How Offernet protects client media budgets from ad fraud through VeriNET

That changes the question advertisers need to ask.

It is no longer simply:

“Did we receive a conversion?”

It is:

“Was there a real human behind that conversion, did they genuinely intend to engage with the brand, and did that interaction ultimately create legitimate commercial value?”

This is the principle behind VeriNET, Offernet’s media integrity and ad fraud verification process.

VeriNET combines multiple layers of monitoring, verification, behavioural analysis, offline outcome data and forensic investigation to identify potentially fraudulent traffic, leads, conversions and advertising placements before they consume significant portions of a client’s media budget.

For security reasons, Offernet does not publish an exhaustive list of the signals, rules, thresholds and detection methods used within VeriNET.

Publishing the complete methodology would make it easier for malicious publishers, applications and fraud operators to engineer activity specifically designed to evade those controls.

However, the following provides an overview of the fundamental principles and protections that form part of VeriNET.

VeriNET does not allow a single conversion metric to define success

One of the biggest weaknesses in conventional digital advertising measurement is that reporting often ends at the point where the advertising platform records a conversion.

An impression occurred.

A click occurred.

A form was submitted.

A conversion was recorded.

The campaign is therefore considered successful.

VeriNET does not stop measuring there.

Through Touchpoint reporting and Offernet’s Data Echo processes, VeriNET continues evaluating what happens after the advertising platform records the conversion.

For a lead-generation campaign, for example, VeriNET may examine:

• Was the submitted telephone number valid?
  
• Was the telephone number operational and contactable?
  
• Did the customer actually respond?
  
• Did the person confirm that they made the enquiry?
  
• Were the details supplied on the form accurate?
  
• Was the person genuinely interested in the advertised product?
  
• Did the lead meet the client’s qualification requirements?
  
• Did the customer receive a quotation or offer?
  
• Did they purchase?
  
• Was the transaction successfully activated?
  
• Was that transaction subsequently cancelled or reversed?
  
• Did the customer remain active?
  
• What revenue and ultimately what commercial value did the acquisition produce?

This allows Offernet to measure the difference between a digital conversion and a commercially valid customer outcome.

That distinction is critical.

A media platform may report that a campaign produced a successful conversion. VeriNET asks whether that conversion was credible, whether the supposed customer intended to perform it, and whether the event ultimately translated into legitimate commercial value.

Offline conversion data becomes a fraud-detection signal

Offline conversion measurement is usually discussed as an optimisation technique. Within VeriNET, it also becomes part of the security architecture.

If one placement produces hundreds of inexpensive leads but those leads consistently cannot be contacted, deny making the enquiry, fail qualification or never progress into legitimate sales, that downstream behaviour becomes evidence about the integrity of the traffic source itself.

VeriNET therefore evaluates performance beyond simple metrics such as:

Cost per lead

and progressively considers more commercially meaningful indicators such as:

Cost per contactable lead

Cost per verified lead

Cost per qualified opportunity

Cost per approved customer

Cost per activated sale

Cost per retained customer

and ultimately:

Cost relative to realised commercial value.

A placement that seems inexpensive at the top of the funnel can therefore become extremely expensive once downstream quality is considered.

This is one of the fundamental principles behind Touchpoint and VeriNET: connecting upstream marketing activity to downstream CRM, operational and revenue outcomes rather than allowing the advertising platform’s conversion event to become the final definition of success.

Lead integrity verification

When a lead enters the Offernet ecosystem, the form submission itself is only one piece of evidence.

Depending on the campaign, available integrations, applicable privacy requirements and the data available to us, VeriNET can analyse additional signals to assess whether the interaction appears consistent with legitimate human behaviour.

These may include the following.

Contact information integrity

VeriNET can analyse whether:

• The telephone number is structurally valid;
  
• That number appears operational;
  
• The number is contactable;
  
• Information supplied in different fields is internally consistent;
  
• The same details have recently appeared elsewhere within the permitted Offernet data environment;
  
• Identical or materially similar leads have been submitted during configurable periods such as the previous seven or 30 days;
  
• The information is associated with known duplication patterns;
  
• Permitted historical information indicates previous fraudulent or suspicious behaviour;
  
• The record matches internal risk, suppression or sensitivity criteria.

A fraudster does not necessarily need to invent a fake identity.

One of the increasingly important characteristics of sophisticated lead fraud is the use of real information belonging to real people.

The phone number can be real.

The name can be real.

The email address can be real.

The device can be real.

The question VeriNET therefore asks is not merely:

“Does this customer exist?”

It asks:

“Did this customer actually perform the action being attributed to them?”

That distinction is fundamental to modern ad fraud detection.

Device and environmental analysis

Where technically available and lawfully collected, VeriNET can use device and session information as additional fraud indicators.

Signals may include characteristics such as:

• Operating system;
  
• Browser and browser version;
  
• Device category;
  
• Screen dimensions;
  
• Viewport dimensions;
  
• Orientation;
  
• Language and regional configuration;
  
• Session characteristics;
  
• Device or browser consistency;
  
• Network characteristics;
  
• Timestamp;
  
• Referral information;
  
• Placement information;
  
• Other available environmental telemetry.

In environments where appropriate telemetry is available, additional device-state information may also contribute to the risk model.

For example, VeriNET may consider whether available device-state information is consistent with the claimed customer interaction, including indicators such as charging state or battery level where those signals are legitimately available to the campaign environment.

Importantly, none of these characteristics should normally be interpreted as proof of fraud in isolation.

An Android device is not fraudulent.

A small screen is not fraudulent.

A 2am application is not fraudulent.

A charging phone is not fraudulent.

A new browser is not fraudulent.

However, combinations of unusual signals can become highly significant.

A cluster of leads generated at unusual hours, through the same placement, exhibiting abnormal interaction patterns, producing exceptional conversion rates and subsequently being disputed by the supposed customers is materially different from any one of those observations considered independently.

This is why VeriNET applies multi-signal risk analysis rather than relying on simplistic single-variable rules.

Behavioural analysis: Did a human actually use the form?

One of the areas that becomes particularly important in conversion-event fraud is determining whether the recorded interaction is consistent with a human actually viewing and completing the interface.

Where the implementation allows it, VeriNET can analyse behavioural and interface telemetry around the conversion process.

For example:

• Was the page actually visible long enough to reasonably be read?
  
• Did the user scroll?
  
• Were required fields visible within the viewport?
  
• Was there normal progression through the form?
  
• How quickly were fields populated?
  
• Were several fields populated at implausibly similar speeds?
  
• Was the sequence of interaction consistent with the form’s visual layout?
  
• Was there normal movement between fields?
  
• Was the interface rendered at a reasonable physical size?
  
• Were text and input fields realistically readable on the recorded device?
  
• Did the session exhibit evidence consistent with normal human interaction?
  
• Did the submission occur unusually quickly after the page became available?
  
• Does the pattern resemble legitimate traffic previously observed for the campaign?

This is important, because automated systems can submit perfectly valid forms.

In some cases, the fact that the interaction is too perfect, too fast or too mechanically consistent can itself become relevant.

VeriNET does not automatically label a fast form completion as fraudulent. Instead, it identifies patterns that differ materially from the behaviour normally observed from genuine customers.

Temporal and contextual analysis

Time is another valuable fraud signal.

VeriNET can compare when activity occurs against:

• Historical campaign behaviour;
  
• Normal customer engagement periods;
  
• Placement-specific patterns;
  
• Device patterns;
  
• Downstream contactability;
  
• Geographic patterns;
  
• Other behavioural indicators.

Again, unusual timing is not itself evidence of fraud.

People legitimately purchase products or complete applications late at night. The concern emerges when timing correlates with other anomalies.

For example, Offernet has identified suspicious activity where questionable leads were concentrated during periods in which the supposed users’ devices would reasonably be expected to be inactive.

On its own, this would not prove anything.

But when those same leads are also:

• Unusually inexpensive;
  
• Concentrated within particular placements;
  
• Generated at unusually high conversion rates;
  
• Associated with abnormal interaction patterns;
  
• Disputed by the supposed customers,

the combined evidence becomes far more significant.

This illustrates an important principle within VeriNET:

An anomaly is a question. Multiple correlated anomalies can become evidence.

The VeriNET Data Echo

One of the most important components of VeriNET is what Offernet refers to as the Data Echo.

The advertising system makes a claim:

VeriNET then listens for what happens afterwards.

The CRM may tell us the lead was received.

The call centre may tell us the telephone number did not exist.

The customer may tell us they never submitted the enquiry.

The qualification system may tell us the customer wasn’t eligible.

The sales platform may tell us the customer was never approved.

The activation system may tell us the sale was never activated.

The billing platform may tell us the transaction was reversed.

The retention system may tell us the customer cancelled immediately. Each downstream system creates another piece of evidence.

When those systems agree, our confidence in the acquisition increases. When they disagree, the disagreement becomes something that VeriNET can investigate.

This is fundamentally different from allowing the same advertising ecosystem that sold the media to be the only authority determining whether that media was successful.

Placement-Level Fraud Detection
Individual suspicious leads are important, but VeriNET is particularly interested in patterns. Fraud becomes commercially damaging when it operates at scale.

For this reason, risk signals can be analysed at multiple levels, including:

• Individual conversion;
  
• Customer;
  
• Session;
  
• Device;
  
• Creative;
  
• Publisher;
  
• Website;
  
• Mobile application;
  
• Placement;
  
• Campaign;
  
• Advertising network;
  
• Geographic area;
  
• Time period;
  
• Combinations of these dimensions.

This makes it possible to identify situations in which individual events appear superficially legitimate, but collectively exhibit an improbable pattern.

For example, a placement producing unusually inexpensive conversions may initially seem to be highly efficient.

If that same placement simultaneously produces:

• Abnormally high conversion rates;
  
• Poor contactability;
  
• Repeated customer denial;
  
• Unusual device behaviour;
  
• Abnormal time-of-day patterns;
  
• Excessive duplication;
  
• Almost no downstream sales,

the economics of that placement look very different.

The objective of VeriNET is therefore not simply to identify bad leads.

It is to identify the source, environment or pattern producing them.

VeriNET risk scoring

VeriNET combines multiple signals to create a risk profile around traffic, conversions and placements.

The process does not automatically conclude that something is fraudulent simply because one signal exceeds a threshold.

Instead, suspicious activity is progressively scored and, where necessary, escalated for deeper investigation.

Depending on the circumstances, this can include:

• Placement-level analysis;
  
• Cohort comparisons;
  
• Customer verification;
  
• Conversion-time analysis;
  
• Behavioural analysis;
  
• Device analysis;
  
• Traffic--pattern analysis;
  
• Duplicate analysis;
  
• CRM outcome analysis;
  
• Call-centre feedback;
  
• Revenue analysis;
  
• Publisher or application investigation; and
  
• Forensic review of the environment producing the traffic.

This is important, because excessively aggressive fraud prevention creates its own risk: legitimate customers being incorrectly rejected.

VeriNET is therefore designed as a risk-based verification system, not a simplistic pass-or-fail blacklist.

What happens when VeriNET identifies a fraudulent placement?

Detection without intervention does not protect the media budget.

When sufficient evidence indicates that a source or placement represents an unacceptable fraud risk, VeriNET can initiate a containment and remediation process.

Depending on the advertising platform and campaign architecture, this may include:

1. Immediate containment

The affected application, website, publisher or placement can be excluded from relevant campaigns where the advertising platform provides that control.

The objective is to stop additional media spend flowing towards a source that has already demonstrated unacceptable risk.

2. Cross-campaign protection

Confirmed high-risk sources can be incorporated into Offernet’s internal placement intelligence so that the finding can inform other applicable campaigns.

This means every campaign does not necessarily have to rediscover the same problematic source independently.

3. Evidence preservation

Relevant campaign, conversion, placement and downstream evidence is retained for investigation and escalation.

This may include:

• Placement identifiers;
  
• Spend;
  
• Conversion history;
  
• Timestamps;
  
• Downstream lead outcomes;
  
• Customer responses;
  
• Behavioural indicators;
  
• Device information;
  
• Screenshots;
  
• Application or publisher information;
  
• Other supporting forensic evidence.

4. Advertising network reporting

Where appropriate, suspicious or fraudulent activity is reported to the relevant advertising network or platform.

The objective is not simply to exclude the placement from one campaign, but to provide the platform with sufficient evidence to investigate the source more broadly.

5. Historical media-spend analysis

VeriNET can analyse the historical spend associated with the identified source and determine when suspicious activity first appears to have entered the campaign environment.

This allows Offernet to estimate the potential financial exposure associated with the source, rather than limiting the analysis to the current reporting period.

6. Credit or refund requests

Where appropriate, Offernet can prepare and submit supporting evidence to the advertising platform requesting reimbursement or advertising-account credit for media that is considered invalid.

The objective is to identify the total potentially affected spend from the earliest point at which the fraudulent placement or pattern can be reasonably established.

Any refund or credit ultimately remains subject to the individual advertising platform’s investigation, policies and determination.

Offernet’s role is to:

identify the exposure, quantify it, preserve the evidence, report it and pursue the claim.

We do not simply accept the loss as normal campaign wastage.

Protecting the optimisation algorithm

There is another important consequence of advertising fraud that is often overlooked. Fraud does not merely waste today’s media budget.

It can influence where tomorrow’s media budget is spent.

Modern advertising platforms use machine-learning systems to continuously search for more of the behaviour an advertiser defines as success.

If a campaign tells the platform:

“A submitted lead form is a successful conversion”,

then placements capable of producing large volumes of inexpensive submitted forms can become extremely attractive to the optimisation algorithm.

If those conversions are fraudulent but are never identified and corrected, the advertising system receives a false positive signal.
The fraud can therefore create a feedback loop:

Fraudulent activity creates conversions.

Conversions appear to represent successful advertising.

The algorithm reallocates additional budget towards the source.

The fraudulent source produces more conversions.

Reported campaign performance improves.

More budget follows.

The campaign can therefore look better at exactly the same time that the underlying commercial performance is deteriorating.

VeriNET is designed to interrupt this feedback loop.

By feeding downstream quality information into the measurement process, Offernet can identify when a source is generating the appearance of performance rather than genuine customer value.

VeriNET, Touchpoint and Data Echo

VeriNET operates as part of Offernet’s broader measurement architecture. The relationship between the three components can be expressed simply: Touchpoint tells us what happened.

Data Echo tells us what happened next.

VeriNET determines whether we should trust it.

Touchpoint provides the measurement framework that connects advertising activity to the wider customer journey.

Data Echo brings downstream operational, CRM, sales, activation and retention information back into that measurement environment.

VeriNET applies the verification, anomaly detection, fraud-risk scoring and forensic investigation methodology across those signals.

Together, they allow Offernet to move beyond the conventional advertising question: “How many conversions did we buy?”
towards the questions that matter commercially:

How many real customers did we acquire?

Did those customers actually intend to engage with us?

What did it cost us to acquire them?

Which media sources created genuine commercial value?

Which placements created waste or suspicious activity?

Where should the next rand of media budget be invested?

VeriNET comes standard with Touchpoint

For Offernet clients using Touchpoint, VeriNET forms part of the broader media integrity and measurement environment.

This means fraud monitoring is not treated as an optional exercise performed only after something goes wrong.

It forms part of the way Offernet measures campaign performance.

The purpose is to identify suspicious activity early enough to prevent it from materially influencing both media expenditure and optimisation behaviour.

The faster suspicious traffic is identified, the faster Offernet can:

• Investigate the source;
  
• Isolate the placement;
  
• Prevent further spend;
  
• Correct optimisation signals;
  
• Report the activity;
  
• Quantify the financial impact.

VeriNET ad fraud risk and impact assessment

VeriNET can also be independently deployed.

An organisation does not need to transfer its media management to Offernet in order to use the methodology.

Offernet can provide a VeriNET ad fraud risk and impact assessment for advertisers that:

• Manage media internally;
  
• Use an internal marketing team;
  
• Work with an external media agency;
  
• Use several agencies simultaneously;
  
• Want independent verification of campaign quality;
  
• Suspect unusual placement activity;
  
• Experience poor lead quality despite strong platform metrics;
  
• Have exceptionally low CPL or CPA results that cannot be reconciled with sales performance; Wish to understand their potential financial exposure to invalid advertising activity.

The purpose is to provide the advertiser with an independent layer of verification.

Depending on the available data and agreed scope, a VeriNET assessment can include:

VeriNET fraud risk score

An overall risk assessment based on indicators associated with potentially invalid, automated, manipulated or otherwise suspicious advertising activity.

Placement risk analysis

Identification of publishers, mobile applications, domains, placements or traffic sources requiring investigation.

Commercial impact assessment

An estimate of media spend associated with potentially suspicious or low-integrity inventory.

Lead integrity analysis

Assessment of duplicate rates, contactability, customer verification and other available indicators of lead quality and authenticity.

Behavioural risk analysis

Review of available session and interaction telemetry to identify activity inconsistent with expected human behaviour.

Downstream quality assessment

Comparison between frontend advertising conversions and actual:

• Contactability;
  
• Qualification;
  
• Quotations;
  
• Approvals;
  
• Sales;
  
• Activation;
  
• Retention;
  
• Commercial value.

Historical exposure analysis

Investigation of how long suspicious placement behaviour may have been present and the historical media investment associated with this. .

Remediation recommendations

Recommended:

• Placement exclusions;
  
• Measurement changes;
  
• Attribution adjustments;
  
• Optimisation changes;
  
• Conversion architecture improvements;
  
• Offline conversion integrations;
  
• Fraud-monitoring controls;
  
• Platform escalation actions.

The purpose of VeriNET is not to replace an advertiser’s agency.

It is to provide the advertiser with an independent media integrity capability that is able to audit g what the advertising ecosystem is actually producing.

Why most advertisers underestimate their exposure

Most advertisers already accept that some portion of digital advertising spend is lost to invalid traffic, fraudulent activity and poor-quality placements.

The difficult question is:

How much?

That is considerably more difficult to answer.

Most advertisers and many agencies do not have the necessary infrastructure to continuously connect advertising activity with:

• Customer verification;
  
• CRM outcomes;
  
• Call-centre feedback;
  
• Lead contactability;
  
• Sales;
  
• Activation;
  
• Cancellations;
  
• Revenue;
  
• Retention;
  
• Long-term customer value.

Without that infrastructure, fraudulent advertising activity can remain hidden inside apparently successful campaign metrics.

This is particularly dangerous when the fraud generates the exact conversion event the campaign is optimising towards.

The dashboard may therefore indicate that performance is improving. Cost per lead may fall.

Conversion rate may increase.

Volume may grow.

Yet the advertiser may be spending increasingly more money acquiring events that never represented genuine consumer demand.

The organisation may only discover the problem much later, once poor-quality leads have accumulated, conversion rates have deteriorated or sales performance fails to match marketing reports.

By that point, the algorithm may already have been trained to purchase significantly more of the same inventory.

This is why real-time or near-real-time verification matters.

A real customer does not automatically mean a real conversion

One of the most important lessons from modern ad fraud is that the presence of real consumer data does not prove that the advertising interaction was legitimate.

A fraudulent conversion can involve:

A real phone.

A real device.

A real application.

A real telephone number.

A real email address.

A real person.

Every individual component can therefore appear valid.

What may not be real is the customer’s intent.

That distinction sits at the heart of VeriNET.

VeriNET is designed to look beyond whether the digital event technically occurred and ask whether the available evidence supports the proposition that a real person intentionally performed it.

From performance reporting to media protection

Traditional performance reporting tells an advertiser what the advertising platform recorded. VeriNET goes further:

The advert says that a person is engaged.

The form says somebody applied.

The session tells us how the interaction occurred.

The device provides contextual signals.

The customer tells us whether they actually made the enquiry.

The CRM tells us if the opportunity was legitimate.

The sales system tells us whether value was created.

The activation system tells us whether the transaction became real.

The retention data tells us if the customer remained.

And the Data Echo allows us to determine whether all of those stories agree. When they agree, confidence increases.

When they do not agree, VeriNET investigates.

When fraudulent activity is identified, we act.

And when a media placement is spending a client’s money without producing legitimate human intent or commercial value, VeriNET is designed to identify it, contain it, quantify the impact and stop the optimisation system from simply buying more of it.

This is the difference between simply reporting advertising performance and actively protecting the media investment behind it through VeriNET.

Important note

No fraud-detection system can guarantee identification of every fraudulent event.

The availability of individual VeriNET signals depends on the campaign architecture, advertising platform access, technical integrations, consent mechanisms, applicable privacy requirements and downstream data available to Offernet.

VeriNET therefore operates as a layered, risk-based verification and investigation framework rather than claiming absolute fraud prevention.

Its strength comes from combining multiple independent signals and comparing what the advertising system claims occurred with what subsequently happened in the real customer journey.