DSPs Say Fraud Runs 1 to 3 Percent. Ten Years After Veritad's One-Pixel Ads Story, Scans Find Half.

From a 2016 site loading ads in one-pixel frames to 2026's self-reported fraud rates, bot identities and spyware served through ads, the gap is still between what vendors report and what outside checks find.

By Pesach Lattin · November 4, 2026

Ad fraud has a way of changing outfits without changing jobs. In 2016, Veritad wrote about a site loading ads in one-pixel frames and popunders. A decade later, the tricks are subtler, the numbers are bigger, and the most interesting gap is between what vendors say about their own traffic and what outside checks find. This page walks from that 2016 piece to the 2026 reporting on DSP fraud rates, bot identities and spyware delivered through ads.

2016: ads in one-pixel frames

The 2016 Veritad piece was about a site loading ads in one-pixel frames and popunders. A one-pixel frame is an ad nobody can see, served so somebody can bill for it. That was the old shape of the problem: impressions that were technically delivered and practically invisible. Keep it in mind, because the 2026 version is less about hiding ads and more about trusting numbers nobody outside the vendor has checked.

2026: DSPs say 1 to 3 percent. Anura's scans keep finding half.

DSPs tell clients their fraud rate runs 1 to 3 percent, already filtered out before the buy. That figure is the DSPs' own self-reported GIVT catch rate, not a verified measurement. Anura's post-click scans of DSP traffic keep finding roughly 50 percent bots, malware or human fraud, with individual scans running from about 40 percent to more than 90. The highest, over 90 percent, came from a major university's agency buying through one of the largest DSPs.

The mechanics explain a lot. Pre-bid filters get about 20 milliseconds per decision; Anura checks more than 800 data points at the landing page. Anura CEO Rich Kahn: "The gap isn't a discrepancy, it's the difference between what a 20-millisecond IP check (GIVT filter) can see and what 800 data points (SIVT filter) at the landing page can see." The MRC says it often sees filtration rates in audits well above 1 percent. And Kahn put growth in the fraud Anura catches at more than 50 percent over six months, driven by AI. His summary of the new economics: "Now, if you can write a prompt, you can build a bot."

Read DSPs Tell Clients Fraud Runs 1 to 3 Percent. Anura's Scans Keep Finding Half., the ADOTAT brief, and Veritad's note on what buyers can ask for.

LiveIntent says its graph is authenticated daily. It gave a bot an ID.

LiveIntent tells Prebid its graph is "authenticated daily through active engagements with email newsletters." A peer-reviewed study found 85% of its persistent IDs were shared by the phone and desktop crawls of a self-declared bot that has never read a newsletter. LiveIntent was not alone. 17 of 18 major ID vendors gave identities to the HTTP Archive crawler, which has been on the IAB Spiders and Bots list since 2013. Only Flashtalking flagged it, answering "Bot" 440,504 times.

The bot got around. One Audigent ID followed it across 52,046 crawls on 29,770 websites. Providers sent different IDs to competing exchanges on 18% of page views, and ID5 did it on 32%. Nobody grades this homework: the MRC does not audit or accredit any identity provider. MonetizeMore's Kean Graham: "Filtering declared bots is bare minimum. The ID layer treated it as optional because for 13 years on that list, it was."

The reporting: LiveIntent Says Its Graph Is "Authenticated Daily." It Gave a Bot an ID., plus the brief and Veritad's note on ID vendors and a declared bot.

Discover-Tech: when the ad is the weapon

In 2016 the worry was an ad nobody saw. In 2026 the worry includes an ad that sees you. Citizen Lab says Discover-Tech ads delivered Candiru spyware to at least 45 Al Jazeera devices in 2024 and 2025. Google buyer records show ad provider ID 3036 switching from MarketDSP to Discover-Tech Ltd on July 31, 2020, with the same domains.

GumGum says it ended its one partnership in that family nearly a decade ago. Discover-Tech was not founded until March 2020, so GumGum's partner was almost certainly MyDSP, the platform that became Discover-Tech while keeping the same Google ID, domains and integrations, and whose code still listed GumGum among 13 connections. Candiru is on the Entity List; Integrity Labs, which took over its operations for about $30 million, is not. BIS told ADOTAT a front for a listed company may be a violation, but declined to say if Integrity Labs is covered, and did not address whether an ad auction falls under the list at all.

Read GumGum Says It Left Discover-Tech's Family Tree a Decade Ago. It Didn't Say Which Branch., the brief, and Veritad's note on DSP lineage and Entity List exposure.

What changed in ten years, and what to ask now

The pattern is the same one: a number the seller reports about itself, standing in for a check nobody else ran. Self-reported filter rates. Unaudited ID graphs. Platforms that change names and keep their IDs. The Bondstark desks on DSPs and fraud and identity vendors carry full question lists. Start here:

Is your quoted fraud rate GIVT, SIVT or both, and who measured it?
Will you credit spend that independent post-click scans flag as invalid?
Do you screen out crawlers on the IAB Spiders and Bots list before issuing an ID?
Do you screen partners by platform ID and ownership, not only by company name?

The one-pixel frame was crude. The 2026 version comes with a dashboard, a match rate and a press release. Reporting by Pesach Lattin; ADOTAT's standards are here.