When you utilize pay-per-click advertising, you want to know that each click represents an honest-to-goodness potential customer.

Click fraud remains a persistent, troubling presence in online advertising, despite the continued evolution of detection technology.  "The bad guys are going to get very creative when they get hungry," says Ryan Smith, a principal researcher with Accuvant Labs, a company specializing in business tech security. "As long as there's a way for money to be made, the bad guys are going to find the loopholes."

Two recent lawsuits filed by Microsoft highlight one of those loopholes, a disturbing new trend in click fraud called click laundering.  Microsoft accuses the Texas operator of a science-related website of using sophisticated methods to collect revenues from clicks. Malware is used to impersonate search engines and send unsuspecting users to fake domains. When the user visits the domain and clicks anywhere on a page, they are clicking on a hidden ad, and the advertiser pays for the click.

Despite the aggressive pursuit of click fraudsters by Microsoft and other reputable companies, more than 17 percent of clicks were fraudulent in the first quarter of this year, according to Click Forensics, which monitors click fraud.  That jives with recent research by Visual IQ, which produces marketing intelligence software.  The company estimates marketers lose an average of 16.7 percent of their pay-per-click budgets to fraud.

"Many of our clients don't even know they are victims," says Visual IQ founder Anto Chittilappilly. "After it happens, you can file lawsuits against the fraudsters and the search engines, but to get that money in the bank is going to take a long time."

Click fraud can be particularly crippling for small to mid-sized businesses with limited advertising budgets. However, while you may be somewhat reliant on the big guys to patrol click fraud, there are best practices you can follow to protect yourself.

Common click fraud techniques

It helps to have some idea of what you're up against. Chittilappilly says the fraud might be perpetrated by your competitor, who drives clicks to deplete your advertising budget early in the morning each day. Unscrupulous website operators also try to cash in with fake clicks.

In addition to click laundering, click scams may use one of these techniques:

  • Manual clicking. In developing countries where labor is cheap, workers might be paid to click to run up totals
  • Software clicks. Automated clicks can quickly run up totals, Chittilappilly says.
  • Bot networks. Using malware to harness unsuspecting users' computers, criminals can create large networks of computers employing programs that imitate clicks. "This is really problematic and takes out most of the money in click fraud," Chittilappilly.

Sean Sullivan, security advisor of North American labs for security solutions company F-Secure, says he sees a significant amount of malicious code designed to affect ad clicks. "Some fraudulent activity would seem to yield small rewards, but remember that many participants come from developing nations," he says. "That base of people will continue to grow."

Your click fraud checklist

Being a vigilant, persistent advertising consumer is crucial to protecting your pay-per-click budget.  Experts offer these tips:

  • Partner with reputable firms. Don't bargain hunt. Rely on established brokers, marketing agencies and networks, says Kirby Winfield of Mpire, which produces AdXpose, online ad campaign verification and optimization technology. While you might not be able to afford this sort of technology on your own (AdXpose runs about $1,000 a month), you should ask what sort of verification software or system your partner is using. "Ask up front 'Do you provide verification of where your traffic comes from? Do you work with a third party?'" Winfield says. "Establish a relationship with your provider and verify they actually acquire their traffic in a transparent way."
  • Limit your campaign geographically. Approximately 44 percent of clicks originating in Vietnam are fraudulent, estimates Chittilappilly. If you're seeing high click totals from countries such as Vietnam, India, Nigeria, and Russia, you're likely the victim of click fraud. You can limit your pay-per-click campaign to where you sell your product or set limits to avoid regions rife with click fraud even if you sell globally.
  • Set daily budgets. Evaluating on a daily basis will help you red flag suspicious activity more easily. If your budget is depleted each day, monitor when the action occurs. "If all the clicks are happening at 2 a.m., clearly there is a problem," Chittilappilly advises.
  • Watch click-through rates. Realistically, you shouldn't expect more than 10 percent of people who view your ad to click through to your website, says Winfield. Be wary of an explosion of clicks generated through one URL.
  • Know where your ads are running. If your ad is supposed to run on a list of sites, be able to monitor how much of your volume went to premium sites, says Winfield.

It's not a case of buyer beware, says Winfield, but of "buyer be aware." Your careful monitoring of your pay-per-click budget is like using the Club to secure your auto, advises Smith, of Accuvant. "When you secure your car, the criminal goes by and picks another car. As long as you implement measures other companies aren't implementing, the other companies are going to be more likely targets."