Future of TV Briefing: DoubleVerify and Roku uncover CTV ad fraud scheme costing advertisers $7.5M per month

As the connected TV ad market matures, so too does the sophistication of CTV fraudsters.

DoubleVerify and Roku have uncovered a CTV ad fraud scheme that has taken fraudsters’ traditional domain spoofing tactic to a new level. Discovered late last summer and still active, the scheme — dubbed “CycloneBot” — may be costing advertisers as much as $7.5 million per month in fake impressions.

“This is one of the largest [CTV] fraud schemes that we’ve seen over the last several years, just from scope and scale of potential risk of dollars and the number of ad requests,” said DoubleVerify CEO Mark Zagorski. He noted that the CycloneBot name was chosen because the scheme resembled a cyclone: “It’s wide, it’s fast and it generates a huge number of requests.”

What makes CycloneBot unique among CTV fraud schemes is its tactic of mimicking extended CTV viewing sessions. Typically, CTV fraud schemes activate a device or server used to spoof impressions — by passing a fabricated URL designed to look like the source of a CTV bid request — just long enough to secure an advertiser. These short session times can signal to companies like DoubleVerify that a real human watching on a real CTV screen is not on the other end of the corresponding impression. CycloneBot, by contrast, spoofed longer CTV session times, generating four times the average amount of traffic compared to other CTV fraud schemes.

As a result, CycloneBot — which can spoof 1.5 million devices — is able to generate 250 million fake ad requests per day.

How CycloneBot was detected

Sophisticated as the CycloneBot fraud scheme is, it has not affected advertisers buying CTV ads through Roku. That’s because of Roku’s Advertising Watermark, through which the CTV platform effectively encodes a signature to publisher requests for advertiser bids to verify them as authentic CTV impressions. Given CycloneBot’s longer session times obscuring a historically reliable indicator of fraudulent CTV traffic, DoubleVerify was able to use Roku’s Advertising Watermark — which is offered for ads bought through Roku’s OneView ad-buying platform and has been adopted by publishers including Discovery and Fox for their own sales — to deduce the spoofing.

“What [the Roku Advertising Watermark] actually does is it looks at the channel-level information and the user-level information — the identity we have of the user with respect to this user actually playing that channel at that point in time to send the ad request — that information we have. It’s our media player, our operating system,” said Louqman Parampath, vp of product management for advertising at Roku. The CTV platform passed that information with the bid requests to DoubleVerify in “near real-time,” he said, for the verification firm to cross-reference the authenticated bid requests with others in order to determine the bid requests spoofed by CycloneBot.

Given the Roku Advertising Watermark’s role in uncovering the CycloneBot scheme, it would make sense for it — or something like it — to become a standard tool across the CTV ad market. And that’s the plan. Roku is having discussions about how to adapt the Advertising Watermark into an industry standard, said Parampath.

“We would want to help move the industry in the direction that we’ve already done with the watermark, which is to use capabilities like this to ensure that you can validate and verify the bid request in real time,” he said.

The state of CTV ad fraud

CycloneBot’s scope and sophistication should be cause for concern for CTV advertisers. While fraud has not been a pervasive issue in CTV like it has been in online display advertising, it is still an issue, and CycloneBot shows how advanced CTV fraudsters are becoming.

One reason that fraud has been less of a concern in CTV is that it’s been seen by ad buyers as an issue affecting the open programmatic market, whereas many advertisers buy CTV inventory directly or via programmatic guaranteed and private marketplace deals.

“I definitely think [fraud is] more prevalent in the open market. I mean, it’s certainly possible for it to exist when it’s bought in a PMP or via direct [insertion order], but I would expect that it would be significantly lower,” said Harry Browne, vp of client strategy and analytics for Tinuiti’s Streaming+ division.

Additionally, advertisers and agencies like Tinuiti have implemented measures to mitigate fraud, such as using demand-side platforms and ad servers that protect against invalid traffic, which has made “the frequency at which we’re running into these issues in a CTV environment pretty low,” he said.

“Ad fraud has not historically been a major concern in the CTV space. For most of our clients, CTV inventory is primarily purchased direct or via PG/PMP, leading to a more curated, quality supply of inventory, rather than on the open web where fraud would be more prevalent. That said, third-party ad verification is now more widely accepted across CTV partners, enabling reporting of fraud/invalid traffic and therefore allowing advertisers to optimize towards the most brand safe, fraud-free environments,” Marcy Greenberger, chief investment officer at UM Worldwide, said in an email.

The future of CTV ad fraud

However, even these more direct forms of CTV ad buying are not entirely invulnerable to fraud. Zagorski and Parampath acknowledged that CTV fraud is more pervasive in the open market, but each also said “nothing is immune to fraud.”

“Spoofing URLs is the meat and potatoes of CTV fraud that can be inserted anywhere in the buying chain that someone could try to jam it in. If there’s a server-side ad inclusion call, you could try to jam a spoofed URL in there,” said Zagorski. “And yes, a direct buy is definitely the safest way to go. However, those can be hijacked or co-opted in the ad buying process.”

Furthermore, fraud may become more of a concern in the CTV ad market as the volume of streaming ad inventory proliferates and streaming ad sellers look to the open programmatic market to fill impressions.

“The frequency at which people are buying CTV on the open market is growing,” said Browne. “There’s obvious advantages to buying in a programmatic environment because you can do all sorts of things with targeting and IDs. On the flip side, that increases the potential for fraud.”

What we’ve heard

“They haven’t been someone we’ve deliberately targeted [for buying connected TV ad inventory]. Usually, a strategy [of buying ads from smart TV platform owners like Vizio] is specific to those core verticals [of media and entertainment advertisers]. But we run on Vizio screens. We have, generally for broader enterprise clients, favored other, holistic, DSP approaches, whether Amazon or Roku or The Trade Desk.”

— Agency executive on Vizio’s ad-sales standing among clients

WTF are outcome-based measurement guarantees?

In preparation for this year’s upfront market — and the potential for performance-based buying to be more prevalent — I put together this explainer video on the practice of buying and selling TV and streaming ads based on what business results were generated.

Numbers to know

97.7 million: Number of subscribers that Warner Bros. Discovery has across its streaming services and HBO’s traditional pay-TV network.

$17.3 billion: How much total revenue, including subscription- and advertising-based revenue, streaming services are predicted to generate this year to surpass pay-TV subscription revenue in the U.S.

49 million: Number of U.S. subscribers that that traditional pay-TV services are predicted to have in 2029, a 51% decline from the current count.

$2.2 million: How much Disney is charging for ads to air during the Academy Awards broadcast next month.

98%: Percentage share of public videos on TikTok that are created by the top 25% of U.S. adult users.

What we’ve covered

How agencies are tackling growing sports media fragmentation:

• The different distribution methods for sports programming has an effect on ad prices.
• Streaming has expanded distribution opportunities for smaller sports leagues, which creates opportunities for smaller brands to reach sports fans.

Read more about sports media here.

What Walmart’s Vizio acquisition could mean for retail media — and the ripple effects that may hit industry data:

• Ad buyers see the acquisition giving Walmart an opportunity to attract more brand and retail ad dollars.
• Walmart could use Vizio’s automatic content recognition technology to improve its targeting and measurement capabilities.

Read more about Walmart’s Vizio acquisition here.

Video-focused firms Pixability, Culture Genesis team up to expand diverse creators network:

• The video ad company and digital video network will add 1,500 creators from Culture Genesis to Pixability’s Inclusive Media Initiative.
• IMI connects diverse YouTube creators with brands and agencies.

Read more about diverse creators here.

CTV providers court SME ad spend as the streaming wars enter a new era:

• Two people said Roku plans to sunset its OneView demand-side platform in favor of its Roku Ads Manager self-serve buying tool.
• The change seems to be an attempt to cater more toward small- and medium-sized advertisers.

Read more about Roku’s ad platform plans here.

What we’re reading

Warner Bros. Discovery pulls back on Paramount purchase:

The parent company of HBO and Max is no longer looking to acquire the CBS and Paramount+ owner, leaving Skydance Media as Paramount Global’s primary suitor, according to CNBC.

Walmart-Vizio puts pressure on Roku:

Vizio’s CTV platform footprint pales in comparison to Roku’s, but the former’s new parent company could give Vizio a TV sales boost at a time when Roku’s hardware business has sagged and its platform growth has slowed, according to The Wall Street Journal.

Charter eyes Altice acquisition:

As the traditional pay-TV business continues to shrink, these two pay-TV providers are looking to bundle up, according to Bloomberg.

Tyler Perry sees the AI writing on the wall:

OpenAI’s unreleased generative AI tool for video, Sora, is already having an impact on the entertainment industry, with Tyler Perry opting to pause his studio expansion plans because of the AI technology’s potential use in lieu of some physical production needs, according to The Hollywood Reporter.

Amazon is/isn’t folding Freevee(?):

Amazon may be looking to shut down its free, ad-supported streaming TV service Freevee, according to Adweek, though the e-commerce giant has denied the plan in a statement to other outlets.