Two reports published this summer disagree about fake ad traffic by a factor of more than forty, and both of them are right.
The short answer: the gap is in what each report counts, not in how much fraud exists. Pixalate's 25% for US desktop and mobile web counts all invalid traffic, general and sophisticated, in programmatic ads. DoubleVerify's 0.6% for North America counts only the fraud and sophisticated slice, in the campaigns it monitored through 2025. Treat every invalid traffic figure as one reading from one instrument, and ask four things before it moves a budget: which tier does it count, which sample, which time window, and who pays when the traffic is found.
- 25% invalid, US desktop and mobile web, Q2 2026 (Pixalate)
- 0.6% fraud and sophisticated invalid, North America, 2025 (DoubleVerify)
- 60 days to ask Google Ads to investigate invalid traffic
Why do two reports on fake traffic differ by more than 40 times?
Because they measure different things on different traffic. Each card below shows one reading, what it counts, the sample it was taken from and the period it covers.
-
25%
Pixalate, US desktop and mobile web
- Counts
- Invalid traffic including ad fraud, the general and sophisticated tiers together.
- Sample
- Over 80 billion programmatic impressions worldwide, mostly buy-side open-auction sources.
- Period
- Q2 2026 benchmark, published August 12, 2026. The same report gives 39% for US mobile apps and 25% for US connected TV; globally 20% for web, 41% for apps, 26% for connected TV.
-
0.6%
DoubleVerify, North America
- Counts
- The fraud and sophisticated invalid traffic violation rate only, not the general tier.
- Sample
- Campaigns DoubleVerify monitored. Unprotected campaigns ran 2.8% worldwide against 0.6% for protected ones.
- Period
- Campaigns monitored through 2025, reported in July 2026. The rate fell 41% on 2024, and it is still the highest of any region DoubleVerify tracks.
-
75.6%
Lunio survey of marketers
- Counts
- Marketers who estimated losing more than 5% of their monthly performance budget to invalid traffic.
- Sample
- Survey respondents. An opinion poll, not a measurement of traffic.
- Period
- State of Click Fraud report, July 2026. Only 5.3% of those surveyed used a dedicated prevention platform.
Even DoubleVerify's unprotected figure of 2.8% is about nine times under Pixalate's 25%, so protection alone cannot explain the gap. The tier counted and the traffic sampled have to carry much of it. Neither report says how much each factor explains, so do not average them. Read each as an answer to its own question, and use the one that matches the traffic you buy.
What is general invalid traffic, and who has to filter it?
The Media Rating Council (MRC) sets the standard for invalid traffic detection. It defines general invalid traffic (GIVT) as traffic "identified through routine means of filtration executed through application of lists or with other standardized parameter checks", and the full text sits in the MRC addendum. Think of it as the coarse screen at the plant's intake: it takes out what is large and known.
Coarse screen: GIVT
- How it is caught
- Lists and standard parameter checks.
- What it catches
- Known data-center traffic, bots and crawlers, several clicks by one user within seconds, non-browser user agents, pre-rendered pages, invalid 1x1 placements, devices that cannot render an ad.
- MRC position
- Detection and filtration is required for accreditation.
- What you do
- Ask the seller for gross and net delivery, and bill on net.
Fine filter: SIVT
- How it is caught
- Advanced analytics, multi-point corroboration, human review.
- What it catches
- Bots posing as real users, hijacked devices, click farms, invalid proxy traffic, automated browsing from a dedicated device.
- MRC position
- Strongly encouraged; buyers are encouraged to add outside coverage when a measurer checks only GIVT.
- What you do
- Ask which tier each vendor's accreditation covers.
General invalid traffic is not always malicious. Lunio notes it often is not: a crawler or a pre-fetching browser has no intent to defraud anyone, but its impressions still do not count as an audience. The same applies to the newest source of it. DoubleVerify reports that AI bots generated 15% of clicks in the unprotected campaigns it studied, and says such activity counts as GIVT and should be stripped from performance metrics before you judge what is working.
On a platform that runs the screen for you, it works before the invoice. Google says invalid traffic found before the end of the billing cycle is removed from billing and from campaign metrics.
What is sophisticated invalid traffic, and why does it need a lab?
The MRC defines sophisticated invalid traffic (SIVT) as "more difficult to detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc." A list cannot catch it, because it is built to look like a person: a bot with a believable browser, a phone taken over without its owner knowing, a room of people paid to click.
Two details matter when you buy. First, the line between the tiers moves. RMIQ summarises the MRC view that some sophisticated techniques will become general once industry bodies turn them into standard lists, so a bot that needs a lab today may be on a list next year. Second, invalid traffic is not always a machine: click farms are SIVT because the activity, though human, has no value to the advertiser.
Accreditation is also narrower than it sounds. Google states that the MRC accredits its invalid traffic defenses for specific services and metrics, not for everything it sells. Before you rely on a "filtered" label, ask which product, which metric and which tier the accreditation covers.
What can you check yourself before a report arrives?
Five checks, in the order that costs least. None of them replaces a verifier, but each one tells you whether to ask for one.
Read the platform's own filter count
In Google Ads, add the "Invalid clicks" column to your campaigns table and open the Invalid traffic card on the Overview page. Google explains that a high count means clicks were caught and removed, not billed.
Compare clicks with conversions, by placement
Amazon Ads says a drop in conversion rate together with unusual rises in click-through rate, impressions or clicks is a higher-confidence sign of undetected invalid traffic, as RMIQ quotes it. Check each placement or product on its own: one bad source disappears inside a blended total.
Keep your own server logs
IP addresses, user agents and the click identifiers attached to each visit. Google asks for exactly these in an investigation, and without them there is nothing to send.
Test the leads, not just the clicks
Google adds that it cannot see what visitors do on your site, so lead quality is shared work: form checks such as reCAPTCHA, server-side validation and a double opt-in email.
Expect two counters to disagree
Filtration differs between systems. RMIQ reports that Amazon expects its invalid traffic rates for DSP campaigns to differ from third-party verifiers' by up to 5%. A small gap is a difference of method, not proof of a cheat.
How long after the ad ran can you still get money back?
Every system keeps looking for a while, and the window is the part you can negotiate. The bars show the two published windows against the one you control.
Amazon figure per RMIQ; Google figure per Google's help page.
Three rules follow from how the money comes back.
- It arrives as a credit. Google credits are billing adjustments on a later invoice, not cash to your card.
- Your reports will not match your invoice. Google freezes campaign metrics at month end, so a credit does not rewrite old data. Use its Invalid Activity Credit Report to see adjusted clicks and cost.
- You will not learn which clicks were judged. Google says an investigation cannot confirm whether specific clicks were marked valid or invalid, to avoid showing bad actors how detection works. Expect a finding and a credit amount, nothing more.
Recent figures can still change, too. Amazon removes invalid events for up to 30 days, so wait before you cut a keyword or a placement on last week's cost data.
What should the insertion order say about invalid traffic?
On a direct buy there is no platform help page to fall back on: the insertion order is the whole rulebook. These seven lines are suggestions to put in front of a seller, not legal advice. Square brackets are numbers you decide; the right values depend on your channel and spend. The insertion order guide covers what else belongs on the form.
- DefinitionInvalid traffic means general and sophisticated invalid traffic as defined in the MRC Invalid Traffic Detection and Filtration Guidelines.
- Billing basisInvoiced on net impressions or clicks, after invalid traffic is removed.
- Seller filterSeller filters known general invalid traffic before billing and reports gross and net delivery.
- Outside checkBuyer may measure with [verifier name]; seller allows its tag on the placement.
- ToleranceGaps between the two counts under [x]% are not disputed; above it, the verifier's count governs.
- Credit windowInvalid traffic found up to [60] days after the last flight day is credited.
- RemedyCredit on the next invoice or a make-good, not only a voucher for future spend.
A tolerance clause matters because two honest counters disagree, as stage 4 showed. Pick the number before the dispute, not during it. Where the buy comes through a platform, ask what its published window is, then write the longer of the two into your own plan.
Three beliefs about invalid traffic that cost buyers money
MythA big "invalid clicks" number in my Google Ads report means I paid for bots.
FactThose are clicks Google filtered before billing. Google states you are not charged for them; later finds appear separately as credits.
MythIf a platform is MRC-accredited, everything on it is clean.
FactAccreditation covers specific services and metrics, and general detection is the part that is required. Sophisticated detection is strongly encouraged, not mandatory.
MythInvalid traffic means fraud.
FactMuch of the general tier is crawlers and pre-fetching, with no intent to defraud. The MRC also says its "fraud" is a custom definition for ad measurement, not a legal one, as Pixalate quotes it.
To weigh what your ads actually caused rather than what was counted, a holdout is the next step; the incrementality testing guide sets one out. For where your ads may appear at all, see the ads.txt and sellers.json guide.
Questions buyers ask about invalid traffic
Is 25% of my ad budget going to bots?
Not necessarily. Pixalate's 25% is the share of impressions in its own sample, mostly buy-side open-auction programmatic traffic, that it classed as invalid. It is not a share of any advertiser's spend, and Pixalate itself calls its reports opinions rather than facts or guarantees. Your own rate depends on where you buy; measure it with the steps in stage 4.
Do I pay for invalid clicks on Google Ads?
Not when Google filters them before the end of the billing cycle: Google says those clicks are removed from billing and reports. If it finds invalid activity after the invoice, it issues a credit as a billing adjustment where appropriate and possible, labelled "Invalid activity". On a direct buy, what you pay is whatever your insertion order says.
What is the difference between GIVT and SIVT in one line?
General invalid traffic is the kind a list or a standard check can catch, such as known data-center traffic and crawlers. Sophisticated invalid traffic is built to slip past those checks and takes analytics, corroboration or human review, such as bots posing as people and click farms.
Do I need a third-party verification tool?
It depends on spend and channel. The MRC standard requires accredited measurers to detect general invalid traffic and strongly encourages sophisticated detection, and buyers are encouraged to add outside coverage when a measurer checks only the general tier, as RMIQ summarises it. Start by asking the seller for gross and net numbers and which tier they cover, then decide whether the gap justifies a tool.
Sources
- Pixalate, Q2 2026 Ad Fraud Benchmarks Report for North America, August 12, 2026
- PPC Land, DoubleVerify: ad fraud drops 41% in North America, 45% in EMEA (coverage of the DoubleVerify 2026 Global Insights report, July 2026, which also summarises the Lunio State of Click Fraud report)
- Google Ads Help, About invalid traffic
- Google Ads Help, Invalid clicks: definition
- Media Rating Council, Invalid Traffic Detection and Filtration Standards Addendum, 2020 update
- Lunio, GIVT vs SIVT: sophisticated vs general invalid traffic explained (quotes the MRC definitions and categories)
- RMIQ, Invalid Traffic (IVT): GIVT, SIVT, and IVT filtration (summary of the MRC position, Amazon Ads and retail media practice)
The MRC definitions are quoted from the secondary source linked beside them; the addendum linked above is the original. Figures from Pixalate and DoubleVerify are the vendors' own measurements and are not independently audited here.
