The industry benchmarks for invalid traffic (IVT) run somewhere between 2% and 4% of programmatic impressions, depending on the source. Those averages are cited constantly, and they've become a kind of collective shrug — everybody knows there's fraud, nobody's particularly alarmed by 2–3%, and the platforms report their own quality metrics with a confidence that the numbers don't always deserve.
What those averages don't tell you is what's happening in your campaign, in your specific line items, on specific days. We recently completed a detailed traffic quality audit of a single monthly campaign flight for a large national advertiser running over $20 million in programmatic spend per month. What we found was a six-figure fraud cost — and four detection signals that standard platform reporting didn't surface.
The most important context for those numbers: the estimated fraud cost in this single campaign month is comparable to what most enterprise advertisers budget for a full year of independent attribution measurement. The measurement program that found the problem costs less than the problem it found.
Why Platform-Reported Fraud Metrics Have a Structural Problem
Programmatic buying platforms report fraud metrics against the inventory they sell. That creates an obvious tension: the entity being asked to report on the quality of its own inventory has a financial interest in the answer. This isn't a conspiracy — it's just a structural conflict that sophisticated advertisers should account for. Platforms do invest significantly in fraud detection. They also have settlement exposure, make-good obligations, and certification relationships that create pressure on how they characterize invalid traffic.
Independent traffic quality analysis works from the raw delivery data — impression logs, beacon fires, conversion records — rather than from platform-reported summaries. The gap between what platforms report and what independent analysis finds is where the interesting numbers live.
Signal 1: The Timing Pattern in Impression Spikes
The first and most visible anomaly was a five-day surge in impression volume during which daily delivery ran 20–30% above the campaign baseline established in the preceding 12 days. Volume spikes happen — budget pacing, auction dynamics, and seasonality all produce them. What made this one notable was the timing pattern: the surge was concentrated in late-evening and overnight hours, producing approximately 37.5 million incremental impression calls above expected levels, with a peak single-hour volume of more than double the campaign average.
Overnight concentration alone isn't proof of fraud — some categories have genuine late-night engagement. But when overnight surges appear simultaneously across two separate programmatic buying platforms, using the same buying parameters, the likelihood of a legitimate audience explanation drops significantly. Coordinated behavior across independent platforms during anomalous hours is a strong indicator of supply-side manipulation rather than demand-side audience behavior.
The fraud rate within these spike windows ran measurably above daytime norms — elevated across the board, but not dramatically so in isolation. Which leads to the next signal.
Signal 2: The Viewthrough Beacon Test
This is the most technically distinctive finding in the analysis, and the one least likely to appear in platform-reported metrics.
A viewthrough (VT) beacon is a tracking pixel that fires when a served ad is viewed. Under legitimate delivery, the ratio of VT beacon fires to logged impressions should not exceed 1.0 — one beacon per impression, at most. There is no legitimate mechanism by which a single impression can produce more than one beacon fire.
A cross-check of VT beacon counts against logged impressions across the high-volume display line items in this campaign found five line items with beacon-to-impression ratios well above 1.0. The highest recorded ratio was 1.81 — meaning for every logged impression, nearly two beacon fires were recorded. The pattern across all five is consistent with pixel stuffing or hidden ad stacking, where a tracking beacon fires in a non-viewable context without a genuine ad delivery.
The confirming detail: all five flagged line items recorded zero clicks across a combined 14.8 million impressions on the most anomalous delivery day. A genuine high-volume audience placement generates some click activity, however low the CTR. Zero clicks at scale is not a normal outcome.
Signal 3: Peer Volume Comparison as an Anomaly Detector
One of the challenges with absolute fraud thresholds is that they don't account for legitimate variation across line items. A single-line-item volume that looks high in the abstract may be entirely normal for that format, audience, and placement context.
The more precise method is peer comparison: look at line items using the same format, the same buying platform, and the same audience parameters, and flag outliers within that peer group. This analysis identified a single video placement that delivered 21 times the average impression volume of its peer line items on the most anomalous delivery day — using identical format, platform, and audience targeting. Its viewthrough beacon count also exceeded its impression count, consistent with the display findings above.
An additional complication: this line item was untagged in the campaign attribution system during part of the delivery period. That means conversions attributed to viewthrough from this placement cannot be validated for that window. The fraud concern and the attribution gap compound each other.
Signal 4: Fraud Cost Is CPM × Rate — Not Rate Alone
This is the counterintuitive finding that has the most practical implications for how advertisers should prioritize fraud remediation.
The impression spike windows are the most visually dramatic part of the delivery data — a sharp five-day surge clearly visible against baseline. Intuitively, these days feel like the fraud problem. But when you calculate actual fraud cost — rate multiplied by CPM, multiplied by impressions — the most expensive fraud days in the month were not the spike days. The spike windows happened to coincide with below-average CPMs. Two quiet-volume days earlier in the month, with fraud rates in the 3–4.5% range at significantly higher CPMs, generated nearly as much fraud cost as the entire five-day spike cluster combined.
The practical implication: fraud remediation efforts that focus on impression volume anomalies without accounting for CPM are mis-prioritizing. The cleanup discussion with DSP partners should be anchored to dollar cost, not impression count. The two are not the same, and the difference matters when quantifying make-good claims.
A Fifth Pattern Worth Noting: Channel Concentration as a Source Classifier
Late in the campaign flight, a single-hour fraud event occurred with a rate nearly triple the surrounding hours — the highest single-hour rate in the dataset. Total impression volume in that hour was not unusual. What was unusual: 99.7% of the fraudulent impressions came from image (IMG) calls, with near-zero JavaScript fraud.
That near-complete concentration in a single channel type is diagnostically useful. When fraud is systemic — bots navigating normally across inventory — the JS/IMG split tends to reflect normal delivery ratios. When fraud is concentrated in IMG at 99.7%, it points to a targeted event on a specific inventory source: a pixel-stuffing or hidden ad stacking incident on a particular IMG placement, not a broad quality issue. This distinction matters for remediation — it means the problem has a specific address, and the investigation can start there rather than at the campaign level.
The estimated fraud cost identified in this single campaign month — across impression inflation, beacon anomalies, and CPM-weighted rate analysis — was six figures. That figure is not an industry average applied to a budget. It is a measured, line-item-level estimate based on actual delivery data and actual CPMs.
For context: that figure is comparable to what most enterprise advertisers budget for a full year of independent attribution measurement. The measurement program that found the problem costs less than the problem it found. When advertisers ask about the ROI of independent measurement, this is one answer to that question — and it doesn't include the attribution distortion created by viewthrough inflation and untagged placements, which is a separate cost category entirely.
What This Requires to Replicate
None of the four signals described here require proprietary technology that isn't available to any advertiser running a serious measurement program. What they require is access to raw delivery data — impression logs, beacon fire records, conversion data — rather than platform-reported summaries. And they require someone looking for these patterns systematically, rather than accepting the aggregate quality metrics that platforms surface by default.
The beacon ratio test, the peer volume comparison, and the CPM-weighted fraud cost calculation are all executable with delivery data that advertisers are entitled to request from their DSP partners. The question is whether anyone is running these checks, and whether the measurement infrastructure exists to catch the patterns when they appear.
Advertisers spending at scale in programmatic should be running traffic quality audits as a standard practice, not a post-anomaly investigation. The cost of doing so is modest. The cost of not doing so, as this analysis illustrates, is not.