Click fraud looms over Google, Yahoo

Click fraud is to Google and Yahoo what bird flu is to world health -- a problem that's manageable today, but could grow into a crisis without aggressive prevention efforts.

Silicon Valley's twin titans of the Internet era get almost all their revenues from pay-per-click advertising.

Advertisers hire Google and Yahoo to distribute the online equivalent of billboards that take people to the advertisers' sites. But advertisers pay only when someone is interested enough to click on their links.

There are several variants of pay-per-click advertising, but one form is particularly relevant to click fraud: affiliate networks.

Independent Web sites, known as affiliates, sign up with Google, Yahoo or smaller Internet companies and agree to let those companies place ads on the affiliates' Web pages. The affiliates then get a cut of any pay-per-click revenue.

Let's say I set up a Web site called Mike's Favorite Spots in Hawaii, where I regularly post news and tips about vacationing in the most beautiful place on earth.

I could sign up with Google's AdSense program and Google would place ads on my site. Google's computers would detect that my site relates to travel, and would place appropriate ads there.

Advertisers might, for example, pay $1 to Google for each ad clicked on my site, and Google would perhaps pass along 50 cents to me, the affiliate.

Everyone wins: I get advertising revenue, Google gets paid, and travel advertisers reach a relevant audience.

But a criminal could set up a fraudulent Web site and look for ways to generate phony clicks on the ads. The criminal collects ill-gotten gains, while advertisers are paying for worthless traffic.

That's click fraud, and it can be very lucrative.

But if it ever becomes rampant -- say, half of all pay-per-click traffic -- the business models of Google and Yahoo could collapse as advertisers walk away or spend drastically less money.

There's no reliable evidence suggesting click fraud is anywhere close to epidemic proportions, and Internet companies have already figured out how to block unsophisticated forms of click fraud.

But Google and Yahoo aren't sharing enough information to tamp down rising concerns about click fraud.

Among the recent news fueling advertiser anxiety:

Mountain View-based Google last month agreed to settle a class-action suit on click fraud by providing $90 million in credits to advertisers. That's a pin prick for Google, which reported profits of $1.5 billion in 2005, but more lawsuits against Google and other Internet companies are pending.

Sunnyvale-based Yahoo was accused earlier this month of failing to catch at least a few spyware companies -- peddlers of software that forces ads onto the screens of unsuspecting users -- who are simultaneously engaging in click fraud.

Ben Edelman, a graduate student in economics at Harvard University who also has a degree from Harvard Law School, uncovered the spyware-click fraud connection. Last week, he told me Yahoo gave him a written response that it will look into the matter. But Edelman said Yahoo isn't willing to concede there's any broader problem with its affiliate programs.

Also in March, federal prosecutors in San Francisco announced the latest in a string of click-fraud criminal indictments.

The arrests highlight a bigger problem created by click fraud: Scammers are secretly taking control of hundreds or even thousands of home and business computers, setting up what are called ``bot nets.''

Bot nets were initially used for extortion, by threatening to overwhelm Web sites with traffic if they didn't pay up, and for stealing credit cards and other personal information. But click fraud is now emerging as another motivator for bot-net criminals.

Despite these red flags, Google and Yahoo are hiding behind a ``trust me'' defense. They keep insisting click fraud is under control, without giving details.

``We have said for some time that we believe we manage the problem of invalid clicks very well,'' said Nicole Wong, Google's associate general counsel, in announcing the class-action settlement.

Google notes, with some justification, that many so-called experts who claim as much as 30 to 40 percent of all pay-per-click traffic is fraudulent are trying to sell consulting services or software to stop click fraud -- giving them an obvious incentive for overstatement.

Yahoo spokeswoman Gaude Paez told me last week that, ``the rates of click fraud that many software providers claim exist are highly inconsistent with the rates we see on our network.''

But neither company is willing to say what percentage of pay-per-click traffic they are flagging as fraudulent, or the total amount of refunds they're giving advertisers who claim click fraud.

If click fraud really is a small problem, releasing hard numbers will prevent advertisers from getting any more nervous than they already are.

If click fraud is a significant problem, advertisers -- as well as investors in Google and Yahoo stock -- have an ethical and legal right to know.

Both companies, to their credit, say they are considering whether to release more information and might be willing to accept independent third-party audits of click fraud.

As long as any bad clicks are getting through Google and Yahoo's filters, advertisers clearly need more information -- if only so they can direct their dollars toward companies doing the best job of detecting click fraud.

So if Google and Yahoo don't start sharing more click-fraud information voluntarily, unhappy advertisers will probably force them to do it anyway