Ad Fraud in 2026: How Much There Is, Why Estimates Disagree and What AI Bots Change

Ad fraud is any deliberate attempt to make advertisers pay for impressions, clicks, installs or conversions that no real, interested person produced, or to misrepresent where an ad ran. How much of it there is depends on who measures. In 2025 and 2026, headline rates ranged from 0.1% of programmatic spend in the ANA's benchmark of large advertisers to 41% of open-auction mobile app impressions measured by Pixalate. Meanwhile bots made up 53% of all web traffic in 2025, according to Thales, and AI agents arrived as a new kind of visitor that the industry has not yet decided how to count.

Every figure below was checked on 22 October 2026 and comes with its source and date.

What is ad fraud?

Ad fraud covers schemes that generate fake ad activity or disguise where it came from: bots that load pages and click ads, apps that show ads nobody sees, cheap inventory passed off as premium, and fake leads or installs that trigger a payout. The people behind it get paid by ad networks, exchanges or affiliate programs for traffic that was never worth anything to the advertiser.

The industry measures it as invalid traffic (IVT), a wider term that also includes activity with no bad intent, such as search engine crawlers loading a page with ads. The Media Rating Council (MRC), which sets US measurement standards, splits IVT into two classes.

The split matters for the numbers below. A vendor that reports "fraud" may mean SIVT only, while another counts every invalid click, including accidental ones.

What are the main types of ad fraud?

How much ad fraud is there in 2026?

There is no single answer. Each vendor measures its own customers in its own unit, some before filtering and some after, so the latest published rates span more than two orders of magnitude.

The same vendor can report numbers several times apart depending on whether the campaign was protected. Across all markets, DoubleVerify measured fraud and SIVT at 0.6% on protected campaigns and 2.8% on unprotected ones in 2025, according to PPC Land's summary of its regional reports. On connected TV the gap is wider. IAS measured 9.1% IVT on non-optimized CTV campaigns in Q2 2026 against 0.1% on optimized ones. DoubleVerify, in a May 2026 report that gives no data period, put protected CTV under 1% and unprotected CTV at nearly 9%.

How much money is lost to ad fraud?

Dollar estimates are a fraud rate multiplied by somebody's forecast of total ad spend, so they inherit every difference in the rates.

• Juniper Research, in its latest ad fraud forecast (September 2023, published with the vendor Fraud Blocker), put losses at $84.2 billion in 2023, or 22% of digital ad spend, rising to $172.3 billion in 2028.
• Lunio estimated $63 billion for 2025 by applying its 8.51% click rate to about $740 billion of global digital ad spend.
• Spider AF estimated $32.6 billion for 2025. For the first half of 2026 it put losses at $25.3 billion by applying its 5.58% rate to half of EMARKETER's $907.0 billion forecast for 2026. Over a full year that comes to about $50.6 billion.
• Anura estimated $165 billion for 2025 without disclosing its method.

Lunio and Spider AF both apply a rate measured on paid clicks to all digital spend, including CTV and retail media, channels their click data does not cover. Ad fraud researcher Augustine Fou argued in October 2026 that Lunio's $63 billion undercounts fraud on CPM buys, where a bot only needs the ad to load. A "$131 billion by 2030" ad fraud figure credited to Juniper in some coverage matches Juniper's forecast for e-commerce fraud, which grows from $56 billion in 2025 to $131 billion in 2030. We found no Juniper ad fraud forecast newer than 2023.

Why do ad fraud estimates disagree?

The numbers above measure different things. Five differences explain most of the gap:

1. They count different units. A share of impressions, clicks, site visits or spend are different measures, and a click-based rate can't be compared with an impression-based one.
2. They measure at different points. DoubleVerify reports post-bid rates, so traffic its pre-bid filters already blocked never reaches the figure. IAS's 1.1% blends campaigns with and without its fraud filtering. Lunio measured accounts with its blocking switched off, and Pixalate measures raw open-auction traffic.
3. They define fraud differently. DoubleVerify's headline counts fraud and SIVT only. Pixalate and Fraudlogix count both general and sophisticated IVT, and Lunio's definition also includes accidental clicks.
4. They sample different traffic. Vendors measure their own clients, and advertisers may sign up because they already suspect fraud. The ANA benchmark uses log-level data from large advertisers, with CTV alone at 41.6% of the spend it tracked in Q2 2026, a very different mix from the paid clicks that Lunio and Spider AF measure.
5. Channels and markets vary widely. Lunio found 24.20% invalid clicks on TikTok and 7.57% on Google. Fraudlogix measured 59.17% IVT in Indonesia and 1.02% in the Netherlands in Q1 2026.

A low rate does not prove quality either. In a July 2026 analysis, TAG, the ANA and Fiducia found that AI-generated "slop" sites had an IVT rate of 0.05%, lower than the 0.32% on what the study called clean supply, and that 88% of that inventory was also made for advertising. The impressions passed fraud checks, yet most of them sat on sites built only to show ads.

How do AI bots and agents change ad fraud?

AI adds a large new class of automated visitors, sends agents to browse for real people and makes fake supply cheap to build. Each of these shows up in ad metrics.

How much web traffic is bots?

• Thales (Imperva) found that bots made up 53% of web traffic in 2025, up from 51% a year earlier, and that 40% of all traffic was malicious. AI-driven bot attacks grew 12.5 times (Bad Bot Report, 29 April 2026).
• Cloudflare's 2025 Year in Review measured humans at 47% of requests for HTML pages and non-AI bots at 44% as of 2 December 2025. AI bots averaged 4.2% of HTML requests over the year and Googlebot 4.5%.
• In September 2026 Cloudflare wrote that "more than half of Internet traffic wasn't human" this year for the first time, and that daily requests from AI agents on its network grew more than 1,700% in a year. The post did not say how the first share was measured.
• HUMAN Security measured automated traffic growing 23.51% in 2025 against 3.10% for human traffic. Traffic from AI agents and agentic browsers grew 7,851%, from a very low base, and made up 1.7% of AI-driven traffic by December 2025.

Do AI bots see and click ads?

Yes. DoubleVerify reported in January 2025 that general invalid traffic rose 86% year over year in the second half of 2024 and that a record 16% of GIVT from known bots in 2024 came from AI crawlers and scrapers such as GPTBot, ClaudeBot and AppleBot. In December 2025 it said AI bots accounted for up to 15% of all clicks in unprotected media, and that in certain client tests and research studies an ad click was 10 times more likely to come from an AI bot than from a human.

TollBit, which tracks AI scraping for publishers, observed in the first half of 2026 that some scrapers were convincing enough to trigger Google Ads: the page treated the bot as a human and rendered ads to it. About 15% of AI scrapes in the same period ignored a robots.txt instruction not to crawl.

AI ad inventory has its own fraud too. Click-verification vendor TrafficGuard analyzed 40,021 clicks on ChatGPT ads from 47 advertisers in August and September 2026 and found invalid rates between 0.1% and 34% by advertiser, according to PPC Land. We cover how those ads are sold in our guide to ChatGPT ads and AI agent advertising.

Are AI agents invalid traffic?

As of October 2026 there is no industry rule. Verification vendors file declared AI agents, the ones that identify themselves in the user agent, under general invalid traffic. IAS told Digiday in November 2025 that it reports them as GIVT rather than fraud, so advertisers don't pay for them, and HUMAN's taxonomy lists "AI Agents" under GIVT. DoubleVerify classifies declared AI activity as GIVT and evasive AI activity as SIVT, and since November 2025 has reported agentic browsing, such as sessions from Perplexity's Comet and OpenAI's Atlas, as a separate class.

The Media Rating Council listed "agentic validity", meaning whether an ad seen by an agent working for a real person counts, among the open gray areas in its July 2026 guidance. It expects to finish its AI standards in phases through 2026 and early 2027. Google's invalid traffic policy for advertisers does not mention agents.

The practical problem is identification. Agents that sign their requests can be told apart: ChatGPT agent uses the Web Bot Auth standard, and Cloudflare has listed it as a signed agent since August 2025. Agentic browsers are harder. TollBit found in 2025 that Comet identifies itself as ordinary Chrome and loads pages from the user's own residential IP address. HUMAN reported the same pattern for Atlas, which OpenAI shut down in August 2026 and folded into the ChatGPT desktop app. Filters built on lists of bot user agents count these sessions as human.

How do fraudsters use AI?

The clearest use is cheap fake supply. DoubleVerify's AutoBait investigation found one operator running more than 200 AI-generated MFA sites with up to 56 slides per article and eight ad slots per slide, at under $2.25 per page.

They also use computer vision to click. Bitsight reported in July 2026 that infected TV boxes in the Fuyao operation used a YOLO vision model and OCR to find and click ads on 144 AI-generated sites monetized through AdSense and Taboola. Doctor Web found an Android trojan in January 2026 that used a TensorFlow.js model to locate and tap ads on a hidden screen.

Fraud also follows automated buying. Spider AF says 71% of the ad fraud losses it traced to MFA sites in H1 2026 came through AI-optimized channels such as Google Performance Max, up from about 62% in 2025.

We found no confirmed case of fraud carried out by LLM agents themselves. Platforms use AI on the other side as well: Google said in August 2025 that LLM-based review had cut invalid traffic from deceptive or disruptive ad serving by 40%.

Which ad channels have the most fraud?

By Pixalate's open-auction data, mobile apps carry the highest IVT, 41% of impressions in Q2 2026, up from 29% a year earlier, followed by CTV at 26% and the web at 20%. CTV is where many new schemes appear: DoubleVerify detected 140% more CTV fraud schemes and variants in Q1 2026 than a year earlier, and found that direct deals are not automatically safe, with 34% of impressions in one direct CTV deal going to bots.

In paid social and search, Lunio's 2026 report ranked TikTok highest at 24.20% invalid clicks, then LinkedIn at 19.88%, X at 12.79%, Bing at 10.32%, Meta at 8.20% and Google at 7.57%. Within Google, video campaigns on Google Video Partners ran at 20.62% and Search at 5.21%. By vertical, gaming and iGaming had the highest rate, 18.49%.

Performance traffic carries its own risk. AppsFlyer's 2026 fraud report, covering more than 100 billion installs, found that in Q1 2026 the install fraud rate of affiliate traffic was 36 times that of self-reporting networks such as Google and Meta. For push notifications, HUMAN disclosed the Pushpaganda scheme in April 2026: AI-generated pages in Google Discover tricked users into subscribing to notifications that then delivered scareware, generating about 240 million bid requests in a single week at its peak. We found no independent 2025 or 2026 measurement of fraud rates in push and popunder traffic; the figures that circulate come from single vendors with undisclosed methods.

Who sells ad fraud protection?

The market splits into verification companies that measure and filter programmatic impressions, and click-fraud tools that protect search, social and performance campaigns.

Both large verification companies are leaving the stock market: IAS went private in December 2025 and Nielsen is buying DoubleVerify. DoubleVerify's growth slowed to 3% in Q2 2026. Market-size estimates for ad fraud detection come from paid research firms with undisclosed methods and differ by four times or more. For scale, DoubleVerify's and IAS's last reported annual revenues add up to about $1.28 billion.

What Y Combinator is funding

A search of Y Combinator's company directory on 22 October 2026 returned no company positioned as an ad fraud or click fraud vendor. YC's bets sit next to the problem. Castle (Winter 2016) and Proof of Human (Summer 2023) detect bots and verify humans. Artil (Winter 2025), Alter (Summer 2025), Multifactor (Fall 2025), Clawvisor (Spring 2026) and Inkbox (Summer 2026) build identity, authentication and permissions for AI agents. At least one makes automated browsing harder to detect: Kernel (Summer 2025), which raised $22 million led by Accel in October 2025, sells browser infrastructure for agents with a stealth mode, residential proxies and CAPTCHA solving. Outside YC, Twilio bought the agent identity company Stytch in November 2025 and bot defense firm Kasada raised $20 million in February 2026.

How do you prevent ad fraud and click fraud?

For advertisers buying performance traffic:

1. Optimize toward events that are hard to fake. Pass conversions back with a postback and judge sources by deposits, paid orders or qualified leads rather than clicks or registrations. In Lunio's May 2026 survey, 51.1% of marketers named bidding algorithms optimizing toward non-human converters as a risk of agentic AI traffic, the most common answer.
2. Read results by source every day. Fraud concentrates in particular placements, so a source that spends without converting should be cut early with a blocklist or an automated rule, or bid down with microbidding.
3. Look for patterns, not single clicks: click-through rates far above the campaign average, conversions seconds after the click, traffic from data center IP ranges, identical device profiles and countries that don't match the targeting.
4. Ask your ad network or DSP how invalid traffic is filtered before billing and how credits work. Google Ads, for example, does not charge for invalid traffic it detects before billing and credits what it finds afterwards.
5. In programmatic buying, check ads.txt and sellers.json, exclude MFA inventory and don't assume a direct deal is clean.
6. Keep AI agents out of your audiences. Exclude declared bots and agents from retargeting lists and lookalike seeds, and report them separately in analytics.
7. Compare fraud rates only within the same unit and the same vendor.

In the same Lunio survey of 131 marketers, 75.6% estimated losing more than 5% of their performance budget to invalid traffic, yet only 5.3% used a dedicated prevention tool.

For publishers, AI crawlers add a different cost. They inflate GIVT, and buyers react to IVT spikes: Digiday reported in November 2025 that one buyer paused spend on Salon after an alert tied to a surge in agentic visitors. Since July 2026 Cloudflare has let all its customers treat search, agent and training crawlers separately, and its pay per crawl private beta, running since July 2025, lets sites charge AI crawlers for access.

Our view

This section is Youtarget's opinion, not reporting.

We don't find a fraud rate useful until we know what it counts. "8% fraud" can mean paid clicks in unprotected accounts or impressions after pre-bid filtering, and the two numbers say different things about your budget. Ask which traffic was measured, in what unit, and before or after filtering.

AI has made fake supply almost free to produce. When an AI-written article costs under $2.25 to generate, lists of bad domains can't keep up, and protection has to move to the result the advertiser actually wants: a deposit, an order or a qualified lead. That favors CPA buying and source-level reporting that shows within a day where the money went.

We don't think agents acting for real people are fraud. They also aren't the audience most advertisers are paying to reach. Until the MRC settles the question, we think declared agent traffic should stay out of billable counts, as other GIVT does, and be reported separately so advertisers can decide what it is worth to them. Agentic browsers that look like ordinary Chrome are the bigger gap: DoubleVerify classifies them separately, but no vendor publishes how many ad impressions they receive.

On Youtarget, bots and invalid clicks are filtered on the platform side before they are billed, statistics are broken down to the traffic source in real time, and advertisers can cut sources with blocklists, allowlists and automated rules. Campaigns run on CPM, CPC or CPA, and the system can bid toward conversions sent back by postback instead of toward clicks.

Sources

All pages were checked on 22 October 2026.

• Fraud and IVT rates: ANA Q2 2026 benchmark, IAS Media Quality Report, 21st edition, DoubleVerify regional reports via PPC Land, DoubleVerify on CTV fraud, Pixalate Q2 2026, Fraudlogix Q1 2026, Spider AF H1 2026, Lunio Global Invalid Traffic Report 2026, ClickCease by industry, Anura executive brief, TAG, ANA and Fiducia on AI slop
• Losses: Juniper Research 2023 study, Spider AF 2025 estimate, Augustine Fou via PPC Land, Juniper on e-commerce fraud
• Bots and AI: Thales Bad Bot Report 2026, Cloudflare 2025 Year in Review, Cloudflare on the agentic web, Cloudflare signed agents, HUMAN 2026 AI traffic report, DoubleVerify on AI crawlers and GIVT, DoubleVerify on AI bot clicks, TollBit State of the Bots H1 2026, TrafficGuard on ChatGPT ads via PPC Land, Google on AI against invalid traffic
• Classification of agents: MRC guidance on AI in measurement, HUMAN IVT taxonomy, HUMAN on ChatGPT Atlas, Atlas shutdown, Digiday on agentic traffic, Google Ads invalid traffic policy
• Schemes: Google lawsuit over BADBOX 2.0, SlopAds, NewsJunkie, Pushpaganda, AutoBait, Fuyao, AppsFlyer State of Fraud 2026, US v. Zhukov (Methbot)
• Market: Nielsen to acquire DoubleVerify, DoubleVerify 2025 results, IAS take-private closing, Peer39 acquires Adloox, Lunio State of Click Fraud 2026