Follow Slashdot blog updates by subscribing to our blog RSS feed


Forgot your password?

Google's Click-Fraud Crackdown 201

An anonymous reader writes "Wired reports that Google is making some effort to put a crack in the practice of click-fraud. Because of the pernicious abuse of the company's advertising business, it simply can't be sure that anyone is actually looking at the ads. Bruce Schneier talks about the problems of ensuring that people are really people, and Google's solution." From the article: "Google is testing a new advertising model to deal with click fraud: cost-per-action ads. Advertisers don't pay unless the customer performs a certain action: buys a product, fills out a survey, whatever. It's a hard model to make work — Google would become more of a partner in the final sale instead of an indifferent displayer of advertising — but it's the right security response to click fraud: Change the rules of the game so that click fraud doesn't matter."
This discussion has been archived. No new comments can be posted.

Google's Click-Fraud Crackdown

Comments Filter:
  • that's bad (Score:3, Insightful)

    by doti ( 966971 ) on Thursday July 13, 2006 @04:10PM (#15714483) Homepage
    That way, Google will want to enforce it's ad (avoid ad blockers, make them more visible, etc) even more.
    • Re:that's bad (Score:3, Insightful)

      by emurphy42 ( 631808 )
      But people are generally a lot less concerned about blocking Google ads, because they're Not Evil. Google knows this, and will make a strong effort to keep it that way.
  • by truthsearch ( 249536 ) on Thursday July 13, 2006 @04:10PM (#15714485) Homepage Journal
    CPA is a good model for Google and a very good model for advertisers. Advertisers, in effect, can pay for only the advertising which results in a sale.

    Small publishers, however, will likely suffer. The vast majority of click-throughs on text ads result in no sale. Yet publishers still get paid for it. The only way this would balance out would be for the payment to publishers per action to go up. That would be fair. But I think the small bloggers who like to use adsense will lose revenue from this model.
    • It is also a great model for extending one's monopoly in one area (search and per click advertising) into another (payment processing).
      • by RidiculousPie ( 774439 ) on Thursday July 13, 2006 @05:12PM (#15714843)

        What monopoly in search? Google has less than 50% [] of the market for search, and they have a significant competitor in Yahoo search marketing (used to be called Overture) not to mention the banner ad people such as doubleclick, although I couldn't find any comparison of the services relative market share.

        Google has not attempted to artificially raise the barrier to entry of the search market, unless they are involved in something i am unaware of, you can get some clever people together, some big hardware and a gigantic pipe and make your own search engine or pay per click advertising. Same for payment processing; Google are not engaging in dumping of Google Checkout, it is infact more expensive than it's biggest rival Paypal.

        (Full disclosure: I have used paypal to pay for things, google & yahoo to search, and I block all adverts with adblock plus and filterset.g)

    • by eln ( 21727 ) on Thursday July 13, 2006 @04:18PM (#15714533)
      Driving direct sales is only a small part of what advertising is really for, though. Advertising is also about creating mindshare for your brand. Just because I don't immediately go and buy something from you when I see your ad doesn't mean I won't eventually buy from you as a resuly of seeing that ad. In this case, seeing the ad has convinced me to choose your brand when I am ready to buy, even if I don't buy right when I see the ad. This is effective advertising.

      By ignoring this type of advertising, Google is basically giving it away for free. Sure, it's good for advertisers, but I'm not so sure it's good for Google.
      • True, but most of google's ads are NOT about mindshare. They are small companies trying to get you to go to their webpage and buy something. Not notice a new product.
        • True, but most of google's ads are NOT about mindshare.

          Semi-true, but definitely arguable. A strong support in your favor is that most google ads are text based instead of image based. Going to a site 50 times and seeing the word "Ford" will not produce the same effect as seeing the Ford logo 50 times. Google's ads don't really create brand recognition, so I agree with your point.

          This is where online advertising has deviated significantly from *most* other forms of advertising. Other ads are in place
      • Driving direct sales is only a small part of what advertising is really for, though.

        I once saw an interview with A-B's NASCAR liason. He was asked how much beer he thought they sold as a direct result of the $40 million a year they pour into stock car racing.

        He responded that as far as the company knew their sports sponsorship did not have a direct impact on selling a single can of beer, but that wasn't the point, because advertising in expectation of driving sales is only a subdivision of marketing (and in
        • even though the beer itself obviously comes from an over hydrated horse with sugar (ok, I added that last bit myself).

          Let me get this straight -- are you saying they *don't* give sugar to the beer horse?
    • by TopShelf ( 92521 ) on Thursday July 13, 2006 @04:19PM (#15714541) Homepage Journal
      The biggest problem is tracking the click through to the action verifiably. Once a user clicks and ad and goes to WidgetsForSale.Com, the WidgetsForSale folks would need to track their activity and determine whether a sale results (q: within how long?), and report those sales results to Google so they can pay for the ads. That doesn't sound like a very tenable model - it relies on the WidgetsForSale folks tracking data and reporting to Google how much they should pay, rather than Google billing them.

      The only way I could see that working is with mandated use of the Google payment system perhaps, so they could generate some link between ad clicks and purchasing activity. That seems a mighty steep hill to climb, however...
      • by Daniel_Staal ( 609844 ) <> on Thursday July 13, 2006 @04:26PM (#15714582)
        Actually, Google has a better solution for that. If the transaction is online, you can embed a small piece of HTML/Javascript code in your 'thank you for purchasing' page that allows Google to check the value of a cookie they placed on a customer's computer when they clicked an ad.

        The cookie links the click to the sale. And there is value to the advertiser as well: Google can then help you track which ad resulted in a sale, and which keywords it was linked to. (So you don't have to buy an expensive but poor-return keyword.)

        (I may be mis-describing: Check Google's docs to be sure.)
        • I hope you're misdescribing, 'cause that's a really bad solution: anyone who refuses third party cookies or ad cookies doesn't get counted...
        • What about this scenario:

          You are in the market for Widget X. While on a website about all things Widgety, you see an Adsense ad for a certain brand of Widget X. You click on it, you like it, and bookmark the site. Because you are a smart consumer, you shop around trying to find the best value for Widget X. Upon completion of said research, you decide the original site (the one found with adsense) is the best deal, and you go to that site and purchase (this is now a week later than the original click-
        • In that scenario, what is the advertiser's incentive to properly report all sales to Google? If I have 100 clicks on my ad that resulted in sales and if I pay $1 per click, I can report all 100 and have to pay $100, or I can just say "oh, only 10 resulted in sales" and only pay $10.

          If they force advertisers to use Google's Checkout system they could enforce it better but I think that's dangerously close to "leveraging their monopoly to get into new markets" that we like to chastise Microsoft for.
          • 1. The complexity of not reporting all relevent sales to Google. (You'd have to recognize this was a Google sale, decide you don't want to report it, and generate a different HTML page based on that decision.)
            2. The value-added services Google gives from the data, which are worth nearly as much as the sale itself to some advertisers.
      • When Google bought out Urchin and turned it into Google Analytics [], they integrated it into their AdWords system. They'll tell you what Ad and search keyword got people onto the site and where they went once they got there. From there, you can define a series of hoops that you're looking for a customer to go through (say checkout -> credit card entered -> confirmed checkout) and it'll tell you how far people make it and correlate it to those Ads and keywords. Cool for webmasters, not so cool if your ti

      • That actually is a real website:WidgetsForSale.Com

        ( =org.mozilla%3Aen-US%3Aofficial_s&hl=en&q=WidgetsF orSale.Com&btnG=Google+Search)

        LOL!!!How funny- if you go to the website, it seems to be about "email marketing" techniques!!!*spam* LOL!

        I have to know, was this known to you beforehand and posted as warped humor, or as I suspect, you were just going for "generic website" as an example. If it was a warped sense of humor....Well Done!, if not,
  • Really. When I first read about web advertising 10 years ago, this was one of the models described. I think it was heavily used by some online bookstores where the website showing the ads would receive a percentage of that customers sale.
  • This approach may or may not solve click fraud, but it certainly doesn't solve the wider problem of proving that it's a human performing some action instead of a computer - and that one definitely needs to be nailed.

    There seem to be at least two alternatives - you could use a chain-of-trust type model such as TCPA to be able to remotely prove that [a] this packet is coming from [b] this program that is [c] digitally signed by this party who [d] asserts that it only accepts input from humans when run on [e

    • by Daniel_Staal ( 609844 ) <> on Thursday July 13, 2006 @04:19PM (#15714544)
      Who cares whether it's actually a human? What you really care is that they purchased your product. If the payment is tied to that, it becomes irrelevent who clicked or how they clicked.

      They spent money because of your ad. So you can afford to pay for the ad.

      And if an AI was the one who spent the money, great. As long as their credit card works.
      • Who cares whether it's actually a human? What you really care is that they purchased your product. If the payment is tied to that, it becomes irrelevent who clicked or how they clicked. They spent money because of your ad. So you can afford to pay for the ad. And if an AI was the one who spent the money, great. As long as their credit card works.

        This works now... but what happens when that scheme is broken?

        Step 1: Script buys product from ad link.
        Step 2: One minute later, script cancels said or
        • Technically, that is no longer Google's problem. That is the advertiser's.

          The company advertising has no reason to commit click-fraud. An AdSense partner who has ads on their site does, and your competitors do, but you don't. If you let people cancel their sale immediately via a scriptable interface, you've got bigger problems. (Yes, it should be easy to cancel a sale, but not that easy.)
        • Why would you report to Google that a product has been purchased any earlier than the completion of the transaction?

          If, at that point, you start to have trouble with people cancelling, that's easy: You require them to call in to cancel. You may find that in the real world, this is already the case, if you can cancel at all. By the time a bot can fake a phone call, we'll have other problems and solutions.

          I'm not sure if it's possible to reverse credit charges without a phone call, but again, if an automated
      • So the problem now becomes truthful advertisers? If they lie to Google ("no, that sale didn't come tru your ad"), what can Google do?

        Since Google has no control over the advertisers... Google just must believe what they tell Google.
      • by IamTheRealMike ( 537420 ) on Thursday July 13, 2006 @05:55PM (#15715047)
        It matters because not every advertiser on AdWords is actually selling something. So, cost per action ads even if fully deployed won't solve the problem for everybody.
        • As he said, fill out a survey or whatever. Add your own captchas, all up to you.

          Here's the problem -- how can Google implement this in such a way that they retain enough control to know whether the item was bought, survey was filled out, or whatever? What's to stop someone from just setting up a paypal donation link and calling that their "purchase", but then having the rest of the site be a sales pitch for a sale which is actually handled somewhere else?

          Google would have to take over the whole process of
    • The action they're going to track will typically be a sale. There will be no fraud if the only way to commit the fraud is to make an actual purchase. This is already how product affiliate systems work. If people click through an ad but don't buy a product the merchant doesn't pay. No one's going to write bots to automatically buy products which cost more than the advertising.
    • I actually don't see any real difference between the two "alternatives" you mention. Both of them boil down to proving that a request was generated by some (presumably tamperproof) hardware. That's fairly difficult, especially when you're transmitting your packets across a channel that can't be controlled.

      We actually already have these "proof of life" systems -- CAPTCHAs -- which are used with varying success on blogs and the like. They have weaknesses, but that's mostly weaknesses in a particular kind

    • This approach may or may not solve click fraud, but it certainly doesn't solve the wider problem of proving that it's a human performing some action instead of a computer - and that one definitely needs to be nailed.

      Actually, as computer power increases as well as the complexity of pattern recognition algorithms, this will be harder and harder to tell a human user from a computer.

      Eventually, we won't be able to tell the difference in 20 years or so...

      On the bright side, sentient computers might way to make
    • by Baloo Ursidae ( 29355 ) <> on Thursday July 13, 2006 @05:01PM (#15714776) Journal
      A better solution might be some kind of fingerprint reader that generates digitally signed "proof of life" which can be demanded by remote sites.

      To record an ad impression? Let me get this straight. You're honestly suggesting that users submit their fingerprint to verify they've seen your ad and you expect people to submit to this? Are you high?

      I mean, it's inconvenient, and invasive! Now if you can just find a way to make it really uncomfortable for the user while they're at it and you'll have achieved the prostate-exam trifecta that everybody shoots for when they want to pitch a new product idea.

  • Terrible Idea (Score:5, Interesting)

    by dada21 ( 163177 ) * <> on Thursday July 13, 2006 @04:16PM (#15714526) Homepage Journal
    I'm an AdWords advertiser and click-fraud means zero to me -- in fact, I don't care either way. All AdWords-advertised sites make a better profit from AdWords than one can believe -- it works. If even 10% of the clicks are fraud (I _highly_ doubt it), I don't care -- the profit is still better than most advertising campaigns.

    I also get a ton of impressions -- most of my ads have a click through rate of under 5%. Considering that 95% of the unclicked ads still form a brand impression, I'm even more satisfied (free advertising, basically).

    AdWords advertisers who complain are just idiots. I've run TV, radio, magazine and newspaper ads for years and never had this kind of ROI.

    I'm also an AdSense publisher, and I don't see what people bother with fraud. For the few bucks you make an hour trying to defraud the system, you can do a better job selling something online and using AdWords to drive business to you.
    • Mark Cuban has written an interesting article on his blog on who ClickFraud effects and how. []
    • Re:Terrible Idea (Score:5, Insightful)

      by karmatic ( 776420 ) on Thursday July 13, 2006 @04:49PM (#15714715)
      It depends on the term - it's easy to rack up $125/day for the right terms (mesotheliomatic cancer, anyone?). For a lot of people, that's a good chunk of money.

      All you need is an internet connection, some proxies, greed, and a "they're rich americans (because they exploit everyone else) so they deserve what they get" mentality.

      How do I know this? I'm an adwords advertiser, and I tracked down one of the site owners who was doing a fair amount of fraud on one of my terms. One of the proxies he used had an X-Forwarded-For header, and I found his IP in an IRC log, and finally managed to track him down on IRC. I pretended to be a fellow fraudster, and we compared account screenshots. The guy was very proud that he was making over $4000USD/mo. His sites were simply wikis with stolen content (it's easier to make pages for a specific term that way, I guess). He did the clicks himself, and had a proxy program that simply took from a list of proxies and picked a random one every page load. He actually sat there for several hours a day clicking, and made about $40/hour to do it.

      For some advertisers, it is a huge problem, especially when paying $10+ per click.
      • Re:Terrible Idea (Score:2, Interesting)

        by dada21 ( 163177 ) *
        Maybe that is true if you're attempting arbitrage, which to me is just as lame as clickfraud. Why would you be advertising for mesothelioma unless you're a shyster lawyer or trying fo arbitrage?

        Most terms I pay for are in the nickel to the buck range, and again, I set my advertising budget with about 70% of clicks not converting to a sale or an interested customer. The fraud is irrelevant for me and for almost 100% of the people I help in setting up AdWords campaigns.

        Congrats on catching the fraudster, th
    • You don't think click fraud is a problem? Check out []

      They have a variety of interesting 'services', including one where you can "Google Bomb Your Competition!"

      This sort of thing has successfully prevented me from even considering adwords or adsense. I get enough traffic from posting on blogs and slashdot :)
    • I hate adwords and avoid websites and businesses who make use of them. Adwords are more annoying than a banner. I think it would be intelligent to acknowledge your customers are conscious people who don't like to be bothered by your salemen. Instead of getting in their face with your ads, maybe you should create a site that attracts customers with good custmoer services, quality products and low prices? Nah, that would be too much like work.
  • Dangerous ground (Score:4, Insightful)

    by Rob T Firefly ( 844560 ) on Thursday July 13, 2006 @04:17PM (#15714530) Homepage Journal
    This could open up a big can of worms, precisely because it increases Google's stake in the actual buying process. The protests over ads for controversial stuff like religious or medical items, "adult" materials, political stuff, and so on simmer to a faint background hum when Google is just churning out automatic ads, but if Google can be shown to be taking part in the actual sales and transactions of this stuff their critics are likely to pounce on that. "OMG Google is selling evil pr0n/Satanism books/weaponry/GTA San Andreas/Online Gambling/etc..."
  • by RobertB-DC ( 622190 ) * on Thursday July 13, 2006 @04:19PM (#15714538) Homepage Journal
    TFA talks a lot about fraud, but what do you call it if I finish reading the article, and I click the nice linkies at the bottom with no intention of buying anything? What if I don't need a "Trojan remover download", credit report restoration, a work-from-home scheme, or (my favorite) to "Make Money With Adsense" with help from some outfit called cash-sense dot com.

    So if I do four shift-ctl-clicks (open in a new window, keeping current window active, I love Opera), am I a bored 'net surfer, or have I just committed Click Fraud? For the advertiser, is there really any difference?
  • by also-rr ( 980579 ) on Thursday July 13, 2006 @04:19PM (#15714545) Homepage
    ::Old-fart Now while Google's advertising is generally pretty inoffensive what's with the idea of putting adverts on anything that stands still long enough for the paint to dry? There are blogs running on $2/month webhosts that use AdSense. Just because it is possible to make money doesn't mean that it's an appropriate thing to do. It reeks of the same kind of greed that causes people to put lengthy disclaimers on their naff short stories or trivial programmes (copyleft excepted) just because they can't stand the idea of missing out on 5 cents. ::End
    • It reeks of the same kind of greed that causes people to put lengthy disclaimers on their naff short stories or trivial programmes (copyleft excepted) just because they can't stand the idea of missing out on 5 cents.

      Most of the time when I've encountered/used the above, it was more about the author wanting to keep their work from being sold by greedy strangers than greedily grabbing the nickels for themselves. Not everyone wants to find their stuff on eBaumsworld or something making ad-money for somebody e

    • Yeah! And it's horrible how they hold guns to your head and force you to visit their blogs, read their short stories and use those trivial program.
  • IP Block (Score:2, Interesting)

    by Anonymous Coward
    I would like to have the ability to see which IPs are clicking my ads and then be able to block them - i.e. my competitors and other random fraudsters.
  • Just charge for space just like the paper.

    Just needless complexity in the current system.

  • Wrong Direction (Score:5, Interesting)

    by SoupIsGood Food ( 1179 ) on Thursday July 13, 2006 @04:23PM (#15714569)
    This is headed in the wrong direction. The traditional role of the ad is to attract the eye, and get the consumer to consider and then remember the product when they want/need it in the future. Even if the ad isn't clicked on, the company advertising is getting itself noted and noticed, for free. That's the entire value of traditional print, radio, TV and billboard ads, just given away by web content providers. It's unreal, and is stifling the growth of online media. I suppose it's OK for enormous middlemen like Google, but it sucks for those making and maintaining websites. Advertisers have gotten too much of a free ride, and the models used to support this free ride... banner ads, popunders, flash ads, etc... have been largely self defeating.

    Making the burden on the content creator heavier and more onerous before they get their dollar is not the way to go. The middlemen and the ad buyers are getting too much for too little in return. New models need to be developed. I'm in favor of the old fashioned sponsorship: flat fee so it's a predictable expense for the ad buyer, and predictable income for the content provider. I'm sure there are other ways to charge advertisers what their advertisements are worth, and increase their effectiveness at the same time.

    This new Google approach doesn't deliver.

    SoupIsGood Food
    • The traditional role was selling products and/or services. If branding was the entire value of advertising, no one would advertise. "Hey, everyone knows who we are, and no one wants to buy!" This will even out. If your conversion rate was 2%, you should be willing to spend 50 times more in CPA. If you're not, your competitor will. Bottom line: this should help boost confidence amongst advertisers, and result in more, not less revenues for most. The spammers and click-frauders will lose.
  • by Anonymous Coward on Thursday July 13, 2006 @04:30PM (#15714605)
    On two occassions, I've had my google account cancelled and funds withdrawn because Google accused me of click-fraud. Of course I had nothing to do with it and when I pleaded my case to Google I got no reply. I was willing to provide click logs and etc. But they just ignored me. I guess it's cheaper to just cancel accounts who are suspected of click-fraud then actually investigate. But if all it takes is a few malicious users with some scripting knowledge and open proxies to ruin my revenue why should I as a publisher use Google Adsense?
  • This isn't a good thing for Google. It turns the fraud situation on it's head. Having written software to try and do it, let me tell you it's hard to tie a sale back to an advertisement impression and/or click-through. Most of the ways involve either trusting the guy who'll be paying, depending on cookies to persist or maintaining a lot of server-side state to track an individual over the long term. The only case that's simple is where the viewer clicks on the ad and then performs the action in the same bro

  • I had my account banned for click through fraud, I did nothing. I wasn't bringing in much revenue at all, however I've heard from others that they've experienced the same thing.

    Google really needs to fix their fraud-detection systems, and this idea isn't going to fly with most people. Either put up with a certain percentage of fraud, or risk banning those who don't deserve it ... Damned if they do, damned if they don't.

  • by grolschie ( 610666 ) on Thursday July 13, 2006 @05:14PM (#15714851)
    1. Pursuade existing Google advertisers to use GooglePay so transactions can be monitored and click-fraud prevented.
    2. ???
    3. Profit!
  • by Goldenhawk ( 242867 ) on Thursday July 13, 2006 @05:22PM (#15714878) Homepage
    CPA only works when there's a trackable action... and in many cases, the trackable action is going to be impossible to define. For example, I launched a new site in July (, which is a free geocaching-related site, supported by Google Adsense ads, and doesn't sell anything. To get some initial traffic, I used my existing Adwords account to run ads on related search terms. Now, since my only monetizing product is advertising (from Google itself!), and the services the site offers are free, how on earth can there be any action? As a matter of fact, the very "action" that I'm trying to get IS a click - I want them to visit the site. I don't have anything to sell beyond that, other than possibly deciding they don't really want to be there and leaving thru a similar click on the Adsense links. I just need to build traffic above the breakeven critical mass. Beyond that, I don't care what happens to any "conversion".

    (And given the economy of Google ads, I'm basically paying about 50% of the Adwords cost because I get about a 1% click-in, and about 1% click-out, and the Adsense click-out pays about half of what an Adwords click-in costs me. So obviously I can't use Adwords long-term, but it's okay for building initial traffic, and incidentally for making sure my site got quickly indexed - thanks to daily visits by the Adwords robot.)

    Now, in that model, as with many other businesses who are not selling online, it becomes impossible to track CPA, and the CPC is really the only valid business model. And this is true of millions of link-farm sites (not that I'd mind most of THEM disappearing).

    As others have mentioned above, advertising is about much more than simple action-tracking - if you put a favorable ad in front of a potential customer enough times, it will build brand awareness and eventually convert. But not in enough time to make CPA useful, and usually in ways that cannot be directly tracked anyway.

    Sorry, but I think CPC is going to be around for quite some time. And I'm sure Google is well aware of these dynamics.
  • This model will fail for impression ads. And impression ads are important for a large number of products and services. For many things, from mundane things like consumer goods, to advanced business services, the products and services are not purchased or acted upon immediately. Impression ads just keep the name, logo image, or musical jingle, in the minds of the readers. In TV they call them viewers. In radio they call them listeners.

    Obviously, in media like TV, radio, newspapers, and magazines, impre

    • They have a new model, and you have an example of a situation where it cannot be applied. Fine.
      But how relevant is this? Your "impression ads" are not covered by pay-per-clicktrough either, aren't they?
      And that is what the new model attempts to replace or extend.

      What you are saying is like radio ads are failing because they cannot convey an image of the product. It is just a different situation, different solution for a different problem.
  • Stupid question (Score:2, Insightful)

    Please excuse the stupid question, but most Apache (and I think IIS, as well) can log the referrer's and the client's IP address. Would it really be that hard to place a cap on the number of clicks from the same pair of client IP / referrer IPs within a given period of time from which the AdSense bill is generated? I would think you could also drop on the floor anything from either an RFC-1918 [] IP address or an address that matches the referring web server's address, as well.

    I'm not real familiar with h
    • Have you ever heard of zombie PCs?

      Fraudsters "own" farms of millions of poorly managed PCs in the average household that they can control to do anything they like, including sending spam, visiting webpages (clickfraud) and spreading worms to infect other PCs to join the farm.
    • Re:Stupid question (Score:3, Informative)

      by cr0sh ( 43134 )
      Unless I am reading your post wrong, I don't see where you consider "zombied" machines, except perhaps case number one. However, in the case of a zombie network, you have potentially tens of thousand of machines spread all over the internet, and none would have to click multiple times in a short time period to rack up the clicks - they would just have to click randomly (as in "at randomly spaced time periods) and constantly, whenever the machine it connected to the internet. If the majority of those 0wn3d b
    • Re:Stupid question (Score:3, Insightful)

      by bennomatic ( 691188 )
      In addition to zombie PCs, which the other poster mentioned, there are zombie proxies. I used to work for one of the original click-through advertising companies, which is now mostly defunct. To protect the annoyed-at-not-being-successful, I won't ssaayy it's name. Anyway, we had a "client" who kept setting up accounts under slightly different names (different combinations of about 6 first and last names), and then those accounts would make 10 times more money than any of our other clients.

      We finally f

  • Steal a credit card number, click on a Google CPA advert, and buy lots of expensive things.

    The profit is in the percentage the advertising website gets, not in the goods.

1 1 was a race-horse, 2 2 was 1 2. When 1 1 1 1 race, 2 2 1 1 2.