Ad Fraud Detection Tools and Companies Compared: How IVT Detection Works and Who Is Accredited

The MRC is the US industry body that audits and accredits media measurement. Its invalid traffic standards are the reference that buyers, sellers and vendors share. The June 2020 update sets out two classes and a list of examples for each (MRC IVT standards addendum, June 2020).

General invalid traffic (GIVT) is traffic you can catch with routine filters, such as lists and standard checks on each request. The MRC's examples include known data-center traffic, declared bots, spiders and crawlers, and sessions that cannot display images. A search engine crawler that loads a page full of ads is a typical case. Nobody is cheating, but nobody should pay for those impressions either.

Sophisticated invalid traffic (SIVT) is harder. In the MRC's words, it needs advanced analytics, cross-checking of many signals or significant human review to find (MRC, June 2020). The examples read like a catalogue of ad fraud. They include emulators and automation tools, hijacked devices, paid click farms, and forced clicks and redirects. They also include faked impressions or viewability events, misrepresented domains and apps, hidden or stacked ads, and proxy traffic built to mislead.

The split matters when you read a vendor's claims. Filtering GIVT is the minimum for any accredited measurement. SIVT accreditation is a separate, harder audit, granted per metric and per environment. When a vendor says it is "MRC accredited", ask three things: for which metric, for which class of IVT, and on which screens.

Most schemes fall into a handful of patterns. This table maps each one to the MRC class it belongs to and to the check that usually catches it.

A bot is software that pretends to be a person. Simple bots run from data centres and are easy to filter. The harder kind runs on real home devices, so its traffic comes from a real home address. In June 2025 the FBI warned about BADBOX 2.0, a botnet of millions of infected devices such as TV streaming boxes, digital projectors and picture frames (FBI public service announcement, 5 June 2025). The FBI said criminals sell access to the compromised home networks as residential proxies. HUMAN Security was one of the companies credited for contributing to the warning.

Spoofing is lying about where an ad will run. A seller labels cheap inventory as a famous news site or a top-ranked app, and buyers pay premium prices for it. The defence is a public record of who may sell each site's inventory, which is the job of ads.txt and sellers.json. We cover how those checks work in the detection section below.

Here the ad is real but no one can see it. Several ads are piled on top of each other in one slot, or an ad is squeezed into a single pixel. Each one still records an impression. The MRC lists stacked, covered, transparent and invisible ad serving among SIVT examples (MRC, June 2020). Measurement tags that check the ad's position and size on screen catch most of it.

Connected TV (CTV) is a natural target because prices are high and the device is hard to inspect. Many streaming apps use server-side ad insertion (SSAI): a server stitches the ad into the video stream, so the ad request comes from that server rather than from the TV. A fraudster can run servers that pretend to be SSAI servers for thousands of TVs that do not exist.

DoubleVerify's CycloneBot report is the clearest public example. DoubleVerify said the scheme could produce up to 250 million falsified ad requests and spoof about 1.5 million devices a day. It put the cost to unprotected advertisers at up to $7.5 million a month (company claims) (DoubleVerify, 28 February 2024). DoubleVerify confirmed the spoofing with Roku's Advertising Watermark, a Roku technology aimed at device and app spoofing. Roku said it was not affected. The two companies had already worked together against an earlier scheme, SmokeScreen (DoubleVerify, 13 July 2023).

The MRC responded with its 2024 interim update, which added requirements for SIVT vendors on domain and inventory mismatch and bundle ID spoofing in CTV (MRC, 24 April 2024). A bundle ID is the identifier of a CTV app. When the bundle ID in a bid request does not match the app that actually plays the ad, something in the chain is lying. Our engineering page on SSAI and CTV ad serving explains the headers that SSAI servers should pass on.

A made-for-advertising (MFA) site is built to resell cheap traffic at a profit, with many ads per page and little original content. The readers are usually real, so MFA is not IVT by the MRC's definition. It is still waste for most brands. In its July 2026 Media Quality Report, IAS said mobile web display carried 45.1% of the impressions it measured but 71.9% of MFA impressions (company data) (IAS, 9 July 2026). Our guide to made-for-advertising sites covers how exchanges detect them.

IVT detection happens at three points: before the bid, after the ad is served, and in the public records that say who may sell what. Good protection uses all three, because each catches what the others miss.

Pre-bid tools run inside the buyer's demand-side platform (DSP) or the seller's supply-side platform (SSP). They score each impression before anyone bids and skip the ones that look invalid. This is the cheapest protection because you never pay for the bad impression. DoubleVerify's annual report shows how central DSPs are: two programmatic partner platforms collected about 24% and 12% of its 2025 revenue on behalf of advertisers (DoubleVerify 10-K, FY2025).

The MRC accredits pre-bid IVT detection as its own category. On 9 November 2026 it listed DoubleVerify and HUMAN for desktop, mobile web, in-app and CTV. It listed IAS for desktop, mobile web and in-app, limited to segments based on internet (IP) addresses and browser user agents, plus a fraud IP list (MRC accredited digital services). Pixalate's pre-bid data feeds and fraud application programming interface (API) were under audit (MRC services under review).

Post-bid tools run with the ad itself, through a measurement tag or a server-to-server feed. They see what actually happened: where the ad loaded, whether it was visible, how the device behaved. That makes them better at catching hidden ads, faked events and new bot patterns. They can block the creative from rendering on a flagged page and produce the reports that refunds and makegoods depend on. Speed of updates matters here. DoubleVerify says it pushes new fraud signatures to its serving systems and partners nearly 100 times a day (company claim) (DoubleVerify 10-K, FY2025).

The IAB Tech Lab, the standards arm of the Interactive Advertising Bureau, built three public records against spoofing. Each one answers a different question.

1. ads.txt lets a publisher list, in a text file on its own domain, every company authorised to sell its ad space. The IAB Tech Lab launched it on 17 May 2017 (IAB Tech Lab, 17 May 2017). app-ads.txt does the same for apps and CTV apps.
2. sellers.json lets each SSP or exchange publish who its sellers are, and the SupplyChain object lists every company that touched a bid request. Both were finalised on 31 July 2019 (IAB Tech Lab, accessed 9 November 2026).
3. ads.cert adds cryptographic signatures, so a receiver can confirm which company sent a server-to-server request. Version 2.0, called Authenticated Connections, is ready for adoption (IAB Tech Lab, accessed 9 November 2026).

Here is a worked check. A bid request says it comes from a news site through an SSP with seller ID 1234. You open the site's ads.txt and look for that SSP and that ID. Then you open the SSP's sellers.json and confirm that ID 1234 belongs to the news site's owner. If either record is missing or names someone else, the request is suspect. Our free ads.txt and sellers.json validator runs these lookups, and our engineering page on the SupplyChain object, ads.txt and sellers.json shows the fields.

These records stop lies about who is selling. They do not stop a bot from visiting a real, authorised site. That is why supply-chain checks sit next to pre-bid and post-bid detection rather than replacing them.

MRC accreditation means an independent auditor checked the vendor's methods, controls and disclosures against the MRC's standards. It is granted per metric and per environment: desktop, mobile web, mobile in-app and CTV. Vendors renew it each year through audits (DoubleVerify 10-K, FY2025).

It does not mean the vendor catches all fraud, or that two accredited vendors will report the same IVT rate. Methods differ, and so does coverage. Adloox's SIVT accreditation covers desktop and mobile web; Pixalate's and Protected Media's also cover in-app and CTV (MRC accredited digital services). Always read the scope notes in the accreditation letter.

The big platforms hold accreditation for their own numbers too. The MRC lists SIVT accreditation for Google Ads, Google DV360, Google Campaign Manager 360, Meta's Facebook and Instagram ads, Microsoft Advertising and Amazon Ads Sponsored Products (MRC accredited digital services). That covers the platform's own reporting. Many buyers still add an independent vendor so that one company is not grading its own homework.

Two other credentials appear in vendor pitches. The Trustworthy Accountability Group (TAG) runs a Certified Against Fraud programme; DoubleVerify says it has held the seal every year since the programme began in 2016 (DoubleVerify, accessed 9 November 2026). In Japan, the Japan Joint Industry Committee for Digital Advertising Quality (JICDAQ) certifies against fraud, and DoubleVerify and Spider AF both display it.

The table covers 11 companies whose main products detect invalid traffic or click fraud. Six hold MRC accreditation for sophisticated IVT. Five sell to performance marketers or platforms and do not appear on the MRC list. Every cell comes from the company's own pages, its filings or the MRC's accredited services list, as checked on 9 November 2026. "Not listed" means the company did not appear on the MRC's accredited digital list that day.

Three things stand out. First, the accredited group is small: six third-party names, most of them accredited for all four screen types. Second, accreditation scope differs more than marketing suggests, especially for pre-bid and CTV. Third, the click-fraud tools solve a different problem. They protect search, social and lead-generation budgets from fake clicks and form fills, where the advertiser owns the landing page and can inspect each visit directly.

The right tool depends on where you spend and what you control:

• A brand buying programmatic display, video and CTV needs an accredited verification vendor with pre-bid filters in its DSP and post-bid measurement with CTV coverage. Check the accreditation letter for each screen you buy.
• A performance marketer on search and social gets more from a click-fraud tool that watches the landing page, blocks bad sources and feeds exclusions back to the ad platforms.
• A publisher or SSP screens supply before it reaches buyers, using pre-bid IVT scoring and IP reputation, so that buyers do not discount or refuse its inventory.
• A retail media network needs IVT filtering inside its own measurement. Walmart Connect's onsite display audit, in process at the MRC, includes SIVT filtering performed by HUMAN (MRC services under review).

Whatever you choose, keep your own records. Log-level data from your DSP or SSP lets you check a vendor's IVT rate against your own view of the same impressions. Our guide to log-level data explains what to request.

Use these eight steps as a starting point for a programmatic buy. Each one closes a gap that the others leave open.

1. Buy only from authorised sellers. Reject impressions whose seller is not in the publisher's ads.txt or app-ads.txt.
2. Require a complete SupplyChain object. Check each node against sellers.json and prefer the shortest paths.
3. Turn on pre-bid IVT filtering in your DSP, with a vendor accredited for the screens you buy.
4. Measure post-bid with an independent vendor and compare its IVT rate with your platform's own figure.
5. Write refunds into contracts. Agree in advance how SIVT that is found after delivery will be credited.
6. In CTV, ask how devices are verified. Look for device signals such as watermarks, consistent bundle IDs and SSAI headers that are passed on intact.
7. Treat MFA separately from fraud. Use inclusion lists or curated deals to avoid cluttered sites that pass IVT checks.
8. Review the numbers monthly. Track IVT rate by seller, app and supply path, and cut paths that stay above your threshold.

Fraud is one part of the gap between what you pay and what reaches real people. Our working media benchmark puts it next to fees and other losses, and the RTB architecture hub collects the rest of the plumbing.

1. Media Rating Council, "Invalid Traffic Detection and Filtration Standards Addendum, Update (Final)" (June 2020). https://mediaratingcouncil.org/sites/default/files/Standards/IVT%20Addendum%20Update%20062520.pdf
2. Media Rating Council, "2024 IVT Interim Updates" memo (originally authored January 2024, published final 24 April 2024). https://mediaratingcouncil.org/sites/default/files/Standards/2024_IVT_Interim_Updates_FINAL.pdf
3. Media Rating Council, accredited digital services (accessed 9 November 2026). https://mediaratingcouncil.org/accreditation/digital
4. Media Rating Council, digital services under review (accessed 9 November 2026). https://mediaratingcouncil.org/accreditation/services-under-review/digital
5. DoubleVerify Holdings, Inc., Form 10-K for fiscal year 2025 (filed 26 February 2026). https://www.sec.gov/Archives/edgar/data/1819928/000110465926020499/dv-20251231x10k.htm
6. DoubleVerify, "DV Fraud Verification" product page (accessed 9 November 2026). https://doubleverify.com/products/advertisers/verify/fraud
7. DoubleVerify, "DoubleVerify Unmasks CTV Ad Fraud Scheme CycloneBot" (28 February 2024). https://doubleverify.com/newsroom/doubleverify-unmasks-ctv-ad-fraud-scheme-cyclonebot/
8. DoubleVerify, "After Stopping SmokeScreen, DoubleVerify and Roku to Continue Joint Investigations into Ad Fraud Schemes in Streaming" (13 July 2023). https://doubleverify.com/newsroom/after-stopping-smokescreen-doubleverify-and-roku-to-continue-joint-investigations-into-ad-fraud-schemes-in-streaming/
9. DoubleVerify, "DoubleVerify Strengthens PepsiCo Philippines' Brand Suitability on TikTok with Pre-Bid Controls" (12 August 2026). https://doubleverify.com/company/newsroom/doubleverify-strengthens-pepsico-philippines-brand-suitability-on-tiktok-with-pre-bid-controls
10. Integral Ad Science, "IAS to be Acquired by Novacap for $1.9 Billion" (24 September 2025). https://integralads.com/news/ias-to-be-acquired-by-novacap-for-1-9-billion-to-further-support-its-strategic-goals/