Top 10 Types of Ad Fraud Eating Your Media Budget in 2026

Ad fraud isn’t one thing; it’s a toolkit. Here are the ten techniques draining budgets in 2026, from crude to highly sophisticated — how each works, how to spot it, and what it costs you.

Two families run through the list. The first fakes the audience — bots, click farms, spoofed devices — so your ad is served to something that was never going to buy. The second fakes the inventory — stacked, stuffed, spoofed or arbitraged placements — so your ad is served somewhere it was never meant to run. Most real campaigns leak through both at once, which is why single-point fixes disappoint.

1. Bot networks

How it works: armies of automated agents generate impressions and clicks at scale, often from compromised consumer devices so the traffic carries residential IP addresses. With bots now 37% of web traffic (Imperva, 2025), this is the fraud most likely to be in your campaign right now.

How to spot it: flat overnight delivery, click-through rates far above the channel norm, and a conversion rate that collapses on particular placements.

2. Click farms

How it works: rooms of low-paid workers, or racks of real handsets, produce genuinely human clicks to order. Because there is a person behind the device, the traffic defeats simple bot filters entirely.

How to spot it: impressions concentrated in a handful of geographies you didn’t prioritise, high engagement with no downstream action, and device clusters that repeat day after day.

3. Device spoofing

How it works: fraudsters disguise cheap, emulated or obsolete devices as premium ones — a budget Android reporting itself as a current iPhone — to command higher ad prices.

How to spot it: implausible device mixes in your placement reports, clusters on long-obsolete operating systems, and identical user-agent strings appearing thousands of times.

4. Domain spoofing

How it works: low-quality inventory is misrepresented in the bidstream as a premium publisher, so you pay a national-newspaper rate for a placement that never ran there.

How to spot it: compare the domains in your delivery report against your allowlist, and check ads.txt and sellers.json compliance for anything unfamiliar.

5. SDK spoofing

How it works: fabricated in-app signals manufacture installs, opens and in-app events that never happened, draining app-install and re-engagement budgets against attribution that looks clean.

How to spot it: installs with no post-install activity, unnaturally short click-to-install times, and attribution concentrated in a small number of publishers.

6. Ad stacking

How it works: multiple ads are layered in a single placement. Only the top one is ever visible, but every advertiser in the stack is counted and billed.

How to spot it: viewability that is suspiciously perfect and shows almost no variance, paired with engagement rates far below what that viewability implies.

7. Pixel stuffing

How it works: an entire ad is crammed into a 1×1 pixel frame. It renders, it counts, it bills — and no human could ever have seen it.

How to spot it: measured viewability well below the campaign average on specific placements, and impression volumes that dwarf the publisher’s plausible audience.

8. MFA arbitrage

How it works: made-for-advertising sites buy cheap traffic, cram the page with ad slots, and resell your impressions at a markup. Nothing illegal happens, which is why it survives. At peak, MFA took 15% of programmatic spend and 21% of impressions (ANA, 2023).

How to spot it: unfamiliar, generic or churn-heavy domains in the placement report, and pages where the ad-to-content ratio is the whole business model.

9. CTV fraud

How it works: fake or spoofed connected-TV devices claim to be premium living-room inventory, exploiting a channel with high CPMs and comparatively weak measurement. Bots drive 65% of all CTV fraud (DoubleVerify, 2025), and DoubleVerify recorded CTV fraud schemes surging 140% globally in 2026.

How to spot it: CTV impression counts that exceed plausible household reach, device IDs repeating across unrelated apps, and delivery from data-centre IP ranges.

10. Retargeting fraud

How it works: bots deliberately visit your site and trigger your retargeting pools, so fraudsters can harvest your highest-value, highest-CPM ads later. You end up paying a premium to re-reach a machine.

How to spot it: retargeting audiences growing faster than genuine site traffic, and retargeting campaigns with strong CTR but conversion rates below prospecting.

How do you stop all ten?

No single tool catches all ten. Blocklists handle the crude techniques near the top of this list; the sophisticated ones — device and domain spoofing, MFA arbitrage, CTV and retargeting fraud — are built specifically to slip past anything list-based. Post-campaign reporting catches them only in the sense that a receipt catches a theft.

The one defence that scales across the whole toolkit is timing: verify a real human, on a real and correctly-targeted device, before the impression is bought rather than reconciling the damage afterwards. Every technique above depends on a fake or misrepresented impression being purchased in the first place. Remove that, and the entire toolkit stops paying.

Where to start if you only do one thing

Pull your placement report and your frequency distribution for a single large campaign. Between them they expose the two families above: unfamiliar domains point at inventory fraud, while a handful of “users” absorbing hundreds of impressions points at audience fraud. Neither check costs anything, and either one finding something is enough to justify verifying properly.

Want to know which of these ten are in your campaigns? We’ll show you on live delivery.