Ad fraud: your exposure depends on what you buy

If you buy Google Ads and Meta directly — how most Indian SMEs run paid media — your fraud exposure is genuinely low and largely handled for you. If you buy open-exchange display, in-app video or affiliate clicks, it is not.

That distinction is missing from almost every article on this topic, and it is the only thing telling you where to spend your attention. Our performance marketing guide covers how the channels work; this page covers what goes wrong in each and who absorbs the loss.

What "ad fraud" actually covers

"Ad fraud" is a loose, emotive term. The measurement industry uses a tighter one: invalid traffic, or IVT.

The Media Rating Council (MRC) defines it in its Invalid Traffic Detection and Filtration Standards and splits it in two. Both definitions are from Section 1.1.2, restated in the MRC's 2024 IVT Interim Updates (April 2024).

Two things follow. GIVT is cheap to filter and almost everyone filters it. SIVT is where the money actually goes, and it needs someone deliberately looking.

The Trustworthy Accountability Group (TAG) keeps a more granular breakdown in its IVT Taxonomy (v2.0, 2019), citing the same MRC definitions. "Click fraud" sits inside this as one SIVT category, not the whole of it.

Exposure rises with every intermediary hop.

Why there is no fraud-loss number on this page

Billion-dollar loss figures get quoted constantly. We are repeating none of them. Every large global ad-fraud loss figure we could trace back is a vendor projection — published by a company selling fraud detection, with no inspectable methodology. Estimates differ by an order of magnitude. A number you cannot audit is not evidence.

The nearest credible, dated, method-stated study is the ANA's Programmatic Media Supply Chain Transparency Study (December 2023), which examined log-level data from 21 major advertisers and found about 36 paise of every rupee entering a demand-side platform reached the consumer. Read it carefully: that measures supply-chain waste — fees, "made for advertising" inventory, poor targeting — not fraud.

Your exposure by channel

This is the table to save. Fraud risk varies by what you are buying and who sits between you and the impression.

Notice the pattern: risk rises with the number of parties between your money and the screen. A direct Google or Meta buy has one intermediary. An open-exchange display impression can have five.

If open-exchange buying is where you are headed, read it properly first: mechanics in programmatic advertising in India, process in media buying, and the specifics of CTV advertising, display advertising and DOOH advertising separately.

What Google and Meta do for you automatically

More than most advertisers realise. Google's Ads Help page says plainly: "Invalid traffic refers to traffic that doesn't represent genuine interest in your business." Its "global ad traffic quality team uses automated filters, machine learning, and manual reviews", and the "Invalid clicks" column in your campaign reports shows traffic that Google's systems already filtered — adding that "Google doesn't charge you for these clicks."

Where filtering happens after billing, Google says it "automatically issues an invalid activity credit in the next billing cycle, when appropriate and possible." Since June 2026 a documented Report Editor template — Invalid Activity Credit Report: Search & PMax — shows credited clicks, so you can see this rather than take it on trust.

On its Ad Traffic Quality site Google describes "over 200 sophisticated filters to stop the vast majority of invalid traffic in real time or soon after." Its Campaign Manager 360 documentation uses the MRC vocabulary directly, and notes pre-bid removals are never bought while post-serve removals are credited back.

Meta's published position is thinner. Documented, via a Meta-authored IAB Europe post (April 2023): a multi-stage AI review system classifying Feed content, three inventory filter settings, and third-party verification partners reporting ad context. There is no advertiser-facing invalid-clicks column equivalent to Google's. For platform mechanics, start with our Google Ads guide and Meta Ads guide.

The checks we run before calling anything fraud

In our own work on client accounts, "I think we're being click-frauded" arrives roughly once a quarter. Here is the order we check things, using only the client's own reporting.

1. Add the Invalid clicks column in Google Ads, at campaign and ad group level, for the period in question. If Google filtered it, you were not charged and there is nothing to recover.
2. Open the Invalid Activity Credit Report in Report Editor and read the Credited clicks column. This shows what was refunded after billing closed.
3. Pull the search terms and placement reports. A spend spike usually has a mundane name: an irrelevant broad-matched query, or a mobile app placement nobody excluded.
4. Check whether Search Partners and Display Expansion are on. In unaudited accounts, they usually are.
5. Compare platform clicks against analytics sessions. A large one-directional gap is far more often a tagging fault than fraud.

The honest finding: most suspected fraud turns out to be something else. Bot traffic polluting analytics but never costing a click. A broken or double-firing tag. An unexcluded placement. A competitor's genuine but useless clicks. Real, chargeable, platform-missed fraud on a direct Google or Meta buy is the rarest explanation.

If nobody has looked at an account this way, a structured PPC audit finds more money than a fraud tool will. Rule out tagging faults through conversion tracking and server-side tracking checks, and where you cannot tell whether clicks were worth anything, incrementality testing answers what fraud tools cannot.

ads.txt and sellers.json, explained accurately

These two files get recommended as anti-fraud measures far beyond what they do.

ads.txt is a text file a publisher hosts on its own domain, listing which companies may sell its inventory. The IAB Tech Lab specification (v1.0.3, March 2021) states its goal as to "eliminate the ability to profit from counterfeit inventory in the open digital advertising ecosystem" by letting content owners "declare who is authorized to sell their inventory." It targets inventory offered under a falsified identity. A parallel file, app-ads.txt, covers apps.

sellers.json works from the other side: IAB Tech Lab describes it as a mechanism "to enable buyers to discover who the entities are" in a selling chain. ads.txt names authorised sellers but not the account identities behind them; sellers.json fills that gap and pairs with the OpenRTB SupplyChain object. The specs were finalised on 31 July 2019.

Brand safety and brand suitability are not the same thing

• Brand safety is the floor — content no advertiser should fund: illegal material, graphic violence, hate speech. Broadly universal.
• Brand suitability is your own line — sensitive-but-legal content you may or may not want to sit beside. A news brand and a toy brand draw it in completely different places.

The vocabulary most of the industry still uses came from GARM's Brand Safety Floor and Suitability Framework, first published September 2020, which described the floor as content "not appropriate for any advertising support" and the framework as a way of "delineating different risk levels for sensitive content."

One correction most articles have not caught up with, and it matters: GARM no longer exists. The World Federation of Advertisers announced on 9 August 2024 that it would discontinue GARM's activities. The framework's language survives as de facto industry vocabulary, and platforms including Meta still map their controls to it, but there is no body maintaining it. Treat GARM tiers as a shared dictionary, not a live standard.

What is live is the platform controls. Google's content suitability settings offer three inventory types — Maximum, Moderate and Limited — applying to YouTube, Display, Google Video Partners and the Search Partner Network depending on campaign type. Meta offers expanded, moderate and limited inventory filters. Both are two-minute settings most accounts have never moved off default.

When a verification vendor is worth paying for

Honest answer: for most Indian SMEs buying Google and Meta direct, it is not. Verification vendors measure, block and report on invalid traffic and content adjacency. They are genuinely valuable — in the environments where your exposure sits. If your whole budget runs on Google Search and Meta placements, you are paying a fee to re-check filtering the platforms already perform and already credit.

One caution. "Clicks aren't turning into leads" is usually a measurement question, not a fraud one — marketing attribution settles it. Rising costs with stable traffic quality are a competition question, and impression share shows that faster.

Spend with your eyes open, not with your guard up

The useful version of this topic is unglamorous. Know what GIVT and SIVT mean so you can read a report. Know that exposure is a function of how many hands touch your money. Check your own columns before buying a tool. Set your inventory controls once, and defer heavy verification spend until your channel mix warrants it.