• by Tyler Loechner  @mp_tyler, June 30, 2014

DoubleVerify on Monday afternoon announced it had uncovered a "highly sophisticated" video ad fraud impression laundering scheme that it believes impacted over 1% of all digital video ads and potentially cost marketers over $5 million per month.

The fraud scheme included over 500 Web sites, and Wayne Gattinella, CEO of DoubleVerify, believes it impacted "virtually every video ad exchange," although he could not speak for exchanges that DoubleVerify is not partnered with.

"URL masking" was the device the fraudsters used in this scheme, per Gattinella, which means the actual URL in which the video ad is delivered is "masked" by being layered through other URLs.

In this case, the "front sites" -- the URLs used to mask the sites on which the ads will ultimately be served -- were designed specifically to attract video advertisers, perhaps because video ads command higher CPMs.

The front sites featured everything a video advertiser typically looks for, including prominent above-the-fold video placements, video content targeting high-value verticals (health, travel, auto, etc.) and phony banner ads from well-respected brands in an attempt to legitimize the site. Gattinella said these characteristics made programmatic ad buyers particularly vulnerable to this scheme.

The sites the video ads were ultimately served on tended to be "copyright infringement sites," per Gattinella. He explained that copyright infringement sites are unable to monetize their traffic because they are already flagged, "so they mask the ID of those particular sites by setting up complicated URLs that lead advertisers to believe what they are buying is high-quality."

"It's quite sophisticated," acknowledged Gattinella. "More so than we've seen on the display side. The front sites are attractive to video advertiser, particularly in the programmatic world. The use of phony banner ads which look really good is pretty clever and crafty, and they even used double masking to delay companies like ours [from uncovering them] in the first place. This is a very sophisticated approach to further deceiving the online marketplace."

Gattinella estimates the fraud scheme has been in place for 60 to 90 days -- "relatively new" in the world of online fraud detection, per Gattinella -- but noted the actual start date is hard to pinpoint. In terms of cleaning up, Gattinella said DoubleVerify is already working with its partners to eliminate these 500+ sites from supply sources.

The source of the fraud scheme hasn't been found, Gattinella said, as traces typically lead to dead ends overseas. In other words, the identity of the fraudsters is masked in multiple ways, mirroring the scheme they deployed.