Home Antifraud

Antifraud

By Azema

• 7 articles

Introduction to Anti-Fraud

Fraud prevention is a cornerstone of effective performance marketing. UCLIQ's anti-fraud module is designed to protect your business from malicious activities, ensuring accurate attribution and maintaining trust with your partners. Below, we break down the anti-fraud capabilities of UCLIQ into key sections to help you navigate its features effectively. The UCLIQ anti-fraud module combines real-time analysis, detection, and prevention tools to safeguard your platform from fraudulent activities. By leveraging a bespoke pattern-matching risk scoring engine, it provides reliable detection of anomalies in traffic, clicks, and conversions. Key capabilities include: - Conversion Scoring: Assigns risk scores to each conversion based on multiple parameters. - Cloaking and Bot Handling: Detects and prevents unwanted traffic from bots and cloaking attempts. - Real-Time Click-Anti-Fraud Rules: Flags suspicious clicks in real-time to minimize exposure.

Last updated on Jan 31, 2025

How Anti-Fraud Systems Work in UCLIQ

Advanced Analysis and Prevention For an anti-fraud system to function effectively, it must thoroughly analyze incoming traffic. This involves several methods, ranging from basic checks (like IP address verification) to more advanced techniques that examine device parameters, big data, and machine learning to detect suspicious activities. UCLIQ’s anti-fraud system is fully integrated, providing real-time analysis of incoming traffic. This system compares current traffic patterns against historical data and assigns risk levels based on a variety of factors. Unlike external plugins, UCLIQ’s integrated system has access to a vast database of historical traffic data, making it more effective at detecting fraud. Common Fraud Detection Techniques 1. VPN and Bot Detection: Identifying traffic coming from corporate networks, VPNs, or automated bots. 2. Mismatch Detection: Spotting mismatches in connection type, device, language, time zone, or operating system (e.g., emulators). 3. Repeated Use of IPs: Flagging repeated attempts from the same IP address. 4. Motivated Traffic Sources: Identifying traffic generated from social networks, instant messengers, or other suspicious sources. 5. Touch Support Discrepancies: Detecting discrepancies between the stated machine parameters and actual touch support, typically seen in emulators.

Last updated on Jan 31, 2025

How UCLIQ Assigns Risk Points

Every incoming click is analyzed using the fraud detection system’s templates. When certain characteristics match known fraud indicators, the click is assigned a risk score. These characteristics can include things like IP address matches, device fingerprinting, and behavior that suggests fraudulent activity (e.g., VPN usage or emulation). The system assigns risk points based on how many of these indicators match. The more matches a click has with fraud patterns, the higher the risk score assigned to it. Publishers also accumulate risk points, which help determine the overall risk level of their traffic.

Last updated on Jan 31, 2025

Fraud Detection Levels in UCLIQ

UCLIQ provides multiple levels of fraud detection to help manage suspicious traffic and conversions. Each level has its own purpose and ensures that fraud is tackled at every stage of the process. 1. Click-Level Detection At the click level, if traffic triggers certain fraud indicators or accumulates a certain number of risk points, it can be redirected to a fallback address. This prevents fraudulent traffic from reaching advertisers or being processed further. 2. Conversion-Level Detection At the conversion level, the system can stop payouts for conversions where the associated clicks have exceeded the risk point threshold. These conversions are flagged for manual review by the advertiser or network manager before any payouts are made to the publisher. 3. Payment-Level Detection Before finalizing payments to publishers, UCLIQ allows you to generate payment cancellations (or declines) if the system detects that a conversion is highly likely to be fraudulent. This step helps prevent publishers from receiving payouts for conversions that have a high likelihood of being non-reimbursed by the advertiser.

Last updated on Jan 31, 2025

How Publisher Risk Scoring Works

Accessing Publisher Risk Scoring Publisher risk scoring is available in the Antifraud > Risk Scoring section of the platform. This tool allows you to analyze the risk profiles of publishers and assess whether their traffic is legitimate or potentially fraudulent. Go to Antifraud > Average Risk Score to open the publisher risk scoring panel, where you can view detailed information about each publisher’s traffic. Key Data Fields in Publisher Risk Scoring The Risk Scoring panel provides several data points for each publisher. These fields help you evaluate the quality of traffic and the likelihood of fraud. Here's a breakdown of the key data fields: Publisher: Displays the username of the publisher whose traffic is being analyzed. Count: The total number of conversions generated by the publisher. Triggered: The percentage of times fraud patterns were triggered based on the publisher's traffic. Avg: The average risk score per conversion. This value shows the overall quality of the publisher's traffic. Several fraud indicators are used to calculate the publisher's risk score: OS Mismatch: Indicates an operating system mismatch, which could suggest the use of an emulator. Connection Type Mismatch: A mismatch between the expected connection type and the actual type, which may be indicative of fraud. Language Mismatch: A difference between the browser language and the user's IP location, suggesting potential fraud. Autonomous System Mismatch: This could point to traffic coming from a bot or a data center. Same IP: Multiple conversions from the same IP could indicate click farms or repeated fraudulent activity. Duplicate Fingerprint: The same device fingerprint being used for multiple conversions raises concerns about fraud. Touch Support: If a device shows unexpected touch support, it may be an emulator. Motivated Traffic: Traffic driven by incentive-based or motivated sources, often fraudulent. Timezone Mismatch: A discrepancy between the time zone of the device and the IP location could suggest fraudulent traffic. Windows Conversions: Use of WinSock (a networking tool often used by bots) could indicate fraud. Analyzing Publisher Traffic Quality By analyzing the data from the risk scoring panel, you can evaluate whether a publisher's traffic is legitimate or if it is possibly fraudulent. Key indicators such as Triggered fraud patterns and the Avg risk score give you a clear picture of the quality of a publisher’s traffic. You can also assess the traffic quality by country using filters. This allows you to pinpoint traffic from regions that may have a higher likelihood of being fraudulent, helping you take informed actions. Taking Action Based on Risk Scoring Data Once you've analyzed the publisher risk profile, you can take appropriate action based on the risk level: Blocking Publishers If a publisher consistently triggers fraud patterns and has a high average risk score, you may decide to block them from working with certain offers or from the platform entirely. This is done by reviewing their risk score and identifying any recurring fraud indicators. Blocking Sub-Sources For affiliate publishers, you may choose to block specific sub-sources that are generating poor-quality traffic or triggering frequent fraud patterns. This helps maintain the integrity of your campaigns without needing to block the entire publisher. Conversion Retention Mode If a publisher's traffic shows signs of potential fraud, you can enable Conversion Retention Mode, which temporarily holds conversions for review before they are processed. This helps prevent fraudulent conversions from being paid out.

Last updated on Jan 31, 2025

How to Interpret Risk Scores and Indicators

The key to managing fraud is knowing how to interpret the data provided in the Risk Scoring panel: - High Risk Scores: If a publisher has a high Avg score and triggers several fraud patterns, this indicates potentially fraudulent traffic. Consider blocking these publishers or their sub-sources. - Low Risk Scores: Publishers with low risk scores and no major fraud indicators can be trusted to provide legitimate traffic. - Frequent Fraud Pattern Matches: Patterns such as duplicate fingerprints, OS mismatches, or repeated IPs may indicate systematic fraud that needs to be addressed immediately.

Last updated on Jan 31, 2025

How UCLIQ Assigns Risk Points

How UCLIQ Assigns Risk Points Every incoming click is analyzed using the fraud detection system’s templates. When certain characteristics match known fraud indicators, the click is assigned a risk score. These characteristics can include things like IP address matches, device fingerprinting, and behavior that suggests fraudulent activity (e.g., VPN usage or emulation). The system assigns risk points based on how many of these indicators match. The more matches a click has with fraud patterns, the higher the risk score assigned to it. Publishers also accumulate risk points, which help determine the overall risk level of their traffic. Screenshot Suggestion: Show a risk scoring interface, where clicks are assigned points based on fraud detection criteria, with visual indicators of high-risk traffic.

Last updated on Jan 31, 2025