On a July afternoon, a single smart TV received 235 ads in five minutes, roughly one every 1.3 seconds. That same device logged more than 11,000 impressions over 17 days, including 1,362 delivered in the 3 a.m. hour.
No household watches television like that. So, who, or what, was on the other side of the screen?
That is the question every Connected TV (CTV) buyer should be asking while we move towards 2027. CTV is sold as a premium, brand-safe, living-room inventory. But our latest analysis of a branding campaign shows that some of those impressions may be generated when nobody is watching at all.
Why CTV Has Become a Prime Target for Ad Fraud
CTV commands premium CPMs because buyers assume a real person is sitting in front of a real screen. That assumption is exactly what makes it vulnerable to ad fraud.
The money is growing fast. Global CTV ad spend is projected to reach $58B by 2028. Further, rising investment also brings greater CTV ad fraud risks. CTV and streaming have an invalid traffic rate of 18% as of now in 2026. (Source: DigitalApplied)
The usual safeguards are not held either. Industry research has found bot activity inside direct CTV deals bought by major advertisers, showing that buying direct or through private marketplaces does not automatically prevent invalid traffic.
Advertisers are paying a premium price for an audience they have not verified. Hence, raises concerns about how much of advertisers' premium media spend actually reaches genuine viewers.
What The Data Analysis by mFilterIt Revealed
During a branding campaign monitored between 11th and 27th July 2026, we tracked impressions across ten publishers. One programmatic CTV supply source stood out, and the deeper we looked, the less the traffic resembled human viewing.
Violations were concentrated in two environments
Major frequency cap violations were noted in two smart TV operating systems where in total they accounted for 81.7% of all violations where one produced 53.35%, the other 28.35%.
Figure 1. Share of frequency cap violations by smart TV operating system, before and after the supply-path switch.
The same devices repeated relentlessly
The ten most active device IDs each generated between 7,001 and 11,993 impressions over 17 days. The top device averaged about 700 ads a day.
Figure 2. Total impressions for the ten most-repeated device IDs, 11–27 July 2026.
Delivery ignored normal viewing hours
These devices received impressions across nearly every hour of the day, with recurring peaks at 03:00, 12:00, and 19:00. Real households watch in sessions. These devices behaved like machines on a schedule.
Figure 3. Hour-by-hour impressions for the same ten devices, summed across 11–27 July 2026.
Impressions arrived in bursts
Two separate devices each logged more than 220 impressions within a single five-minute window, in the same hour on the same day. One device registered 1,435 impressions in a single day.
Figure 4. Impressions per five-minute window for two devices during the 13:00 hour on 24 July 2026.
Each of these ad calls was technically valid. The devices were real and connected. What the data could not show was a viewer.
How It Happens: Proxy SDKs Inside Smart TV Apps
The pattern points to a specific mechanism: residential proxy software development kits (SDKs) embedded in smart TV apps.
These SDKs let third parties route internet traffic through a household connection. A smart TV is an ideal host because it stays plugged in, online, and largely ignored. The proxy functionality can continue running even after the app has been closed. That background network activity can generate ad requests with no active viewer, and potentially while the screen is switched off.
Independent research confirms that the problem is widespread in digital advertising. A scan of 6,038 apps across two leading smart TV platforms found 2,058 containing residential proxy software, including 42.5% of apps on one platform and 26.9% on the other. These are the same two operating systems that drove 81.7% of the violations in our data.
Figure 5. Share of smart TV apps containing residential proxy SDKs, by operating system.
The device is active. The ad call is valid. The viewer may not be there.
Why a Policy Fix Isn't Enough
The platforms have responded. One major smart TV maker said it would suspend apps that turn a television into an always-on proxy node, and the other said it had already restricted new app registrations with proxy functionality.
That is progress, but it is not protection. SDK updates can take time to reach apps already installed on TVs because of app store review processes. Millions of devices may keep running older code for months.
Changing how you buy does not solve it either. On 1 August, the campaign's supply source was switched to a direct-seller path. In the five days that followed, the same two operating systems still accounted for 69% of frequency violations. The buying route changed. The behavior did not.
Platform policy governs what apps are allowed. Only impression-level validation tells you what actually happened in your own campaign.
How Advertisers Can Detect Fake CTV Impressions & CTV Ad Fraud
Independent, third-party ad traffic validation should answer four questions for every CTV buy:
Question | What to check |
Was the viewing environment legitimate? | App and OS transparency, exposure to apps carrying proxy SDKs, and IP type (residential, data center or proxy) |
Did the device behave like a real viewer? | Hour-of-day delivery, overnight activity and the presence of natural session gaps |
Is the same device generating impressions repeatedly? | Device-ID-level frequency and minute-level bursts that exceed what a screen can display |
Was there a genuine opportunity to see the ad? | Delivery rates a person could physically watch, cross-checked against user activity signals |
From these checks, five practical actions follow:
Monitor CTV separately. Blended reporting hides device-level anomalies.
Enforce frequency caps at the device-ID level, not just at campaign or household level.
Exclude high-repetition device IDs as soon as they are flagged.
Investigate spikes by operating system, especially overnight delivery.
Validate independently. Do not rely on seller labels or platform assurances alone.
What This Means Across the CTV Ecosystem
For publishers, inventory trust is now a revenue issue. Buyers will move budget toward supply they can verify.
For DSPs, SSPs and exchanges, supply-path integrity cannot rest on a "direct" label when direct paths carry the same patterns.
For brand protection and risk teams, unverified impressions are a governance and financial-reporting exposure, not just a media-efficiency problem.
The Screen May Be Connected. Was Anyone Watching?
CTV still deserves its rightful position in your media mix. However, in 2026, a counted impression doesn’t mean a delivered impression. The marketers who safeguard their budget in programmatic buying will be those that verify every impression and question if an actual viewer watched.
Is your CTV budget delivering impressions to real viewers?
Ask for a CTV traffic audit for your campaigns to find out device level frequency, delivery insights, and invalid traffic flags.
Frequently Asked Questions
How does CTV ad fraud happen?
Fraud in CTV advertising occurs when the ad request appears genuine, but no actual person is behind it, be it bot traffic appearing as smart TVs, fraud via apps, or actual TVs requesting ads in the background.
What are the common types of CTV fraud?
App spoofing, SSAI spoofing, bot/data centre server device spoofing, background/screen off impressions, and frequency abuse due to repeated device IDs are the most frequent kinds of frauds.
How does CTV fraud infiltrate the supply chain?
Fraud happens whenever an ad request is manipulated. False app and device information allows making worthless inventory seem expensive, while multiple resellers and server-side ad placement obscure traffic sources.
How do advertisers measure CTV traffic quality?
Advertisers look for invalid traffic ratios, frequency at the device level, time-of-day delivery, transparency of the application or operating system, and ratio of data center or proxy IPs to make sure that impressions match actual viewing households.
How does AI detect CTV ad fraud?
AI learns what genuine viewing looks like, then flags deviations. It analyses device frequency, timing, session length, IP type and app consistency at scale, and clusters devices that behave identically to expose coordinated fraud.