Most advertisers don't think they're affected by bots. But since more than half of the Internet's traffic is not human - though it's not necessarily nefarious - that assumption is most likely false.
It's no secret that fraudulent traffic costs advertising billions every year. But surprisingly few think their sites are affected.
According to Distil Networks' 2015 Digital Publisher's Guide to Measuring and Mitigating Non-Human Traffic, only 37 percent of advertisers think non-human traffic has a significantly negative effect on their campaigns. Among publishers, it's only 14 percent.
"I think a lot of people feel like because they're not actively doing anything to engage in that ecosystem, it doesn't impact them," says Rami Essaid, CEO of Distil Networks. "They feel like they haven't gotten their hands dirty so they're clean. They don't realize how widespread it is."
Bot traffic denial could be compared to if a principal sends home letters about the rampant bullying at school. Most parents would have the same reaction: "My child would never!"
For many advertisers, seeing good ROI after investing in legitimate channels leads them to believe everything is going well. They often fail to realize how much better it could be going.
"Nobody really has the tools in place to really detect these things. I think that goes hand-in-hand with everybody's 'not me' mentality. Why would you do anything if you don't think it's impacting you?" says Essaid.
Here are three things you need to know:
1. How do you realize if it's affecting you?
First, realize that it most likely is. Distil Networks found that 22.7 percent of 2014's web traffic was bad bots and cyber criminals don't really discriminate.
And while they're often crafty and sophisticated, in many cases, they don't even have to be.
"They're practically walking through the front doors," says Essaid. "If you don't lock your door or have a security system, are the robbers going to have to be that sophisticated to rob you?"
The first step to stopping fraudulent traffic is being able to recognize it. According to the report, three-quarters of publishers and 59 percent of advertisers are either unable - or unsure how - to do so.
A few ways to protect yourself against bots include:
- Only buying from known sources and working with reputable vendors.
- Correlating your campaigns and their performance on the most granular level possible. Being aware of every dollar spent and tracking every click, you'll have a much better picture of what did and didn't convert. As a result, you'll waste a lot less of your advertising dollars.
- Learn what to look for. Analyzing views to video platforms like YouTube and Dailymotion, a group of European researchers was able to recognize bots by atypical human actions, such as many times for very short periods of time.
- Educating yourself on the threats most common to your industry and business model
According to the report, areas like digital publishing, travel and e-commerce are among the hardest hit. It makes sense to Mike Zaneis, executive vice president of the Interactive Advertising Bureau (IAB) and CEO of the Trustworthy Accountability Group (TAG), who points out that the cyber criminals are simply following the money.
"Think about how valuable a would-be traveler in the U.S. who might want to do a European trip is to an airline or a hotel," Zaneis says. "Those are very high ROI, very high cost demographics.
"If I'm running bots, I'm going to make my bots look like those types of consumers," he adds.
2. Mobile's newness is a double-edged sword
All advertisers know that mobile has a unique set of challenges, such as the difficulty of measurement and lack of viewability standards. The decreased sophistication carries over to fraud detection, as well.
However, mobile also presents challenges to cyber criminals. With significantly smaller screens, there are simply less ads on each page for them to work with. As a result, the criminals are most attracted to those ads with the highest cost-per-mille.
"There are challenges, but with every challenge, there's also an opportunity," says Zaneis.
The newness of mobile, at least compared to desktop, usually works against marketers. But in this case, that relatively novelty helps them: the industry is far enough along that marketers have a better sense of what to look out for.
When thousands of fraudulent apps were spotted in Google Play earlier this year they were suspended very shortly after the report's release.
"Mobile might be fraud with more fraud, but it might be easier for us to clean it up because we're aware of it sooner than [we were] in the desktop world," says Zaneis.
3. There are different kinds of bots
The word "bot" has a very negative connotation because of how often they're used nefariously. But a bot isn't necessarily criminal.
Distil Networks' report is full of references to "bad bots" - malware - and "good bots." The latter generally refers to things like search engine spiders, which make up more than 36 percent of web traffic.
The difference, however, is that Google, Yahoo and Bing self-identify their bots as bots. That way, publishers know not to count the non-human traffic the search engines generate as part of their sold inventory.
But behind door number three is another kind of web traffic: not human, but not insidious, either. For example, someone using a bot to compare prices.
"It's not human traffic a marketer would want to pay for, but it's not criminal," he continues. "We need to create a system so we can identify that kind of traffic and take it out of the inventory that's sold because it generates a massive amount of traffic on the Internet."
"No matter what, we want to stop [cyber criminals] from ever making a penny on digital advertising, but we also don't want to shut down things like search engine spiders and e-commerce spiders," he continues. "We don't want to undermine the trust marketers have in our supply chain by selling them bots."
Some non-human traffic is fraudulent and some merely causes a technical problem. Both kinds can cost advertisers a lot of money, whether intentionally or not.
To combat this problem, it's crucial to stick to reputable sources and vendors, and to educate yourself on your industry's common threats, as well as the signs of non-human traffic.
On an industry-wide level, major organizations working to fight the issue, as well. Earlier this week, the Media Rating Council (MRC) issued new guidelines for digital media vendors and companies to detect and filter out non-human traffic.
In addition, TAG announced a new anti-fraud program this morning. "Verified by TAG" has two main elements: an official registry of legitimate advertisers and publishers, and a payment identification system connecting all ad inventory to those who are to be paid for them.