Crypto click fraud: what you can actually check

36 cents of every dollar that enters a demand-side platform effectively reaches a consumer, according to the ANA's programmatic transparency study published in December 2023 and built on log-level data from 21 major advertisers. The ANA put the recoverable efficiency at $22 billion. Not all of that gap is fraud, much of it is fees and waste, but the study established what crypto advertisers already suspected about opaque supply chains. Crypto click fraud lives comfortably in that opacity, because crypto CPCs are high, verification is rare, and many advertisers never look past the click count.

You don't need enterprise fraud tooling to look. Here's what invalid traffic formally is, and the checks you can run this week with what you already have.

What counts as invalid traffic

The Media Rating Council's Invalid Traffic Detection and Filtration Standards (issued 2015, updated June 2020) split the problem into two tiers, and the split is useful for advertisers, since it separates what's cheap to catch from what isn't.

General Invalid Traffic, GIVT, is catchable with routine filtration: known data-center traffic, declared bots, spiders and crawlers, unknown or unusual browser user-agents, and impressions served into placements that can't render. Any serious ad system filters GIVT before billing.

Sophisticated Invalid Traffic, SIVT, is the expensive tier. The MRC's categories include automated browsing from emulators or hijacked devices, incentivized clicking including click farms, falsified measurement events (fake impressions, clicks, locations, even falsified consent strings), domain and app spoofing, and cookie manipulation. Detecting SIVT, per the standard, requires advanced analytics, multi-point corroboration, and significant human intervention. The standard mandates GIVT filtration and strongly encourages SIVT detection, which tells you something: even the industry's own rulebook concedes that the hard half is optional in practice.

The practical takeaway is that "we filter bots" is a claim about GIVT. Click farms with real humans on real phones sail past GIVT filters by design.

Five checks you can run in your own analytics

Because our placements carry UTM tags, every check below works on PraxAds traffic in your own GA4 property. They work on any network that lets you tag, and a network that won't let you tag has answered your question already.

• Compare clicks billed to sessions recorded. Establish the ratio in week one, then watch for breaks. Gaps have innocent causes, ad blockers and abandoned loads, but a ratio that suddenly worsens is your earliest alarm.
• Read engagement, not volume. Fraudulent sessions cluster at near-zero engagement time with no scroll and no second page. A placement whose sessions average two seconds is either fraud or a terrible placement, and either way it doesn't deserve your budget.
• Check geography against your targeting. Paid sessions arriving from countries you never targeted, or a distribution wildly different from the placement's stated audience, deserve a written question to the network.
• Look at hour-of-day patterns. Human traffic follows waking hours in its time zones. Clicks arriving in a flat line around the clock, or in bursts at 4 a.m. local to the placement's audience, look like scripts because they usually are.
• Sample your server logs. Repeated IPs across many clicks, user-agents from data-center ranges, and requests that fetch the page but no assets are all visible in raw logs, and GIVT-style checks like these need no vendor at all.

None of this catches everything. Sophisticated fraud is sophisticated precisely because it simulates engagement. But these checks catch the lazy majority, and they cost you an hour a week.

What we can and can't promise about crypto click fraud

We built PraxAds assuming nobody should take an ad network's word for its own traffic quality, ours included. The structural choices follow from that.

Publishers enter the network through five vetting checkpoints, listed on our network page: a 10,000 monthly pageview minimum, at least 40 percent Tier-1 geographic traffic, an organic and direct traffic backbone, three months of domain history, and analytics cross-verified against independent traffic estimates. Sites whose claimed numbers don't survive cross-verification don't get in. A small vetted network is easier to police than a long-tail exchange, which is a real advantage of being at founding stage, and we publish no reach numbers for the same reason, since any figure before measurement would be a guess.

On the money side, deposits are prepaid, minimum bids are shown in the campaign form before you commit, and campaigns stop at 95 percent of budget. Every placement is tagged so the five checks above run in your GA4, and image-only creatives mean nothing served through us executes code in a reader's browser.

What we can't promise is zero fraud, because nobody honestly can, and the MRC standard's own language about SIVT explains why. What we promise instead is that you'll always have the data to catch a problem, and a written answer when you bring one to us.

The test that sorts networks fast

Ask any network three questions before depositing. Can I see your prices in public. Will every placement carry my UTM tags. Will you accept my server-to-server conversion data instead of only your own pixel.

If a network hides its prices and blocks independent measurement, treat that as the answer, and keep your money.

The pattern behind the ANA's findings was structural: intermediaries multiply where verification is absent. Crypto advertising has fewer verification norms than mainstream programmatic, not more, so the burden lands on you, and the checks in this article are the minimum viable burden. An advertiser who reads their own GA4 weekly is harder to defraud than one running any tool they never open.

The ANA study that produced the 36-cent figure analyzed log-level data from 21 advertisers, and it took an industry trade body until December 2023 to get that access.