Protecting Your Google Spend From Fraudulent Clicks with Neil Andrew of PPC Protect

Andy Splichal  0:02  

Hello, and welcome to the Make Each Click Count Podcast. This is your host, Andy Splichal. And today I am being joined by Neil Andrew of PPC Protect. Now before we dive into today's topic, including what  PPC Protect is and what it does. Can you take a few minutes and tell us about yourself and and the history behind PPC protect?

Neil Andrew  1:16  

Yeah, sure. So thanks for having me. First of all, really nice to be here. So in terms of the history behind PPC Protect, we were founded about five years ago now. We are a team of four founders, initially, very distributed team and four founders. So we've got a founder in Tennessee in the US, we've got here UK, where I am. And we've also got one over in Israel. And our background really leads us perfectly to the industry that we're in, which I'm sure we'll touch on very shortly. So two of us used to run a performance marketing agency, specifically within the PPC space. And two of us also worked in a cybersecurity background. So one of those was enterprise network cybersecurity, and the other one was cybersecurity within the military, in the Israeli military, specifically. 

Andy Splichal  2:04  

Well, wow. 

Neil Andrew  2:05  

And those two, yeah, so it's quite quite advanced, shall we say? Those two co founders that worked with us who were on the cybersecurity side, they were actually clients of ours, at the performance marketing agency. So the whole business, the whole solution was very much born out of that agency and out of the frustrations that they were experiencing as clients of ours. So it was very much building a problem ability, building a solution to a problem that we had ourselves first, and then rolling that out, obviously, across more people. So about two years ago, now, we mothballed that agency completely. We focus fully on PPC Project, we now have 14 stuff spread across four different countries. So we have a head office here in the UK, near Manchester, which is where the majority of our stuff are. And then we also have stuff in Israel, the US and France as well.

Andy Splichal  2:57  

That's very fascinating. Now, before we really get into it, more about you what's what's an interesting fact that well, fun fact that most people may not know about you?

Neil Andrew  3:08  

It's good when you put me on the spot a little bit. Most people don't know I don't want to speak to people, they don't realize that I am actually Scottish because I don't have the accent at all. I've been living down in England for so long. So that's that's something that yeah, I guess I guess often surprises people. On the marketing side, specifically, I actually used to be responsible for the PPC management and PPC budgets of at the time. The UK is largest Google Ads advertiser. So we were spending more money than anyone else at that time, whether they still are or not. I don't know if they've been there for about eight years now. But yeah, that's my claim to fame. I guess I was at one point managing the biggest Google Ads account in the UK. 

Andy Splichal  3:50  

Wow. That's, that's a great claim to fame.

Neil Andrew  3:55  

Google, all of it. Definitely. Yeah, they must love the amount of revenue you have driven to them.

Andy Splichal  3:59  

Sure. Well, you know, jumping into that so many of my listeners are also heavily into advertising using Google ads. Now, can you tell us quickly how how PPC works to identify fraudulent clicks?

Neil Andrew  4:12  

Yes, sure. So I'll keep it fairly top level for now. And then if you're interested, we can dive into a little bit deeper, we can go into more technical detail. But in terms of the solution that we have, in this solution that we've built, what we've done is we built an automated cybersecurity driven solution to stopping click fraud. So one of the reasons that we went down that route is when we were on the agency side, and we were trying existing solutions that were out there. We found that everything in that market, it very much takes an ad tech approach to things. So it very much very much looks at things like defining your rules, for example, and how that influences your campaigns. So do you want to block certain types of traffic as a blanket ban your rather than taking those nuances into account so a great example would be, Do you want to block VPNs, right? Well, actually, people might at first glance, think, oh, yeah, of course I do. Someone uses a VPN, they're obviously clicking my ads maliciously, that's not true. There's no reason that that needs to be malicious activity. If you go on YouTube, and you look at any video, these days, you'll probably see an ad for NordVPN, somewhere on there, they're advertising on everything. That's because VPN is so widespread now in legitimate usage. So there's a lot of legitimate activity coming from them, too. So those existing solutions that took that ad tech approach just didn't work. So we came at it from a completely different angle from the cybersecurity angle. The way that we implement that is when someone makes a click on an ad that is protected by PPC protect, we analyze the data associated with that click in real time. So we have hundreds of parameters that we look at that we cross reference against our own internal databases, and that we do that real time analysis on. And if enough of those metrics sit outside the mean, so they sit outside the average, you'd expect, that flags that something isn't quite right about this activity. So it could be anything from the very basic end click frequency, and I'll touch on that more, a bit later on. But from click frequency, all the way up to things like spoofing device ID, spoofing, browsers, spoofing locations, that type of stuff. So we look at all this information together. And when the system then makes a decision that the click is not legitimate, and the user is invalid, we block them from be able to see those ads in the future, we block any future activity from them. So you're not essentially paying for junk traffic, you're not paying for invalid traffic anymore.

Andy Splichal  6:30  

And just in case, some listeners might not know what what is a VPN?

Neil Andrew  6:35  

So a virtual private network is essentially a way to mask your IP address. So if you were, for example, worried about your ISP, snooping on your browsing habits, so your internet provider snooping on what you're doing online, or if you are, I guess, in a very basic case, wherever you're at work, and you know, work blocks, Amazon from the work network, because you don't want to be better when you're shopping on Amazon. During that time. If you use a VPN, you can get around that block, because you're changing your IP address. And so essentially just changing the address of your of your computer itself, there is a lot of legitimate uses for them to so a lot of people that work in corporate networks will use VPN to connect to internal secure networks and that sort of thing, but don't want to get too high level into the technical side of it.

Andy Splichal  7:21  

Sure, sure. Now, I see in your system that you have fraudulent, and then suspicious clicks. So how do you tell the difference between those? 

Neil Andrew  7:32  

Yeah, we do. So it's two different are the two primary buckets if you like. So, we do have legitimate as well, obviously, which means that we're not taking any action within the two primary buckets of activity that we monitor are those suspicious fraudulent for suspicious clicks essentially means that when our systems analyze that data, we've detected that enough metrics lay out with maintained enough metrics don't quite add up to say that something isn't right about this activity. But it's not yet done it to a point where it's statistically significant enough for our system to say this is fraud. So to take a very, very basic example on that, there may be repeated click patterns, that could be indicative of competitive activity. But the system doesn't have enough information to say that those repeated click patterns are definitely fraud. They just don't quite add up. Yeah. fraudulent activity means that the system has enough data to sufficiently determine that it is actually fraudulent. So we have very, very confident that this is fraudulent activity. And therefore, we blocked that traffic in real time. So when it's fraudulent, it can't see your ads anymore. It can't interact with them across whatever campaign type you're using within Google ads. When it's suspicious, we haven't looked at it yet. We're just monitoring it very closely. And we're going to see what happens with it in the future. If we get some more information that allows us to make a more informed decision, then we can move it either to being legitimate if it's a real user, or to fraudulent if it does, indeed appear to be fraudulent.

Andy Splichal  9:02  

Okay, so fraudulent, you've already blocked suspicious here you're thinking about it?

Neil Andrew  9:07  

Exactly. Yeah, that's in basic terms. Yeah, suspicious means that we're thinking about it. But ultimately, what we don't want to do is we don't want to block traffic that might not quite look right, but could end up converting and being a high value conversion. If you're blocking someone who could spend $10,000 That's, that'd be a nightmare.

Andy Splichal  9:26  

Now, what about automatic traffic or bot traffic?

Neil Andrew  9:31  

Yeah, so. So we do stop bot traffic, in terms of how we determine between different types because there's a lot of different types of bot traffic out there. So you've got targeted bots, where someone, for some reason really doesn't like you. It could be a competitor. That's the most common case. And they have set up a botnet a bot network to specifically target your ads. So to put that into some context, if you have $100 and you have access to with either the dark web or you speak Russian, and you can hit up some of the Russian forums out there, then for $100, for one day, you can hire a botnet that will tell your competitors Google Ads offline. It's that simple. And when you think about, well, $100 might seem a lot, but actually, if your competitors driving $10,000 of business through their ads account every day that has a massively damaging effect. So we stopped those types of attacks. And we also stopped things like automated click farms. So they're in a much larger scale, they're not targeting us specifically, they're just clicking ads in general, either to scrape for information, or to do it on the publisher sites. So I'm sure some of your listeners are familiar with the AdSense network where the publisher receives a percentage of the click, and Google gets a percentage of the value of the click. So there's a lot of click fraud on that site. With display ads, in particular, where publishers are making quite a lot of money by spoofing these clicks with automatic automated bots, in terms of how we determine if it is a bot, or isn't it there's various different characteristics that we can take into account. But at a basic level, you're looking at things like the user agent, which is essentially, the browser itself, saying, This is what I'm running on. So you have browsers that you would extend to us, and then you have browsers that humans definitely wouldn't use. So something like a headless browser, and again, not to get too technical, but a headless browser essentially renders the code that renders attacks, but you can't actually see anything, well, a real user wouldn't use that, because you don't see anything on your page, you don't see anything on your screen, so it'd be completely useless. So at a very basic level, we can do that. But then when we start getting into the more advanced detection, we have to be a lot more clever, if you like in how we're detecting these things. So we have to start diving into things like network analysis, the health of the IP and the network range, the history of it, cross referencing it with various pieces of data in our database, and then doing that real time analysis as well, on things like what plugins do they have installed? What fonts do they have installed, you know, all these things can give you a probability that someone is a bot, or there's someone is human, if you've ever used the reCAPTCHA service, so you ever had one of those boxes that you have to tick that says, not a robot. It's essentially a very, very similar process to that.

Andy Splichal  12:13  

Well, that's, that's scary, especially the, to have competitors hire a Russian programmer to take you off line there for 100 bucks.

Neil Andrew  12:20  

Yeah, I mean, it's, it's one of those things that when you say it to people, they go, No way, that doesn't happen. No one would do that. And then yeah, we should show people the screenshots of the forums, we can send them the URLs. And, you know, there is if you want to hire and you've got enough Bitcoin to pay them, then go wild. So it absolutely exists out there. And people are generally quite shocked when they realize that.

Andy Splichal  12:46  

Now the fraudulent clicks in general, how big of a problem is that to? You know, let's say the average ecommerce company or I don't know, average, but you know, the ones spending a couple grand a month on their ads?

Neil Andrew  12:58  

Yeah, so it's, I mean, for the industry, in general, it's, it's a massive problem. It really is a it's kind of the silent killer, if you like no one is talking about this, which is absolutely bizarre, because the studies show that this year, there's been $25 billion lost by advertisers to click fraud. And by 2024, that's gonna be $50 billion double in four years when there's a massive amount of money that we're talking about here. And people just aren't taking the action that needs to be taken to stop it. In terms of Ecommerce advertisers, specifically, we see that shopping campaigns, which are by far the most used by Ecommerce, advertisers, they say on anything from about 10 to 12%, fraudulent activity, that's going to vary by which industry you're in, but as a baseline, that's kind of what you're looking at Search Ads. Say it again?

Andy Splichal  13:49  

No, I'm sorry. So 10 to 12%. You think?

Neil Andrew  13:51  

So 10 to 12% on shopping? Yeah, absolutely. Search Ads varies massively by industry. So ecommerce search ads, you're looking at a lot of brand name, very cheap clicks on brand name, generally quite low fraud percentages, you're probably looking at five to 8%, somewhere around there. If you're running display campaigns, so whether that's dynamic remarketing, for example, or if you're running prospecting campaigns on the Display Network, then you're looking at massive amounts of fraud. So we had one client with us who is spending three quarters of a million dollars a month, $750,000 a month, purely on display advertisements. 88% of that activity was fraudulent. 

Andy Splichal  14:32  

Wow.

Neil Andrew  14:33  

That's humongous  amounts of money. And yet we have people coming to us saying display campaigns don't work. We don't want them anymore, because they're just useless. Well, actually, they're not they're incredibly valuable if you get them right and you get the traffic, right. And that's the key thing. Really, if you're spending 80 90% of that spend on fraudulent traffic then obviously you're not getting results because there's so much money being wasted. But display is is by far a biggest, then shopping and then Search Ads. 

Andy Splichal  15:04  

Okay, great. Now, what would you say to those advertisers out there who say, Well, Google automatically provides credit for fraudulent traffic? So why should I bother signing up for a service like PPC Protect?

Neil Andrew  15:20  

Yeah, it's a good question, because it's probably the most common question that we get asked by people seems to be a very common one out there. So yeah, our stance on this is that Google aren't ignoring this issue. And we're not pretending that they are okay. We're not saying here that Google do nothing, and that they're totally useless. And you need our solution, we're going to solve all your problems. That's not who we are. That's not the kind of company that we are. And we can see from credits, like you say that Google provide on invoice statements and invalid activity adjustments, that there is something there that's kicking into, provides small amounts of refunds small amounts of spent back and it is generally very small amounts of spend, they get given back, I think what it ultimately boils down to is two things really, a they can't handle this on their own, this is an industry wide problem, we're not just talking about Google potentially being an issue here, we're talking about the entire digital media ecosystem. So it really is an industry wide problem. And even a company the size of Google can't handle that on their own. But following on from that, we really have to look at is this a priority for the ad networks to tackle or have they got bigger things on their plate and other areas that they could better invest their funds in. And looking at it from perhaps somewhat of a cynical point of view, but an ad network, whichever ad network that may be when an ad networks goal is to generate revenue. Ultimately, no matter who's clicking an ad, no matter where that comes from, via a competitor, be it a botnet or some sort of malicious user, the network is still being paid. Now it is in the network's somewhat interest to limit that amount of fraud because they don't want people buying traffic on a network that's very, very fraudulent, because no one's gonna buy that traffic anymore. But it's also against their revenue goals, to start refunding people for clicks to start really filtering that out. So I do think there is a bit of a disconnect there, perhaps I'm not saying by any means that Google are doing that maliciously, or with any sort of intent. I don't think that's the case at all. I think it's just not a priority for them. And we see it from the systems that they have in place. We've had clients come to us who've had for seven days straight CTR on some of their ad groups of seven 800% with hundreds of clicks. That's not normal. And yet, they're still being built for these. So we can see that the systems aren't working as intended that they are failing. And that's exactly what we are there to help with. And that's what we're there to protect.

Andy Splichal  17:43  

Well, I gotta say, that's a great sounding click through rate.

Neil Andrew  17:46  

Yeah, I mean, if I'm betting, if it's converting, I'm fantastic. But unfortunately, it doesn't convert.

Andy Splichal  17:52  

Sure. So I know, sounds like you're all over Google. Now, are you just monitoring Google traffic? Or do you do any other networks?

Neil Andrew  18:02  

So we monitor Google Search, Google Shopping, and Google Display. We also do, we offer data protection on all of those as well. So we did the blocking of traffic and the IPs. We also offer monitoring on the services on Discovery campaigns, YouTube campaigns and app campaigns. So we don't do the act of blocking on those just because of how Google has set that system up, it is not possible to block traffic on them. But by having the monitoring, we can provide reports for people to go back to Google to say, on my app campaign, or on my YouTube campaign, you billed me for this, but my verification provider says this, this and this doesn't add up, and then they can open that conversation with them about getting some sort of refund beyond the Google ecosystem. Let's just say I can't say much right now. Take of that what you will. But I can't really expand beyond that.

Andy Splichal  18:49  

Oh, all right. Well, that sounds like something might be coming, huh.

Neil Andrew  18:53  

Well,

Andy Splichal  18:56  

So if somebody is interested in your service, and and testing it out, I know you you offer a 14 day trial. Now that is that for that's for complete access? Or how does that work?

Neil Andrew  19:07  

Yeah, so 14 day trial, completely free access, you get total access to the platform, you'll also be partnered with one of our customer success specialists here. So they will offer to go through an initial onboarding session with you. And then they'll be on hand throughout that trial to really deep dive into that data. So some of our customers come on, they sign up, they see the results, and they think great, perfect, love it. You know, that's it don't need any more sort of interaction with us. And they just leave it to do his thing in the background. Or the customers really want that deep dive into the data or they want to know, why did you take action on this specifically? Or what was it about this that caused it to be flagged up? So that's where our customer success team come in. We can provide the raw data exports from our database. Depending on how technical you want to get, we can give you full log level analysis and data visualization or if you want to keep it simple. We can just give you some top level reasons of why certain actions were taken but we're there sort of on hand if you like to dig into that data with you, and to help you get those insights into why we're doing what we're doing.

Andy Splichal  20:07  

Okay, great. And then after the trial after the 14 days, how, how does your pricing work?

Neil Andrew  20:13  

So we have two different methods of pricing if you like. So, if you're spending under $40,000 US dollars per month, on your Google Ads campaigns, then we have a number of fixed plans that work within that. So for example, if you're spending up to $10,000 a month, it costs you $70 a month for protection. If you're spending 10 to 20,000, it cost you $130. And so if you go over 40,000, then that changes to a percentage of your media spend. So depending on how much spend, you're putting through the system, how much spend you want to protect, that determines what percentage point we would then build that up.

Andy Splichal  20:51  

Okay, that makes sense. And besides the 14 day trial, do you have any other special offers or incentives going right now, somebody might be on the fence, but just trying to figure out if they'd like to give PPC Protect to try or not?

Neil Andrew  21:06  

Yeah, we do. So if anyone is a nonprofit who signs up, nonprofits have a flat 50% lifetime discount across all of our pricing options. If they are not a nonprofit, then we do have a 20% off for your first three months offer. All you need to do is during the trial process, reach out to your account manager reach out to our support team and just mentioned that you've heard me talking about this. And then we will apply that onto your account. And that will give you 20% off for the first three months.

Andy Splichal  21:33  

Oh, great. Well, that's a that's awesome. Thanks, Neil. Now, is there anything that I might have obviously overlooked, you can think of?

Neil Andrew  21:42  

Nothing that that really springs to mind? I mean, I guess from your listeners point of view, if they're thinking well, do we have fraudulent activity, or we're not sure if there's any fraud in our ads, we would always say, sign up for a trial, connect your ad accounts. And you'll get that auditing in real time. And the way that we do business as a company is very open, very transparent. We are not afraid to go to our trial users and say, Don't give us money. There's no point in using this. You're not being hit by fraud. In a way, that's the best case scenario. You know, we don't want to see our users suffering from fraud. So I would say, hook up your accounts, try it out. We're always on hand for any questions you've got. And if it's saving you money, it's fantastic. It's a great investment for you. And if it's not saving you money and you're not being hit by fraud, then we would absolutely tell you that.

Andy Splichal  22:28  

Well, that definitely sounds like a no lose proposition.

Neil Andrew  22:32  

That's the idea. Yep. That's the idea.

Andy Splichal  22:35  

Cool? Well, that's great. Well, thanks for joining. That is it for today. So remember, if you liked this episode, please go to Apple podcasts and leave a five star review. If you're looking for better results with their Google ads by avoiding fraudulent clicks with their Google advertising, go ahead and sign up for a trial to PPC Protect or take advantage of the 20% discount that Neil had offered. Neil's also just joined the Make Each Click Count Facebook group. So if you have any questions directly for Neil, feel free to ask them in there. And if they wanted to contact you, they just go to ppcprotect.com? Or is their phone number what what's the best way to do that deal?

Neil Andrew  23:15  

Yeah, so the best way would be ppcprotect.com. And we do have phone numbers for various locations around the world depending on where you're in. So we have us phone numbers. We have a call center here in the UK. And we also have representatives over in Australia. So anywhere that your listeners are we're on hand in and waiting to take their calls. I'm also open to talking to anyone directly and my emails are always open can be reached at Neil at ppcprotect.com. So if anyone has a question about click fraud in general, or even just a Google Ads question in general, always happy to share those insights and that expertise.

Andy Splichal  23:49  

Well, great. Well thank you again for joining us. And that's it for today. Remember, listeners remember to stay safe, keep healthy and happy marketing, and I will talk to you in the next episode.