The Next Era of Spoofing: Smart Refrigerators Impersonating CTV

Where there's a will, there is fraud. And in the ballooning connected TV landscape, more creative schemes are emerging. A brand wants to buy ad space on a streaming platform, like Hulu or Tubi, sending their media buyer to an ad-tech vendor to bid. But instead of the request landing on a TV in a family’s living room, it doesn't reach any eyeballs. On the backend, the device the ad actually appeared on resembles a smart refrigerator, smart watch or another Internet of Things (IOT) device. In reality, the device was totally fake. Fraudsters use publicly available lists of connected devices to find plausible ways to trick ad tech pipes, in a new ad fraud scheme identified by ad-tech firm DoubleVerify. It's a more updated version of classic domain spoofing, the passing off of fake or low-quality impressions as those from a pricier tier. DoubleVerify—a verification ad-tech company that makes money by ensuring ads end up where brands intend them to—first identified this type of scheme, dubbed LeoTerra, in 2020, sans IoT fraud. In all its iterations, fraudsters direct bid requests to invalid CTV devices. But in the most recent version identified, the bad actors try to make their spoofing less obvious by using the technical nomenclature of tech where ads can already go—connected devices like watches and refrigerators—but not the connected TV devices advertisers originally bid on. In all the schemes, no one actually sees the ad. If DoubleVerify did not intercept the fraud, it would have cost the company's advertising partners $10 million, it said. “We looked for certain kinds of signatures that [inventory is] fraudulent,” DoubleVerify's chief product officer Jack Smith said. “We started to see patterns that [fraudsters] were just rotating through these device lists.” The research is another example of the ways that the ad tech that undergirds the booming connected TV market can find itself susceptible to fraud, given a structural lack of transparency and the relative immaturity of the space, compared to the older, more developed open web. U.S. ad spend directed toward CTV is expected to increase by 32% this year to $19 billion, per eMarketer, while the connected devices market is anticipated to rise by 18% to 14.4 billion connections this year, according to IoT analytics. While there have been instances of fraud in the connected device market, the growth trajectories are giving fraudsters more vectors to hide behind. “Fraud does follow the money and there’s a lot of money in CTV and we see a lot of fraud schemes in CTV,” Smith said. In Connected TV, Brand Safety Is Still a Goal, Not the Norm The root of the problem An independent ad-tech researcher, who requested anonymity to discuss in-progress research, said that the bad actors leading CTV fraud schemes are often unscrupulous sell-side ad-tech. In their own work, the researcher found ads winding up at fraudulent locations, including those that are invalid and on non-CTV devices. Both the demand-side technology and supply-side technology are liable for letting fraudsters act as legitimate sources of inventory, the researcher said. Supply-side technology is particularly liable, though it can be hard to ascertain if companies are actively perpetrating fraud—or if their efforts to prevent it are insufficient, letting shady resellers slip through. “[SSPs are] where the buck should stop,” the researcher said. “Their raison d’etre is to value and curate inventory,” DoubleVerify said that fraud comes from a variety of untrustworthy supply sources and—in this case—the bad actor is not known to DV. The study points to the buy side’s need for more transparency from sellers, said Alex Stone, svp of advanced video and agency partnerships at Horizon Media. Advertisers have inadvertently funded misinformation pedaled by connected TV publishers, previous Adweek reporting has found, a reality that can be partially mitigated by buying directly from publishers —rather than large resellers or aggregators like Amazon or Roku, industry sources say. “The root of this problem is that there needs to be more transparency from the inventory suppliers on the factors and signals that matter most when determining the quality and suitability of a buy,” Stone said. “Buyers are seeking device-level impression reporting, app, genre, context, program level.”