When a risk manager says «we have ATO» and a marketer hears «an unclear word» — the business loses money. Not because there is no protection, but because teams do not speak one language.

This glossary closes a basic gap: key terms everyone who works with digital traffic, ad budgets, or online payments should know.

🔐 Financial and transactional fraud

BIN attack (BIN Attack)

What it is: automated brute-force of bank-card numbers.

BIN is the first 6 digits of a card, which identify the bank and product type. They are not secret: databases of them are publicly available. The fraudster knows the BIN and, with scripts, brute-forces the remaining digits, expiry, and CVV — thousands of combinations per minute.

How it looks in practice: an online store suddenly receives hundreds of micro-transactions of 1–2 rubles from different cards of the same bank. These are not buyers — this is brute-force. The attack's goal is to find live cards for later cash-out.

Why it is dangerous for the business: besides direct losses, a BIN attack leads to fines from payment systems for exceeding the allowed share of failed transactions.

Chargeback

What it is: a forced return of funds to the buyer through the payment system — bypassing the seller.

The mechanism was created as consumer protection: if the goods did not arrive or the card was used without the owner's knowledge, the bank returns the money. The seller then loses both the goods and the amount, and also pays a fee for the chargeback itself.

The dark side — Friendly Fraud: the buyer received the goods, was satisfied, but calls the bank and says «I did not order this». The bank sides with the customer. The seller is left with nothing. According to Chargebacks911, up to 86% of chargebacks in e-commerce are exactly friendly fraud, not real third-party fraud cases.

Botnet

What it is: a network of infected devices remotely controlled by an attacker.

It can include thousands of computers, smartphones, and IoT devices — their owners often do not suspect that their gadget is executing someone else's commands.

Botnets have several uses: DDoS attacks, credential stuffing, and — especially relevant for advertising ecosystems — click fraud. The botnet clicks banners, the advertiser pays for each click, the report looks decent — and there is not a single live person behind the traffic.

Skimming and Shimming (Skimming & Shimming)

What it is: physical methods of stealing card data.

A skimmer is an overlay on an ATM card reader that reads magnetic-stripe data. A shimmer is a microchip as thin as a human hair, inserted inside the slot and intercepting chip data.

Their online counterpart is — Magecart attacks: injecting malicious JavaScript onto the checkout page. While the buyer enters card data, the script quietly copies it and sends it to the fraudster.

📢 AdTech fraud: advertising schemes

Ad fraud is a separate ecosystem where money leaks quietly and methodically. Budgets are charged, metrics look normal, reports look good — but there are no real buyers behind the numbers.

Click fraud (Click Fraud)

What it is: imitation of clicks on ads using bots or device farms.

The most common type of advertising fraud. The advertiser pays for each click — and pays for emptiness. Modern bots can reproduce human behavior: random pauses, scrolling, mouse movement. A simple IP check no longer works — you need behavior analysis at the full-session level.

Click Injection

What it is: mobile fraud in which a malicious app «inserts» its click at the last moment before install — and takes the attribution.

The scheme works like this: a malicious app installed on the user's smartphone tracks signals that other apps are being downloaded from the store. At the right moment it generates a fake click from a real device — the attribution system decides that this source brought the user, and pays a commission to the fraudster.

Why this is dangerous: the victim is a real user, the device is real, the install is genuine. Detecting the fraud without analyzing timing patterns between click and install is practically impossible.

SDK Spoofing

What it is: imitation of mobile app installs without a real installation.

The fraudster intercepts traffic between the mobile app and the attribution system (MMP: AppsFlyer, Adjust, Branch) and replays signals of legitimate installs at industrial scale. There are no real users — only a stream of fake events, and the advertiser pays for each one. Threat scale: one infected server can generate thousands of fake installs per hour.

Ad Stacking

What it is: several ad banners stacked on top of each other in one ad slot.

The user sees only the top banner, but an impression is counted for all layers at once. Each advertiser in the stack pays for an «impression» that nobody saw. A simple scheme with large damage.

Domain Spoofing

What it is: selling cheap ad inventory disguised as premium placements.

The fraudster takes part in RTB auctions, putting an authoritative domain in the bid request — for example, forbes.com. The advertiser pays at top-media rates, while the ad actually shows on an anonymous site with inflated audience.

Pixel Stuffing

What it is: a 1×1 pixel ad banner — invisible to the user, but counting as an impression.

Technically the ad is on the page, the impression counter fires, the CPM budget is spent. In fact nobody sees the ad. Used on sites with a large volume of pages.

Geo Masking

What it is: spoofing traffic geolocation — cheap traffic from one country is passed off as expensive traffic from another.

The advertiser buys audience from the USA or Western Europe at matching rates. In fact they get traffic from low-cost regions — via proxies, VPN farms, or infected devices. There are no conversions.

Cookie stuffing (Cookie Stuffing)

What it is: fraudulent substitution or hidden adding of affiliate cookies into the user's browser without their knowledge.

Affiliate programs work on a «last click» principle: whoever last brought the buyer gets the commission. A cookie stuffer injects their affiliate ID into the victim's browser in the background. When the user makes a purchase on their own, the system «thinks» the fraudster brought them.

Invalid Traffic / IVT

What it is: any traffic in ad systems that is not a real interaction of a live user with the ad.

IAB and MRC split IVT into two levels:

• General IVT (GIVT) — known bots, search crawlers, monitoring services.
• Sophisticated IVT (SIVT) — advanced schemes: botnets that imitate humans, device farms, click injections.

🛡️ Protection tools: terms worth knowing

Device Fingerprinting

What it is: a technology for identifying a device by a set of its characteristics — without using cookies.

The system collects parameters: browser version, fonts, screen resolution, time zone, GPU behavior. Together they give a unique «fingerprint» that lets you recognize the device even after an IP change or cookie clearing.

Phishing-as-a-Service (PhaaS)

What it is: ready-made infrastructure for phishing attacks for rent.

For a few dozen dollars a month the fraudster gets an exact copy of a bank or marketplace interface, a victim-management panel, and automated mailing. No technical knowledge is needed. This has become the main driver of growth in account-takeover (ATO) attacks.

Why it is important to know this

Antifraud is not only a technical task. It is a shared language between marketing, security, and finance. When the team understands how cookie stuffing differs from click fraud, and SDK Spoofing from Click Injection, it becomes possible to build real protection: not reacting to consequences, but preventing losses at the entry point.

«Understanding antifraud terminology lets a business move from reactive protection to proactive. When a specialist can tell classic carding from synthetic identity — they can tune rules precisely and keep conversion».