Rapid response to mobile ad fraud

[Music] all right this is a fun session let's talk about the dark arts here my name is Mitchell work adapts fire on our partnerships team today we're going to talk a little bit about fraud but what I want to start off with is you know when you're working with networks is often a conversation you want to have with your partners on what is the difference between low quality traffic and what's the difference between what we can deterministically without a doubt say hey this is fraud so what I want you guys to take away from this session is if you're looking at you a haven't haven't started investing at or maybe you are understanding that that you know what are the big types of fraud that are out there how do we how do we look at these anomalies and understand what is fraud and you know understand how can we prevent fraud how can we detect fraud

what does that mean I got a clicker cool so mobile advertising this is this is a this is an interesting point here when you see that in 2017 with recent data mobile advertising is actually surpass web so congratulations we did it here in Mobile so basically what what this indicates is that more mobile marketers are gaining more confidence there's more fancy tools out there enabling marketers really understand their business to understand what's the impact of their advertising on their ROI maybe they're driving app installs and are understanding that when they drive an app install that someone's making a purchase on web and they're really starting to understanding that when they're investing in mobile they're really starting to see that ROI over the lifetime value of the user so we're really starting to see more app marketers get more and more sophisticated and the network's as well getting more sophisticated in their

ability to drive value for users but as the HM proverb goes Mo Money mo problems as you start to see that the the money is out there the opportunity is out there for fraudsters really take over so the process use a variety of techniques but adopts flyer we're at a unique position where we have sixty percent market share we're able to see 60 percent of the apps that are doing app install marketing as a mobile attribution and marketing analytics company our SDK is in around 98% of devices globally so really does put us in a unique position to see the the fraud as it occurs and see how the fraudsters are continuously evolving and continuously getting better and not just simulating clicks not just stimulating impressions with stimulating installs and simulating engagement and retention as well so how do we look at this you know what what is fraud look like and I want you guys to take away from this more confidence and understanding that hey if we're going to start investing a

lot in growing our app and growing our business we understand we know what fraud looks like and we know how to act on it quickly so it's a global issue it's not just in the US Canada Europe where there's higher payouts for CP is we see this all over the world and to be honest when you've got fraudsters that are able to spoof IPS and use bad devices they can really make themselves look like they're from anywhere to be honest so we're really seeing this as a global issue so this brings up one of the more important pieces of my talk today which is the prisoner's dilemma you guys have probably seen this chart before but basically what this means is if you have one network that is breaking the law and and one network that is actively trying to prevent fraud actively trying to build tools around fraud to see you know how can we get better it's honest it's going to be the the come it's going to be the network that is trying to fight fraud that's going to lose so when you've got this

prisoner's dilemma it's like what do we do to stop this especially when you get more modern types of techniques of fraud which I'll go into here later in the in the discussion we've got clique flooding clique hijacking device ID reset fraud and all of these fancies the types of techniques and tactics that fraudsters are using where they're able to actually capture organic installs as installs that are driven by attributed networks so when you're seeing installs that are organic everyone loves organic installs right you know those are typically users that are solid ROI they're coming in they're making purchases and things like that when you have another network that's going out and trying to actually grow the business trying to grow the the business in terms of generating new actual users that have never heard about your app you're paying for organic users in a lot of these cases and the fraudsters happy because they drove the user the attribution companies happy because they made an attribution the network is happy because they drove that install the marketers happy because they

their ROI looks a little bit better but you're paying for users that would have already came in your app anyways so how do we solve this problem when there's unclear accountability across this ecosystem and we see this problem continue to grow we see the fraudsters get better and better at what they're doing so here at apps fire we because we're in this position where we have so much data we track over half a trillion mobile interactions per month what can we do to really push push the envelope here and hold someone accountable so so we built things internally I'd like to look at ourselves as the Chuck Norris of fraud prevention so fraud occurs across the user funnel way back in the archaic ages of mobile around four to five years ago you saw a lot of impression fraud where a low value fraud just kind of simulating impressions and things like that more for the brand advertising but what we see what we start to see more

and more and I'll highlight the top three types of fraud that we see today is a lot of click fraud obviously an install fraud being the number one type of fraud that we see as an attribution company so click fraud you got click hijacking click flooding which I'll go into in just a little bit as well as CPA fraud as well so as I mentioned the fraudsters are able to to simulate actual in-app events and retention and ROI as well so what are the things that we can do to prevent the fraud and there's only there's a certain amount of fraud that you can actually prevent in real time and there's a and there's another piece where it's going to take some post-mortem you got to know what to look for and you got to know what to look for fast because you want to make sure your reallocating those budgets to networks and publishers within the networks which is usually where the problem exists that are actually driving real value so you got to think in layers and basically just reiterating on the point no way you can prevent real time

no what you need to look for from a detective measure as well so these are some of the tools that you want to make sure your fraud solution that you're using has and and really good things to keep in mind before you start investing in UA as well so very easy ones validation install and receive validation those are easy ones and in most cases you can prevent those in real time filtering rating and blacklisting so I don't think there's a fraud school out there that doesn't buy third party lists black lists of IP addresses black lists of devices but what you'll find is the fraudsters can buy those same black lists as well so what do we do you want to make sure you're with the solution that has only great third-party data but great first party data as well so with apps fire we're in a position where we have so much data we can actually build machine learning and I hate saying that word because it's such a buzzword everyone hates it AI machine learning

what the what the hell is that but but it really requires you know a constant flow of data to be able to really do machine learning and that's something that most of the the big attribution companies out there will have you want to make sure that that the company you're working with has device ID ratings and can actually not only just understand the bad IPS that are out there but also as they continue to evolve being able to detect those IP addresses those bad devices as they start coming in and learn about those devices as well distribution modeling so there's a fancy word for looking at anomalies and click to install time but even a better term that I like to use is quick to intent so you know that if the user clicks on an ad they're not going to wait five days to launch the app in most cases unless they're unless they're burning their dinner and they had to run and again the babies crying and all these fancy stuff but if you look at cohorts and groups of users that where they're all installing the app five days after the click

there's something to look into and we'll get into some of the benchmarks that you'll want to keep in mind as well and then again there's certain things that you can prevent there's certain things that you need to look at after the fact and that's why it's great to have someone that's hands-on with this data looking at it making sure that you're not only investing it with great networks that are there driving return on your ad spend but you're also making sure that there's certain publishers and they are you know actively looking at problematic publishers within networks that are driving fraud so the key building blocks for fraud as we see it I'll start with scale so you want to make sure you're with a provider that you know has the scale that is able to actually learn about the market there's certain KPIs that we can look at having all these devices where if we see a certain publisher within a network or a certain network is driving a hundred percent new devices you know that that's fraud and then building building technology on top of that we're you know obviously

the you can you can see fraud in the raw data but how long does it take you to see it so building good visuals and good graphical representations well you get where you can act on this on this problem very quickly and like I said you can't prevent everything in real time but you can't prevent things a couple days after the fact and then regulation in a market where no one's really incentivized to to fight fraud we want to help push the boundary and and you know make sure that we are incentivizing the advertiser to to fight fraud you know make sure that the attribution provider you're working with is unbiased and that's really key to you know all the revenue that we get comes from our advertisers and that's how we like to keep it so these are good benchmarks to write down and these are this is what most of our partners data looks like if we looked at clicked and install time reports make sure that you can look at it in seconds hours and days so this is pretty normal you know 75% of installs

coming in within the first hour ninety-four percent within the twenty within the first 24 hours you know this is pretty normal so we'll start we'll start to look at the top three types of fraud that we see and how the data will look different quick flooding and I should say we we have the picture the network here usually it's certain sub publishers that are actually attacking the network as well so usually it's within the network well you'll see that not have a friend that loves to watch these Mets games right but it doesn't want to pay for it so you use this some sketchy app that you download it on a jailbroken device and and you know we find that that that that bad app is stealing every single device information from from all of their users and they're pushing out five or six clicks a day from that device for the rest of eternity so they're hoping to grab these unrelated downloads and hopefully make attributions on those installs depending on what the clicked quick to install

look back window is so you'll see that this is one way that the fraudsters are trying to get organic installs organic installs are great and when you can make an attribution on them it's very bad and it pollutes the ecosystem with bad data this is what it looks like I don't know about you guys but whenever I click on an ad I usually launch the app five or six days later it sounds ridiculous right I mean come on so when you're starting to sow it you know launching the app five or six days later maybe it's a storage issue on the phone you know there's things there's those anomalies that can happen but when you start to see groups of these users come in that are all downloading the app five or six days later this is a prime example of clique flooding and it's something you'll definitely want to explore and you'll want to explore as granular as possible so not just looking at the network and saying well this network is fraudulent look at this you know honestly you go into the into the data and look at specific sub publishers that are usually problematic

in this case so that's one of the top types of fraud that we see at apps fire the other is install hijacking so this is going to look a lot different in the data in terms of the click to install time so usually this comes from bad apps where can where they can insert malware in your device they understand that okay you're now installing an app they know that and they can insert a click really quickly before that app is launched for the first time again going after those organic users because you know it's pretty easy to see when you drive 10,000 installs and none of them completed one of it in your app you know that's obviously traffic but when you're starting to see traffic from organic users and that are actually engaging you know again it goes back to that prisoner's dilemma and you know hopefully after this session you're able to understand how to analyze this what it looks like in these reports so this is what it looks like and this would probably be across an entire media source because you do see some normal traffic in here but I welcome you to try

it click on an ad download the app and try to launch it within the first five seconds it's impossible to do if you can do it I'll give you five bucks so and so there's a certain range of installs that you can prevent here so maybe within the first two three seconds you say well this is impossible but maybe someone has some fantastic internet and they're you know something crazy so there's there's a range of what you need to what you can prevent here and what you can detect but this is this is clearly insult hijacking where you're seeing thousands of installs come in with where the quick install time is under five seconds that is without a doubt fraud how many of you have seen one of these are heard of one of these before device farms yeah so those so these exist and you know we see a lot of data

here at apps fire this is this is honestly the number one source of fraud that we've seen and also one of the most difficult to detect and that's when you have a bunch of devices that can we'll see that here we go so they'll click on an ad they'll download maybe even engage with the app for a couple days fake like four or five days of retention then they will reset their device ID and download the same app again and there's clear ways to see this device but it all really depends on going back to that scale where you need to have a provider that you know at the end of the day if you're looking at your own data to prevent fraud that's great but if you can look at 60% of the entire advertising markets data that is very very impactful and that's how you can prevent this type of fraud which is number one from a type of fraud that we see carried apps fire with these device ID marathons you'll see a lot of groups

of installs hiding behind limit ad tracking as well and there's nothing wrong with new devices there's nothing wrong with limited tracking this occurs in the market but when you see an entire group of users all from the same publisher and they're all new devices or they're all limit ad tracking that's something to explore so this is what we see this is what it looks like in our dashboard with our with our fraud solution I think it looks pretty nice so you see this is across a media source you see that most of the these installs are normal but we're seeing that a specific media source it has over 90 to 100 percent new devices this is a metric that is very very tough to get and you want to make sure you're working with a provider that has the scale where they're able to see this many devices and able to come up with this metric because the fraudsters are betting on the fact that you don't have this metric so brings me to just just to kind of conclude there's a lot of things that you can prevent a lot of things that you can detect I hope that you've seen today

the top the top three types of fraud that we see in our data obviously you know work with your providers working with your with your partners to understand what and emphasize what is the type of insults that we don't want to pay for what is bad performance look like and then what is fraud look like in terms of apps fire we have products called like device rank where we have over 98% of the devices rated and if we see one bad device in our entire in our entire database we block that and immunize our entire client base from that so that's kind of taking forward action on this big problem that that's harming the industry and really incentivizing the advertiser to take action on this fraud and make sure they're not paying for again accusers and things like that and giving them metrics that they never had before and really empower them to spend more and we think that if we can help to solve this problem you know there's going to be

more trust there's going to be more transparency in the industry and a scanning that's what's going to increase ad budgets to the end of the day the legitimate networks will will survive and the data savvy marketers will also survive as well cool so if you have any of you have any questions we have great glossary online of all the different things you want to know about mobile ad fraud before you get into UA or if you're already experiencing some of these problems you're seeing bad traffic come in feel free to check that out or send me an email I'm happy to answer specific questions thank you second all right that's right you [Music]