At some point a partner will email you to say that a portion of last month’s traffic was invalid, and that they are withholding payment accordingly.<\/p>\n\n\n\n
The email will name a vendor and a percentage. It will rarely explain how the number was produced. And you will have to decide, usually within a few days, whether to accept it or push back on a subject where the other side appears to hold all the evidence.<\/p>\n\n\n\n
It helps enormously to know what is actually happening underneath.<\/p>\n\n\n\n
The first thing worth separating. The industry splits invalid traffic into two categories, and they are treated very differently.<\/p>\n\n\n\n
General invalid traffic<\/strong> is the uncontroversial stuff. Known data-centre IP addresses, declared search engine crawlers, bots that identify themselves honestly. Filtering this is largely a matter of consulting published lists. Nobody argues about GIVT.<\/p>\n\n\n\n Sophisticated invalid traffic<\/strong> is everything designed not to be caught. Bots that render pages, move a cursor, scroll at plausible speeds. Hijacked residential devices sending traffic that comes from a real home connection. Ad stacking, where ten ads occupy one slot and all count as viewed.<\/p>\n\n\n\n Nearly every dispute you will ever have is about SIVT. And SIVT detection is probabilistic, which is the part nobody says out loud in the email.<\/p>\n\n\n\n No single signal proves anything. Detection works by stacking weak signals until a pattern becomes hard to explain innocently.<\/p>\n\n\n\n Network signals.<\/strong> Does the IP belong to a data centre, a residential ISP, a mobile carrier, a VPN? Residential proxies are the standard way of defeating this, which is why network data alone is no longer sufficient.<\/p>\n\n\n\n Device consistency.<\/strong> A browser announces things about itself, and those claims can contradict each other. A user agent claiming to be an iPhone with a screen resolution no iPhone has ever shipped. A device reporting a timezone that does not match its IP geography.<\/p>\n\n\n\n Behaviour over time.<\/strong> Real people are irregular. They pause, scroll back, get distracted, take four seconds to notice a button. Automated traffic tends to be too consistent, and consistency at scale is one of the strongest signals there is.<\/p>\n\n\n\n Traffic shape.<\/strong> This is where most publisher-level flags originate. A site with an organic audience has messy, weather-like patterns. Traffic that arrives in flat plateaus, or peaks at exactly midnight UTC, or shows the same session duration across thousands of visitors, does not look like people.<\/p>\n\n\n\n Rendering checks.<\/strong> Was the ad actually in a viewport a human could see? Was it in an iframe one pixel wide, or stacked behind another ad?<\/p>\n\n\n\n Because they are running different models on different data, and each is making a judgement call about where to draw the line.<\/p>\n\n\n\n A vendor with deep visibility into one part of the ecosystem sees patterns another cannot. Each weights signals differently. Each sets its own threshold for how suspicious is suspicious enough, and that threshold is a business decision about which error to prefer. Flag too aggressively and you destroy legitimate publisher revenue. Flag too gently and you fail the advertisers paying you.<\/p>\n\n\n\n Reasonable people set that threshold in different places. So the same million impressions can come back at 2% from one vendor and 6% from another, and neither is lying.<\/p>\n\n\n\n Which is exactly why a claim that names no vendor, no methodology and no time period is not a claim you should accept quietly.<\/p>\n\n\n\n Ask which vendor, and whether they are MRC-accredited.<\/strong> Accreditation means the methodology has been independently audited. It does not make the vendor correct, but it means somebody outside the company has examined how the number is produced.<\/p>\n\n\n\n Ask for the breakdown.<\/strong> Which placements, which days, which geographies, GIVT or SIVT. Real invalid traffic clusters. It concentrates in a placement, a traffic source, a date range. A flat percentage applied evenly across your whole inventory is a red flag about the claim, not about your traffic.<\/p>\n\n\n\n Check the timing.<\/strong> Most agreements, including ours, require IVT claims to be raised within thirty days of month end. A claim about traffic from four months ago is usually a claim about somebody’s cash position.<\/p>\n\n\n\n Look for the source yourself.<\/strong> If the flagged window matches something you did, you have your answer. A traffic campaign, a new content partner, a syndication deal, a widget you installed. In my experience the large majority of genuine publisher IVT problems trace back to purchased traffic that somebody bought in good faith from a source they did not vet.<\/p>\n\n\n\n Then decide whether it is worth fighting.<\/strong> Sometimes the claim is right and the useful response is finding the cause. But accepting an unevidenced deduction sets a precedent, and partners notice which publishers check.<\/p>\n\n\n\n The reliable protections are unglamorous.<\/p>\n\n\n\n A publisher accused of invalid traffic is asked to disprove a claim built on data they cannot see, using a methodology they are not shown, by a vendor they did not hire, within a window somebody else set.<\/p>\n\n\n\n That asymmetry is real and it is not going away soon. What you can do is refuse to treat these claims as weather. Ask which vendor. Ask for the breakdown. Check the dates against your own records.<\/p>\n\n\n\n Most partners sending an IVT deduction are acting in good faith on data they received from someone else. Some are not. The questions cost you nothing and they sort one from the other quickly.<\/p>\n","protected":false},"excerpt":{"rendered":" At some point a partner will email you to say that a portion of last month’s traffic was invalid, and that they are withholding payment…<\/p>\n","protected":false},"author":1,"featured_media":23,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-22","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ad-quality-fraud"],"_links":{"self":[{"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/posts\/22","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/comments?post=22"}],"version-history":[{"count":1,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/posts\/22\/revisions"}],"predecessor-version":[{"id":24,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/posts\/22\/revisions\/24"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/media\/23"}],"wp:attachment":[{"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/media?parent=22"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/categories?post=22"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nasrev.com\/blog\/wp-json\/wp\/v2\/tags?post=22"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What detection actually looks at<\/h2>\n\n\n\n
Why two vendors return two different numbers<\/h2>\n\n\n\n
What to do when a claim arrives<\/h2>\n\n\n\n
Staying clean, which is mostly boring<\/h2>\n\n\n\n
\n
The part that is genuinely unfair<\/h2>\n\n\n\n