While click fraud and identity theft are probably the most common forms of larceny on the Internet, I just heard of a company that sets a whole new standard of bad, lying to advertisers about, well, everything.

Click fraud is when a web site either clicks on its own ads to increase revenue, gets someone else to click on them with no intention of buying or works with botnets to generate millions of illegal clicks. I wrote a few months ago how longtime YouTubers were suffering income drops as Google algorithmically eliminated their botnet clicks. But click fraud requires a third party ad network to work. What I am writing about here is something completely different.

I have an old friend who works in the private equity world where companies are bought and sold for millions. He was about to do exactly that with a prominent web media site (buying it for low nine figures) when due diligence revealed the amazing news that the company was completely fudging its ad numbers.

It was too good to be true.

This can only happen for sites that sell their own ads but this particular site was just sending invoices to advertisers for amounts that were consistently 10 or more times what the advertisers would have paid on the basis of real — not fake — clicks.

It’s click fraud without the clicks, since all the complexity of clicks and bots is eliminated in favor of just sending a bogus bill.

I wonder how common this is? Have you heard of this happening or has it happened where you work or used to work?

There is apparently no standardized ad auditing capability on the Internet so scams of this sort are actually easy to do. And advertisers often lean into it by often preferring not to know precisely how effective are their ads.

Take my money, please.

Now here’s the strangest part: having discovered this blatant fraud my friend walked away from the deal but did nothing to bust the offending web site. His lawyer advised that because he signed a non-disclosure agreement with the crooks my friend might be legally liable if he turned them in to the authorities. It is his intention, though, to bust them just as soon as the NDA expires… in three years.

Yes, I know the name of the web site, but if I tell then again my friend is liable. So my lips, too, are sealed.

Until then I suppose advertisers will be soaked for more millions. That is unless the web site owners can find a really stupid buyer.