This is Investigation Wednesday. Once a week, ADOTAT takes one number this business repeats until it sounds like physics and checks whether anyone ever measured it. We put the questions in writing to the companies involved, we print their answers, and we print it when they don't answer. The top of the piece is free and built to be forwarded. The deeper reporting sits behind a free email signup. The receipts, the contract language and the questions to take into your next vendor meeting are for ADOTAT+ members. We run ads. We don't sell editorial. Nobody pays to get into these pieces, and nobody pays to stay out. This week: the fraud rate your DSP quotes you, and the one it doesn't.

Every programmatic buyer has heard the number. Ask your DSP how much of your traffic is fraud and the answer comes back clean, small and reassuring: one to three percent. Filtered. Handled. Nothing to see here, go optimize your ROAS.

It is a wonderful number. It fits on a slide. It lets a CMO sleep. It lets the agency keep the line item. It lets the DSP keep the take rate.

It also, according to the company that has spent nine years scanning that traffic on the other end of the click, measures almost nothing about the traffic you are actually paying for.

Anura, the fraud detection firm run by Rich Kahn, says that across the DSP traffic it has scanned for clients, roughly half of the visitors are bots, malware or human fraud. Not 1 percent. Not 3. Fifty. And the individual scans run from about 40 percent at the low end to more than 90 percent at the top, the high mark coming from a recent scan for a major university whose agency was buying through one of the largest DSPs in the market.

"Across our scans, the large platforms still sit at roughly 50% and growing fraud on the traffic we test, despite having real detection infrastructure and real budgets behind it."

That is Kahn, on the record, approved as written.

Before anyone at a DSP drafts the angry LinkedIn post, the honest version of this story is more interesting than "the DSPs are lying." They are not reporting the same thing. The 1 to 3 percent and the 50 percent are not two estimates of one number that disagree. They are answers to two different questions, asked at two different moments, by two different machines, one of which has to answer before you can blink.

The problem is that the buyer only ever hears the first answer.

Start with where the small number comes from, because it matters more than the number itself.

"The 1-3% figure is what DSPs themselves tell clients when asked about fraud, it's their own stated GIVT catch rate, not a number Anura has measured or verified."

Read that slowly. Self-reported. GIVT. Not verified.

The industry splits invalid traffic into two buckets. GIVT, general invalid traffic, is the easy stuff: known data center IP addresses, declared crawlers, user agents that announce themselves as robots, the traffic equivalent of a burglar wearing a striped shirt and carrying a sack labeled loot. SIVT, sophisticated invalid traffic, is everything engineered not to look like that: hijacked devices, residential proxies, bots that scroll and hesitate and move a mouse like a bored human at 2 p.m.

When a DSP tells you its fraud rate is 1 to 3 percent, it is telling you what its fast filter threw out before the bid. That is a real number. It is just a number about the striped shirts.

Kahn put the gap in one sentence that should be printed on every insertion order in the business:

"The gap isn't a discrepancy, it's the difference between what a 20-millisecond IP check (GIVT filter) can see and what 800 data points (SIVT filter) at the landing page can see."

Twenty milliseconds. That is the budget. Real-time bidding has to clear in roughly a tenth of a second, and a pre-bid filter typically has to answer in a fraction of that. In that window, Kahn says, a filter is realistically checking the IP address and the user agent, maybe one or two other signals. It is a bouncer glancing at an ID in a dark doorway while a line of ten thousand people pushes forward.

Anura's number comes from the other end of the transaction. Its detection runs post-click, at the landing page, across more than 800 data points, and it takes longer because it can. It is the same visitor, examined after the ad has done its job, by something that has time to look.

So here is the structure of the thing, laid out plainly:

What the buyer hears: 1 to 3 percent, self-reported by the DSP, from a GIVT filter that answers in about 20 milliseconds, measured before the buy.

What Anura measures: roughly 50 percent, from its own SIVT scans, more than 800 data points, at the landing page, after the click.

What nobody tells the buyer: that these two numbers were never measuring the same thing.

The most damning part of this is not the 50 percent. It is the reason the 50 percent surprises people.

Kahn says almost none of the advertisers who come to Anura are running any post-impression SIVT measurement when they arrive. They show up because something smells wrong. A CMO read an article, heard a podcast, looked at a dashboard full of beautiful KPIs and a business that is not growing, and asked for a gut check.

And until that moment, they had no reason to look. Their DSP had told them fraud was a 1 to 3 percent problem, and that the 1 to 3 percent was already filtered out before the buy. From the buyer's chair, the problem had been solved upstream by people whose job it was to solve it.

That is the trap. A small number reported before the purchase reads like a warranty. It is not one. It is a description of what one fast gate caught, and it says nothing about what walked through.

Kahn's other line on this, from his first note on the subject in July, is the one that should keep performance marketers awake: fraudsters are now faking the very KPIs brands use to optimize their campaigns. In his words, brands end up making good decisions based on bad data, and getting bad results.

Think about what that does to an optimization engine. The algorithm does exactly what it was built to do. It finds the inventory that converts, the audiences that click, the placements that complete. It shifts money toward them. If the conversions are manufactured, the machine is not failing. It is succeeding at the wrong job, very efficiently, with your budget.

If you want to dismiss the 50 percent as a fraud vendor talking its book, and that is a fair instinct, the Media Rating Council is the one body in this business that has no book to talk.

The MRC was asked directly whether the 1 percent figure that floats around the industry means anything. Its answer, which the MRC allowed ADOTAT to attribute to it, does not land where the comfortable number would like it to.

The MRC said it assumes the 1 percent "might refer to ANA/TAG studies or perhaps some sort of tolerance level," and then said this:

"We often see filtration rates in audits well above 1% depending on these factors."

The factors are the whole story. According to the MRC, invalid traffic levels across hundreds of audits vary by:

The metric. Clicks typically show higher filtration than impressions, because of competitive click fraud and other pressures.

The property. Retail media networks can run higher because of scraping and crawling for pricing and inventory checks. Fraudulent domains and made-for-advertising sites run high. Long-tail CTV may run higher.

The locale of the user or site.

The filtration type, GIVT versus SIVT.

And then the MRC said the part that every aggregate fraud statistic in this business should have tattooed on its forehead:

"It's also not good to size a problem in aggregate, especially if it involves a curated list of properties and advertisers that may have and use 3P IVT measurement."

Translation for the slide deck: a single industry-wide fraud number is mostly a description of who was in the sample. Measure only premium properties with advertisers already running third-party verification, and you will get a small number. Congratulations. You measured the people who were already careful.

The MRC's recommendation instead is campaign-level and property-level reporting with impression-level granularity, reviewed and analyzed. Not a percentage on a quarterly slide. Your campaign. Your properties. Your impressions.

The MRC and Anura are not saying the same thing. The MRC does not endorse Anura's 50 percent, and Anura's figure is not an MRC audit result. But on the one question that matters for buyers, whether 1 percent is a safe assumption about your traffic, the accreditation body and the fraud vendor are standing on the same side of the room.

Everything below this line is for subscribers. Sign up free with your email to keep reading: how pre-bid fraud protection actually works, who in the chain is allowed to ignore it, and why the biggest DSPs and the smallest ones are exposed in completely different ways.