Fraud in CPA networks: how partners fake leads

A fake lead is not one event in the public descriptions. The OWASP automated-threats catalog separates a dubious message, a repeat meant to skew a metric, and mass use that inflates paid volume. A partner CPA network is not described on these pages, and they give no share of fake leads. Below is how to keep the events apart when a partner sends leads, and which status exists for that in a CRM upload to Metrica.

Click fraud is a neighbor here, not a synonym. Payment is for an action, and the fake can be a click, a form, or a new account. Mixing them means fixing the wrong contour.

Three different abuses of a form

OAT-017 Spamming is adding malicious or dubious information to content or to messages. Mass abuse of a broken "form to email" or "form to SMS" function, where messages go to the wrong recipients, is not part of spam or of the other events in this catalog: OWASP treats it as use of an implementation defect. Repeated use that inflates paid traffic is sent to OAT-003. Repeated use that distorts metrics is sent to OAT-016.

OAT-016 Skewing is repeated clicks on links, page requests, or form submissions whose purpose is to change some metric. The metric may be visible to people (a counter, a survey, a review, a dynamic price) or hidden (usage statistics, business indicators). For malicious inflation of spend the catalog points to OAT-003, not here. Names such as click fraud and survey skewing on the page are event names in the catalog, not a Direct report and not a quiz measurement.

For a partner lead the difference is practical. A repeat that stuffs an approval counter is closer to metric skewing. A stream of actions the network pays for is what the catalog files as inflation of paid volume. Mail that reached the wrong people because the form was broken is an implementation defect, and it is not filed as "partner fraud."

False clicks and the new name

The OAT-003 page still defines the event as false clicks and fraudulent display of advertising placed on the web. By that page, the people who do it are owners of sites with ads, competitors, and vandals. For similar activity without web advertising, the page points to OAT-016. The header says that in version 1.3 the event was renamed Cost-Inflation Fraud. In the project's current table the short description of the new name is mass use of a function in order to illegally gain from paid ancillary services.

Neither the page nor the project table describes partner CPA networks or gives a share of fake leads. Click fraud and sklikivanie is closer to the old name of the event, false clicks. A partner's paid action is closer to the new description: mass use of a function for gain from a paid service. Invalid clicks do not label the network by themselves. Who clicks ads and why is named in the catalog among those who make false clicks: site owners, competitors, vandals. A CPA partner is not singled out on that list. Whether Yandex refunds click fraud does not apply to a payout to a partner.

How to mark spam in Metrica

The help for uploading a CRM into Metrica gives five order-status types. "Spam order," default identifier SPAM, reaches the goal "CRM: Spam order." Next to it are "Order created" (IN_PROGRESS), "Order paid" (PAID), "Order cancelled" (CANCELLED), and "Order in another status" (OTHER), if you pass the identifier of your own "goal event" goal. In the help's example a qualified lead is a separate goal passed after a conversation, not the moment the form was submitted.

The uploading side sets the SPAM status. On this page Metrica does not promise to recognize spam in the lead text by itself. If a partner pours empty leads, the mark appears only after you decide to pass that status. Optimization that learns from "order created" at the moment of submit will learn from the fake as well, until you separate the qualified lead.

New accounts are not password guessing

OAT-019 Account Creation is mass creation of accounts, sometimes with a filled-in profile, through the application's ordinary registration, in order to abuse those accounts later. Among later purposes the page names spam, reputation, search optimization, reviews, and surveys. It says separately that these are new accounts: guessing and checking login-password pairs that already exist are other events, OAT-007 and OAT-008. The page does not describe how a particular site's registration works.

The order is this. First name the event by its aim: text, a metric, paid volume, or a new account. Then pass Metrica the status you set: spam on its own, a qualified lead after a conversation, not at the moment the form is submitted. A share of "how many of the partner's leads are fake" cannot be taken from these pages. It is not there, and the threshold has to come from your own review, not from a quote of the catalog.