides: test fraud patterns to see if they're detected, and when they get caught just redirect the bots towards extortion victims. No matter how well Google's detection system works, the scammer gets paid.

duxup 7y ago
Yeah if one scam doesn't work... now you've got a known good weapon. Google's willingness to shut down a lot of things on what seem like a very surface level fingerprinting means it's pretty rock solid to predict what will happen.
dessant 7y ago
Google either doesn't care about intent, or their systems have consistently bad judgment. I've lost count of the horror stories about indie bloggers getting a ban from AdSense when it was time to receive their first check, and being offered no meaningful way to appeal the ban.
- burnte 7y ago
  Yeah, that happened to me 15 years ago. Just crossed the $100 payout limit and suddenly, FRAUD! What ticks me off the most is if they have the ability to detect and block fraud, then why block accounts? Why the death penalty? Just don't pay out fraudulent clicks and terminate repeat offenders, rather kill the account on the first blush with no appeal.
  - settsu 7y ago
    > if they have the ability to detect and block fraud, then why block accounts? To protect their business by protecting their reputation. The scale of Google's advertising business(es) means that a loss in revenue from poor public perception of their ads is likely to be far more than a few thousand small ad buyers (those spending <US$5000/mo) getting cut off, which would barely register as a rounding error (<0.1% of just AdWords revenue alone.)
    - lonelappde 7y ago
      How is perception affected by not-paying suspect accounts but not banning them either? The public doesn't see the clickfraud
      - settsu 7y ago
        They could be shadow banning them or they could be continuing to allow them to operate in service of their algorithms. The public doesn’t see clickfraud but they also don’t see headlines about Google ads having a fraud problem. A rare anecdote of Joe Schmo not getting his 97.54 payout is effectively meaningless.
    - burnte 7y ago
      I understand this, but it's suspicious when they manage to detect the fraud only when it's time to pay out the revenue to the site owner. It's also a little unfair to assume every detection of fraud is 100% purposeful action by the site owner and permanently terminating their account without even so much as a warning. In my case, I had ads running on my blog. It took 4 months to rack up $100. I think the chances I was purposefully defrauding them was low, given how long it took to get to the payout point.
  - hinkley 7y ago
    I wonder if there's a simple explanation for this pattern. Fraud detection costs money. If there is no money changing hands, why spend the money on detection?
  - incompatible 7y ago
    Terminating after 1 offence, 2 offences, or n offences only changes how long a competitor / blackmailer / disgruntled former employee or ex-spouse / random bored idiot with a stolen credit card needs to continue paying for clicks.
    - burnte 7y ago
      They don't charge the ad buyer. My account was terminated 15+ years ago, still can't run ads under that account for some reason I do not know, but they were able to detect it and block it, whatever "it" was. So I'm punished forever for something forever unknown to me, despite not doing anything. I think the rule is unfair.
      - incompatible 7y ago
        It seems unfair to the point that the entire model is unworkable. Well, perhaps they could ignore the "fraudulent" clicks when billing and never terminate anybody. By "paying for clicks", I was thinking that they'd be paying some service to click on the ads, rather than writing their own scripts or doing it manually.
- izacus 7y ago
  > Google either doesn't care about intent, or their systems have consistently bad judgment. Not to defend Google here but... how did you determine this? By seeing those < 0.01% of issues where it goes wrong? How did you determine the magnitude here and how do you know the systems aren't right in > 99.999999% cases?
KaoruAoiShiho 7y ago
They don't have to judge intent, just remove the traffic without enforcing a punishment.
- skymt 7y ago
  The policy that the system is intended to implement requires suspending customer accounts for detected fraud but not for cases of sabotage, so it needs to judge intent until the policy is changed. I would imagine that the current policy was designed under the assumption that traditional click fraud would be the dominant form of fraud and so making it more difficult would be the highest priority. Simply removing detected fraudulent traffic without enforcing a ban would make it easier to test and iterate on fraud bots without burning as many accounts. I don't think there's an easy answer.
the_matrix 7y ago
Doesn't your hosting platform (Wordpress/Blogger/AWS/etc.) help identify the spam bots and stop them in the first place?
- pier25 7y ago
  AFAIK you don't need to spam the actual hosting platform since you can extract the embed code of the ad.
Mirioron 7y ago
Well, the difference is that extorting someone is a lot more illegal in a lot more countries than running not farms. Extradition usually requires that whatever a person is accused of is a crime in both countries, which makes extortion a bigger risk for the scammers.
cirno 7y ago
It's an act of duplicity. Google wants you to believe both that it can detect a website owner doing bad things (blackhat SEO, click fraud on ads on their site to earn more money, etc), yet simultaneously that they can catch any bad actors faking those things to damage you (negative SEO, click fraud to terminate your own accounts, etc) That obviously isn't possible. Google cannot determine the intent behind anonymized actions. They just want you to believe that they can in order to discourage people from trying to game the system. I've heard of Twitter and YouTube accounts being suspended for buying followers, but anyone with $5 can send tens of thousands of fake followers at anyone's account. The only real solution these services have is to silently ignore the faked traffic whenever they observe it. Anything else can be gamed from either side.
incompatible 7y ago
Yes, and if a somebody is offering ad-clicking as a service, how is Google supposed to know who paid for the clicking?

by skymt 7y ago

duxup 7y ago

Yeah if one scam doesn't work... now you've got a known good weapon. Google's willingness to shut down a lot of things on what seem like a very surface level fingerprinting means it's pretty rock solid to predict what will happen.

dessant 7y ago

Google either doesn't care about intent, or their systems have consistently bad judgment. I've lost count of the horror stories about indie bloggers getting a ban from AdSense when it was time to receive their first check, and being offered no meaningful way to appeal the ban.

burnte 7y ago
Yeah, that happened to me 15 years ago. Just crossed the $100 payout limit and suddenly, FRAUD! What ticks me off the most is if they have the ability to detect and block fraud, then why block accounts? Why the death penalty? Just don't pay out fraudulent clicks and terminate repeat offenders, rather kill the account on the first blush with no appeal.
- settsu 7y ago
  > if they have the ability to detect and block fraud, then why block accounts? To protect their business by protecting their reputation. The scale of Google's advertising business(es) means that a loss in revenue from poor public perception of their ads is likely to be far more than a few thousand small ad buyers (those spending <US$5000/mo) getting cut off, which would barely register as a rounding error (<0.1% of just AdWords revenue alone.)
  - lonelappde 7y ago
    How is perception affected by not-paying suspect accounts but not banning them either? The public doesn't see the clickfraud
    - settsu 7y ago
      They could be shadow banning them or they could be continuing to allow them to operate in service of their algorithms. The public doesn’t see clickfraud but they also don’t see headlines about Google ads having a fraud problem. A rare anecdote of Joe Schmo not getting his 97.54 payout is effectively meaningless.
  - burnte 7y ago
    I understand this, but it's suspicious when they manage to detect the fraud only when it's time to pay out the revenue to the site owner. It's also a little unfair to assume every detection of fraud is 100% purposeful action by the site owner and permanently terminating their account without even so much as a warning. In my case, I had ads running on my blog. It took 4 months to rack up $100. I think the chances I was purposefully defrauding them was low, given how long it took to get to the payout point.
- hinkley 7y ago
  I wonder if there's a simple explanation for this pattern. Fraud detection costs money. If there is no money changing hands, why spend the money on detection?
- incompatible 7y ago
  Terminating after 1 offence, 2 offences, or n offences only changes how long a competitor / blackmailer / disgruntled former employee or ex-spouse / random bored idiot with a stolen credit card needs to continue paying for clicks.
  - burnte 7y ago
    They don't charge the ad buyer. My account was terminated 15+ years ago, still can't run ads under that account for some reason I do not know, but they were able to detect it and block it, whatever "it" was. So I'm punished forever for something forever unknown to me, despite not doing anything. I think the rule is unfair.
    - incompatible 7y ago
      It seems unfair to the point that the entire model is unworkable. Well, perhaps they could ignore the "fraudulent" clicks when billing and never terminate anybody. By "paying for clicks", I was thinking that they'd be paying some service to click on the ads, rather than writing their own scripts or doing it manually.
izacus 7y ago
> Google either doesn't care about intent, or their systems have consistently bad judgment. Not to defend Google here but... how did you determine this? By seeing those < 0.01% of issues where it goes wrong? How did you determine the magnitude here and how do you know the systems aren't right in > 99.999999% cases?

KaoruAoiShiho 7y ago

They don't have to judge intent, just remove the traffic without enforcing a punishment.

skymt 7y ago
The policy that the system is intended to implement requires suspending customer accounts for detected fraud but not for cases of sabotage, so it needs to judge intent until the policy is changed. I would imagine that the current policy was designed under the assumption that traditional click fraud would be the dominant form of fraud and so making it more difficult would be the highest priority. Simply removing detected fraudulent traffic without enforcing a ban would make it easier to test and iterate on fraud bots without burning as many accounts. I don't think there's an easy answer.

the_matrix 7y ago

Doesn't your hosting platform (Wordpress/Blogger/AWS/etc.) help identify the spam bots and stop them in the first place?

pier25 7y ago
AFAIK you don't need to spam the actual hosting platform since you can extract the embed code of the ad.

Mirioron 7y ago

Well, the difference is that extorting someone is a lot more illegal in a lot more countries than running not farms. Extradition usually requires that whatever a person is accused of is a crime in both countries, which makes extortion a bigger risk for the scammers.

cirno 7y ago

It's an act of duplicity. Google wants you to believe both that it can detect a website owner doing bad things (blackhat SEO, click fraud on ads on their site to earn more money, etc), yet simultaneously that they can catch any bad actors faking those things to damage you (negative SEO, click fraud to terminate your own accounts, etc) That obviously isn't possible. Google cannot determine the intent behind anonymized actions. They just want you to believe that they can in order to discourage people from trying to game the system. I've heard of Twitter and YouTube accounts being suspended for buying followers, but anyone with $5 can send tens of thousands of fake followers at anyone's account. The only real solution these services have is to silently ignore the faked traffic whenever they observe it. Anything else can be gamed from either side.

incompatible 7y ago

Yes, and if a somebody is offering ad-clicking as a service, how is Google supposed to know who paid for the clicking?