I worked on fraud detection products for several years, and in the end the only explanation I had was misaligned incentives between the publisher, advertiser, a

I worked on fraud detection products for several years, and in the end the only explanation I had was misaligned incentives between the publisher, advertiser, agency, ad server, and other adtech middlemen. The publisher wants to show little clickfraud to keep their rates high, but don't get the data to handle nor often have the technical resources to prevent it if they knew. The advertiser doesn't really understand the modern ad market so sees "fraud" and will go to the agency that promises zero fraud, even if they're more expensive than just eating the fraud. The ad server doesn't really care per se, and can't do much because (outside RTB optimization) the publishers are the only ones who can really do the work to prevent the fraud. But they need to keep the publisher and agency happy, so they measure it. Both the publisher and agency get unhappy if the numbers are high, no matter how true they are or how inefficient it would be to bring them down - so the ad servers are either incentivized to lie (in practice meaning, not investing much in fraud detection) or to kick publishers with high fraud rates off. (The closely-related question is why fraudulent clicks matter at all, when CPM/CPC rates should pretty quickly decline in proportion to target the same number of real people for the same price. But no matter how much we tried to sell actually useful features - e.g. no ads for your vacation planning service on a news article about a plane crash - all any customer ever cared about was click fraud!)