Analysis Imagine a store where you go in, pay money, and sometimes leave empty-handed. That's digital advertising on social media in a nutshell because it's seemingly full of fraud.

Simon Arthur, founder of custom parts maker Big Blue Saw, believes he had more or less that experience buying Facebook ads. In a blog post on Friday, Arthur recounted how he paid Facebook to boost the exposure of posts made to his company's Facebook Page and received attention from what he believes are mostly fake accounts.

Arthur said he had previously been using Facebook's Boost Post option, by which Page owners can pay to have posts distributed more widely on the social network. He restricted the distribution of his post to those between the age of 18 and 65 who are living in the US.

After being advised to talk to a live Facebook ad salesperson, Arthur says he did so and, following the advice he received, set up a custom audience of the 5,000 or so people who had visited Big Blue Saw's Facebook Page in the past year. From that, he created a Lookalike Audience, said to be similar in terms of demographics and interests, to the custom audience of actual Page visitors.

Facebook says, "A Lookalike Audience is a way to reach new people who are likely to be interested in your business because they're similar to your best existing customers."

For Arthur, that's not quite right because it would mean his existing customers don't exist. He set his ad spending to $100 over two days and after a day his page had received around a thousand Facebook Likes.

But he believes most of these clicks were coming from fake accounts. He looked at the engagement he'd measured when he advertised to an audience composed of Friends of Friends, a group he said appears to be mostly real people, and it was 1.7 per cent.

Then he looked at the engagement he received through his Lookalike Audience and it was so much more that the figure seemed implausible, almost 70 per cent.

"[O]n the Lookalike audience, I got 1,055 post engagements (likes, clicks) and a reach of 1,524 people," he wrote in his post. "This theoretically means that 2/3 of the people who saw my post decided to engage with it. I can only conclude 2/3 or more of the Lookalike Audience is fake."

Who are you?

Asked in a phone interview with The Register how he could be sure these engagements came from fake accounts, Arthur acknowledged he has not investigated the accounts behind every one of the thousand-plus clicks and likes his ad campaign received. But he said those he reviewed didn't look right.

They often had similar generic names that differed only with prefix letter (e.g. John KSmith) and from 20 to 100 friends, often located in the Middle East, India, or Southeast Asia, he explained. He said he began looking into the accounts after receiving a like from someone with his own name, which while not uncommon made him wonder.

The Register asked Facebook to comment but a company spokesperson, while he challenged Arthur's claims, didn't offer a response on the record. While we cannot be certain whether any of these accounts are fake without access to internal Facebook data, it's well known that the company has struggled to rid itself of fake accounts. In the period between Q2 2018 and Q3 2018, Facebook estimates between 3 per cent to 4 per cent of monthly active users on the site were fake.

While Facebook certainly has happy advertising customers, dealing with fakery remains an ongoing issue for the company: On Thursday, Facebook said it had banned a digital marketing group in the Philippines – Twinmark Media Enterprises and all its subsidiaries – for coordinated inauthentic behavior and using fake accounts.

In a phone interview with The Register, Augustine Fou, a cybersecurity and ad fraud researcher who advises companies about online marketing, said Arthur's assessment seemed plausible.

"This happens and there are tons and tons and tons of fake accounts on Facebook, Instagram, Twitter, you name it," he said.

Fou recounted the experience of a client, a music seller, who had been using Facebook ads for the past five years. Facebook ads for this merchant had been performing progressively worse, with more clicks coming in but fewer sales.

Facebook's metrics, said Fou, were saying its ads had sent 100,000 clicks to the vendor's website. But the vendor's Google Analytics data showed only 10,000. Ninety percent of those clicks were fake, said Fou.

The problem turned out to be a checkbox that allowed ads on third-party sites. Facebook apparently has it checked by default. Over the past five years, Fou explained, there's been a shift in where Facebook shows ads, from Facebook.com to third-party sites that include Facebook ad code.

Once he unchecked it, said Fou, his traffic plummeted but his sales went back up – proof at least that digital advertising can work.

As long as there's money in it who cares?

Facebook's Lookalike Audience perhaps taps into dubious third-party websites and accounts that exist to profit from ad fraud. The company did not respond to The Register's request to reveal its own metrics on ad abuse or to provide figures rebutting Arthur's claim.

For Fou, who has documented the ad fraud ecosystem in various online reports, this form of ad fraud represents a tiny fraction of the rampant ad fraud plaguing digital commerce.

Digital ad spend was about $100bn in the US last year and Fou said only about 10 per cent goes through big publishers where the incidence of fraud is low. The remaining 90 per cent, much of which the industry refers to as programmatic advertising, he said, is difficult to be sure about.

The problem is that ad fraud is hugely profitable for both fraudsters and the ad tech firms and service providers that make the fraud possible. Fou estimates the returns for ad fraud are somewhere in the neighborhood of 2,500 to 4,100 per cent. Profit, researchers have found, can be as high as $24 million a month, though this varies wildly depending on the sophistication of the thieves and the scope of the operation.

With cloud services like AWS, said Fou, it's easy to spin up servers with an unlimited number of ad-laden webpages and bots to load those ad impressions.

The cybercriminal's cash cow and the marketer's machine: Inside the mad sad bad web ad world READ MORE

Ad fraud has been slow to attract the attention of law enforcement. The Justice Department last November announced the takedown of a botnet involved in ad fraud.

Fou suggested the indictments mean greater scrutiny from authorities – there have only been a few related cases in the past decade. Even so, he said, the risk to fraudsters is not defrauding advertisers but hacking, planting malware, or other computer crimes that make it easier to conduct ad fraud.

Things might be different if the ad industry and the cloud vendors wanted to stop ad fraud. But according to Fou, marketing executives care more about what they can spend with the results of that spending.

"VPs of marketing boast about their budgets," he said. "All they care about is how much they spend. If we solve the fraud, there will be far fewer ad impressions to buy, maybe 1/100th of current impressions, so their ad budgets would shrink."

"Why haven't we solved ad fraud?" said Fou. "We don't want to."

Smaller advertisers cannot afford to be as cavalier as marketers at major firms.

"I would definitely be very reluctant to do advertising in the same way again," Arthur said. ®