DoubleVerify’s Fraud Lab has uncovered a new connected TV advertising fraud scheme which causes screensavers to hijack CTV devices to generate impressions — even when the screen is off.

The scheme, dubbed “SmokeScreen,” operates through fraudulent apps that offer screensavers to users. SmokeScreen primarily targets users with external CTV devices, like gaming consoles or streaming sticks, which are not built into the CTV console and need a separate power source from the screen or TV itself. Even after a user has turned their TV screen off, the CTV device remains on. This is how SmokeScreen is able to continue serving ads using falsified data, even after a user had stopped watching their TV. 

"CTV ad fraud doesn’t just impact advertisers,” Roy Rosenfeld, head of DoubleVerify's Fraud Lab, said in a statement. “It’s harmful for the entire ecosystem — siphoning revenue from high-quality CTV publishers and app developers, as well as streaming platforms.”

DoubleVerify’s Fraud Lab estimates that so far SmokeScreen has impacted nearly 10,000 devices daily and generated up to 10 million fraudulent requests each day. With CTV CPMs — the cost to reach 1,000 views — averaging $20, and with SmokeScreen generating more than 300 million ad requests each month, that adds up to over $6 million in false impressions. 

There are a few factors that make CTV ripe for ad fraud. First is that the CTV landscape is fragmented by different platforms and publishers. CTV is also shifting from manual buying to programmatic, making it harder for marketers to know exactly where their ads are running. As viewership has skyrocketed from the pandemic, the high CPMs make CTV more attractive to marketers, as well as fraudsters. U.S. upfront ad spending on CTV is forecasted to reach $4.51 billion in 2021, up from around $3 billion last year, according to a May 2021 report by eMarketer. 

This is not the first time CTV ad fraud has occurred. SneakyTerra was a server-side ad insertion scheme that purchased a real impression and then inserted impression trackers from multiple ads, obtained through spoofed ad server calls, into one creative. When an actual CTV device received this response, pixels fired for all the impression trackers — meaning that even though only one ad was seen, impressions for multiple ads were generated. Another scheme, DiCaprio, spoofed mobile app ad requests to look like they were coming from a Roku device. StreamScam was one of the largest scams that spoofed more than 28 million U.S. households to make advertisers believe their ads were reaching streaming devices.