The High Price of False Security
In the hyper-curated world of programmatic advertising, “premium” has become a dangerous synonym for “safe.” CMOs and procurement leads increasingly flee the chaos of the open exchange, pouring billions into programmatic guaranteed (PG) and private marketplace (PMP) deals. They pay exorbitant premiums for what they assume is a secure space where the publisher is known and the traffic is of pristine quality.
However, a deeper analysis reveals that the premium promise is not bulletproof. While these deals are commercially “guaranteed”in terms of price and volume, the traffic source can often be questionable. As a result, in dozens of case studies conducted by the DV Fraud Lab, fraud has not been ruled out, no matter how premium the deal is.
This piece sheds light on how fraud attacks infiltrate the high-rent district of direct deals, as they exploit the same technical cracks that plague the rest of the ecosystem.
The Premium Visibility Blind Spot: Paying Premium Prices for Fraud
Direct CTV deals generally carry a lower risk of sophisticated invalid traffic (SIVT). Paradoxically, that lower risk can create a blind spot: buyers may place greater trust in the deal’s premium positioning while applying less scrutiny to the inventory delivered through it.
In a recent investigation we conducted, a large pharmaceutical brand purchased a package marketed as preferred direct-to-publisher access to premium inventory. Yet the campaign delivered more than 700,000 confirmed impressions associated with the LeoTerra bot. The advertiser had paid for premium access, but a significant portion of what it received was premium-priced fraud.
Even more concerning, the campaign had not been configured with the full set of fraud protections and metadata controls needed to support investigation and mitigation. The premium nature of the deal had created a false sense of security, leading the buyer to assume that additional safeguards were unnecessary. Although DV could detect and confirm the fraudulent activity, the limited metadata collected made it significantly harder to trace its origin and take targeted action.
By September 2025, the advertiser noted that the correlation between the deal and the surge in fraudulent activity was concerning. The buyer had selected a premium package expecting greater protection and control, only to discover that the deal’s premium label offered no clear view into who had actually supplied the fraudulent traffic.
Direct Doesn’t Mean Protected: Audio Fraud Speaks Volumes
Even the cleanest possible deal structure is vulnerable to infrastructure-level hijacking. In another DV Fraud Lab case study, a large retail brand was engaged in a 1:1 direct audio PG deal with a leading audio platform. There was no exchange intermediary; the path was explicitly tagged as direct.
However, the campaign was hit with 20 million bot fraud incidents. On a single PG placement alone, nearly 6 million incidents were recorded. The culprit was BeatSting, a sophisticated SSAI botnet. BeatSting avoids detection by spoofing residential IP addresses and audio apps through fraudulent ad-insertion servers. By mimicking real consumer behavior at the infrastructure level, BeatSting proves that even a 1:1 relationship is only as secure as the weakest link in the potential audience extension.
The Aggregator Trap: When a “Direct” Partner Is Actually a Network
A common commercial illusion is the belief that a single counterparty equals a single publisher. A client of DV’s, a major financial brand, was hit by fraud during the recent World Cup series, which exposes the aggregator trap.
The advertiser used what they believed were direct deals in six deals. The reality was a technical disaster: a 94% bot fraud incident rate. Out of slightly over 1.2 million impressions, 1 million were identified as LeoTerra SIVT. In this instance, the “publisher” was actually acting as a network, reselling inventory from a vast array of sub-publishers with multiple SSPs in the path.
The Infrastructure Reality Check: The Intermediary Problem
The gap between marketing assumptions and technical reality is widest when examining demand-side platform (DSP) documentation. While buyers assume a straight line from buyer to publisher, the plumbing actually opens a door to a potential maze of intermediaries.
When reading the fine print of major buying platforms, one may find cases where buying guides/troubleshooting documentation shifts the responsibility for delivery and pacing entirely to the SSP or publisher. Such documentation often describes a “routine” occurrence where a publisher can shift inventory to a different SSP mid-flight.
The intermediary problem is found in the help center documentation of several buying platforms, with phrases such as, “You can also set up Programmatic Guaranteed deals with third-party exchanges.” This suggests that “guaranteed” does not necessarily mean a direct technical connection to the publisher; in some cases, an exchange may still facilitate the transaction.
At the end of the day, DV’s data does show that PG video inventory is sometimes routed through various intermediaries, further obfuscating the supply path.
Beyond the Label
Premium is a commercial tier, not a security protocol. As the case studies above prove, fraud can still affect PG deals, often in ways that are difficult to detect or trace. To protect high-value investments, advertisers should look beyond deal labels and adopt a framework built on transparency, measurement and independent verification.
Here are several best practices advertisers and agencies should consider, even when buying through PG and PMP deals:
- Understand the supply path: Make sure media teams recognize that inventory labeled “direct” may still involve intermediaries or aggregation layers.
- Measure post-bid: Apply continuous independent measurement across premium and guaranteed inventory rather than treating the deal type as an assurance of quality.
- Maintain consistent metadata: Ensure deal IDs and available supply-path details are captured consistently to improve transparency and reduce measurement gaps.
- Activate pre-bid controls: Use pre-bid filtering to avoid known fraudulent traffic before media is purchased.
The key question is not simply whether inventory is labeled “guaranteed,” but whether advertisers have the transparency, measurement and controls needed to verify the quality of the inventory for which they are paying a premium.
