Invalid traffic, defined.

Invalid traffic is a billing problem before it is a security problem. A campaign budget is spent one visit at a time, and every visit that was never a potential customer is money billed for nothing. You buy clicks; what arrives are visits — and a share of what arrives was produced by machines, paid clickers, or accidents rather than by anyone with a chance of converting. Industry benchmarks put invalid traffic above 10% of paid traffic. At that rate the line item is not rounding error. It is one of the larger recurring costs in a paid media program, and the only one that never appears on an invoice under its own name.

The measurement standard comes from the Media Rating Council. The MRC defines invalid traffic (IVT) as any impression, click, or conversion event that does not originate from a genuine human with a real opportunity to engage — activity that should not be counted toward paid media results. The definition is deliberately intent-free. It does not ask whether anyone meant to deceive. It asks whether the event deserved to be counted.

One structural fact shapes everything that follows: the platforms that sell the clicks also grade them. Every major network filters some invalid activity and credits some of what slips through, and every major network marks its own homework while doing so. That is not an accusation of bad faith. It is a conflict of interest built into the billing relationship, and it is the reason independent measurement exists as a category. The seller's count and the buyer's count should come from different parties. Everywhere else in procurement this is obvious. Paid media has been the exception.

Invalid traffic is not one phenomenon. It is a family of them, each with its own origin and its own tell.

• Server-farm automation. Scripted clients running on rented hosting fire clicks and visits at scale. Real shoppers do not browse from hosting infrastructure, so traffic arriving from known server ranges is the clearest single category.
• Masked and relayed traffic. Visits routed through anonymizing proxies and VPN exits, dressing a connection up as home broadband. Masking alone proves little — real people use VPNs — which is why it only matters in combination with other evidence.
• Automated browsers. Full browser environments driven by software rather than a person. They execute the page, load the measurement script, and imitate engagement, which separates them from cruder scripted clients.
• Click farms. Real people on real devices, paid to click. The hardware and the connection are genuine, so the giveaway is behavior — identical session shapes repeating across supposedly unrelated visitors.
• Hijacked devices. Malware-conscripted consumer browsers producing clicks their owners never see. Residential connection, genuine device, no human intent.
• Arbitrage sub-sources. A publisher buys cheap traffic and resells it into your campaign at a margin. The clicks appear to come from the publisher's site; the supply chain behind them runs several tiers deep and gets worse at every tier.
• Accidental and duplicate clicks. Fat-fingered taps and habitual double-clicks. No malice, same billing consequence.
• Non-rendering clients. Crawlers and tools that fetch a page without ever running it. Measurement that lives only in the page's own code never sees them at all.

The categories overlap in practice. A single low-quality placement can route several of them at once, which is why classification matters less than attribution. Knowing which sub-source delivered the traffic is worth more than knowing precisely which species it was.

The MRC splits invalid traffic into two tiers, and the split is load-bearing.

General invalid traffic (GIVT) is the tier that makes no effort to hide. Declared crawlers, agents on the IAB/ABC robot lists, monitoring and testing tools, and traffic from known server ranges all identify themselves — by announcement or by origin. GIVT can be filtered with straightforward rules, and the major networks do filter much of it before it reaches an invoice.

Sophisticated invalid traffic (SIVT) is built to survive those rules. Automated browsers that execute scripts and imitate scroll and click timing. Click farms riding residential connections that pass any origin check. Hijacked consumer devices whose every observable property is genuine. Residential proxy networks that launder a connection's true origin through real households. Falsified measurement events injected without any page ever being shown.

The practical asymmetry is the point. Most advertisers assume their networks have removed the invalid share, and for GIVT that assumption is roughly fair. The traffic inflating a cost-per-click report is therefore almost always SIVT — the tier that passed the seller's filters and now sits in the buyer's data wearing the costume of engagement. Catching GIVT is a list problem. Catching SIVT is an evidence problem: no single observation condemns a visit, so the case has to be assembled from many independent ones.

There is a second asymmetry worth naming. GIVT costs volume; SIVT costs judgment. A crawler inflates a click count and stops there. A click farm that completes calls-to-action teaches a bidding algorithm that the placement works, and the algorithm scales spend toward it. The expensive tier is the one that lies convincingly.

Three terms circle the same territory and draw the boundary in different places. The comparison advertisers search for — IVT vs click fraud — is a containment relationship, not a rivalry.

Invalid traffic is the measurement term: the MRC umbrella for any event that should not have been counted, with no claim about intent. An accidental double-tap is IVT. So is a botnet.

Click fraud is the intent-laden subset. Click fraud is the deliberate generation of invalid clicks on paid ads — to drain a competitor's budget, to inflate a publisher's per-click revenue, or to feed an arbitrage chain. It can be fully automated or fully human; a click farm is fraud committed by hand. Every instance of click fraud is invalid traffic. Most invalid traffic is not provably click fraud.

Ad fraud is the widest term. Ad fraud is any scheme that siphons advertising spend without delivering a genuine audience, and much of it never involves a click: impression fraud (ads rendered where no one can see them), domain spoofing (inventory misrepresented in the bid stream), and made-for-advertising content farms built to harvest programmatic budgets. Those are impression-side problems with impression-side defenses. The click-and-visit side — the part that lands on your pages and pollutes your conversion data — is the part per-visit measurement addresses. Bot traffic, for completeness, names a mechanism rather than a category: the automated portion of all of the above. Bot traffic detection treats it on its own terms.

The vocabulary is leverage, not pedantry. Telling a network that one of its publishers is committing fraud is an accusation the data cannot substantiate and a conversation that goes nowhere. Telling the same network that a specific placement's visits score far below the account average is a measurement claim with a remedy attached. IVT language keeps the discussion on evidence. Fraud language ends it.

The threat profile differs by channel, and so does the remedy.

Search. High commercial CPCs make each invalid click expensive on its own. The characteristic patterns are competitor automation clustered on branded and high-intent keywords, and repeat arrivals from narrow origins. Google filters some of this and credits some of the rest; the gap between what the platform catches and what independent measurement sees is the working margin. Google Ads click fraud and competitor click fraud cover the channel-specific patterns.

Native and push. The networks aggregate thousands of publisher sites, and quality varies enormously across that supply — not because the network is the culprit, but because its long tail of sub-publishers, zones, and widgets is where arbitrage chains and click farms attach themselves. The network's own tracking tokens — site, zone, and widget identifiers passed through URL macros — are the attribution handles that make the long tail legible. Bot traffic by network compares the channels; the tracking tokens reference covers setup per network.

Programmatic display. Domain spoofing, hidden frames, and ad stacking inflate impression counts without genuine exposure. These are fought largely upstream, with ads.txt and sellers.json, rather than on the landing page.

Affiliate and lead generation. Inflated click counts chasing per-click commissions, and automated form fills chasing per-lead payouts. Behavioral evidence — forms completed faster than a human can read them — carries most of the weight here.

Across every channel the constant is the same: the problem concentrates in specific sub-sources. Whole networks are rarely bad. Specific placements very often are, and the difference between those two sentences is the difference between quitting a channel and fixing one.

No single observation separates invalid traffic from genuine visits. A real customer can arrive through a VPN. A sophisticated operator can rent a residential connection. Any one test, taken alone, has a counterexample — which is why measurement that leans on one tell produces either misses or false alarms, and a false alarm against a real customer is the more expensive failure.

Sound measurement weighs independent evidence from three angles and lets the combination decide.

• Where the visit came from. The network and connection behind an arrival are observed as it happens, not reported by the page, so nothing running on the landing page can dress them up. Traffic from server farms and known server ranges, connections behind anonymizing relays, and origins inconsistent with the campaign's targeting all register here.
• What answered. Real consumer devices present a coherent, internally consistent picture of themselves. Automated browsers and scripted clients tend to get small things subtly wrong — individually excusable, collectively damning.
• How it behaved. People are noisy. They hesitate, scroll unevenly, move a pointer imprecisely, and act on different timing every visit. Automation is precise and repetitive: calls-to-action hit faster than a human could read the headline, sessions with no movement at all, identical timing repeated across thousands of supposedly unrelated visitors. Clients that fetch the page but never run it are their own giveaway — one that page-only measurement misses entirely.

This is how ValidVisit works. Every visit arriving from paid campaigns is weighed against 100+ independent data points across those three angles and distilled into a single 0–100 quality score, with the evidence behind each verdict kept attached to the visit. Scoring happens after arrival. ValidVisit does not stand in the click path, challenges no one, and never turns a real customer away — it measures, attributes, and reports. The mechanics are laid out in how detection works and how it works.

An advertiser who suspects invalid traffic has a hunch. An advertiser holding per-visit scores attributed to specific publishers, zones, and widgets has a case, and the difference shows up in three places.

Network conversations. A complaint that 'the traffic seems bad' gets a templated reply. A per-placement breakdown showing which zones score in the invalid band, with the evidence attached, gets placements removed — because it is specific, checkable, and reasonable to act on. The network is not the adversary in this conversation; its long-tail sub-sources are, and networks cut sub-sources that documented evidence makes indefensible.

Platform credits. Google runs a formal invalid-activity credit process, and other platforms have equivalents. The platform makes the final determination and its own filters set the baseline, but independent per-visit records — timing, origin patterns, per-placement concentrations — are exactly the documentation those reviews ask for. Google Ads refunds covers the process end to end. ValidVisit supplies the evidence; the request is yours to file.

Optimization integrity. The least visible payoff and the largest. Automated bidding learns from the engagement and conversion signals your campaigns send back. When invalid visits complete calls-to-action, the algorithm reads success and scales budget toward the sub-sources producing them. Invalid traffic does not just waste the spend it consumed; it steers the next dollar toward more of itself. Keeping flagged visits out of the signals you feed back breaks that loop. A defensible count is not only for arguing with other parties — it keeps your own automation honest.

One boundary stays fixed throughout: ValidVisit reports; you apply the exclusion. The score, the attribution, and the evidence arrive ready to act on. The action — the placement exclusion, the credit request, the budget shift — happens in your accounts, under your control.

The working sequence, for an account of any size.

1. Instrument attribution before scale. Pass each network's tracking tokens — site, zone, widget, campaign — through your URLs so every visit ties back to the sub-source that sent it. The tracking tokens reference lists the macros per network. Without this step, a bad score is a fact without an address.
2. Baseline new sources small. Run new placements and networks at conservative budgets and read per-source scores for the first days before scaling. Structural quality problems announce themselves early and cheaply.
3. Exclude at the sub-source level. Cut placements, not channels. The per-network playbooks walk the exact steps: Taboola, MGID, PropellerAds, ExoClick, and Zeropark.
4. Quarantine flagged visits from conversion signals. Keep low-scoring events out of the data your platforms optimize on, so bidding learns from customers rather than automation.
5. Request credits where the evidence supports it. Document the pattern and file through the platform's own process, with independent per-visit records as the supporting exhibit.
6. Keep watching. Sources decay. A placement that scored clean at launch can degrade as its own supply mix shifts, so quality review is a recurring calendar item, not a launch-week task.

None of this stops a machine from clicking an ad. Nothing advertiser-side does — measurement happens after arrival, on your page, after the budget moved. What the sequence does is narrower and more valuable: it stops invalid traffic from spending the next dollar, corrupting the next optimization cycle, and hiding inside an undifferentiated total. How the vendors compare covers the tooling category itself.