A clawback does not arrive at the moment of the fraud. It arrives 30 to 90 days later, after the buyer's billing cycle closes, after the verification vendor re-checks the campaign, and after your demand partner has already paid you or credited the advertiser. The result is a deduction applied retroactively to impressions you can no longer inspect, based on evidence you were never shown at the time of serving. That structural delay is what makes invalid traffic clawbacks so damaging: by the time the line item appears on your payment report, the server logs may have rotated and the traffic source may have disappeared. This article covers the mechanics of how clawbacks propagate through the supply chain, the attack vectors that trigger them, the controls that reduce your exposure, and the documentation and dispute process that determines whether you recover the money.
What a Revenue Clawback Actually Does to Your Payment
The clawback chain starts at the advertiser. An advertiser buys inventory through a DSP or a direct insertion order, a verification vendor or the buyer's own analytics flags a share of the impressions as invalid, and the advertiser demands a make-good or a credit. The DSP then recovers that value from the exchange or SSP that sold the impression. Each intermediary passes the loss down the chain, and it stops at the publisher who owns the inventory where the invalid traffic appeared.
The timing matters more than the amount. Most publishers operate on Net 30 terms, as we do at WireAds, which means January's earnings arrive at the end of February. If a buyer files an IVT claim in March covering a campaign that ran in December, the deduction lands on your April or May payment. You are financing a loss on inventory you delivered four months earlier, and your cash flow planning has to absorb a number you could not forecast.
The categories of invalid traffic also determine how the claim gets processed. According to Google's official invalid traffic definition, invalid traffic spans two categories: general invalid traffic (GIVT), which known bots, crawlers, and data center traffic generate and which filters can catch through pattern matching, and sophisticated invalid traffic (SIVT), which requires multi-point detection and analysis to identify. GIVT claims are usually small and mechanical. SIVT claims are the dangerous ones, because they arrive with a verification report, a fraud classification, and sometimes a demand partner that pauses your account entirely while it investigates.
One more mechanic deserves attention. Under Google MCM (Multiple Customer Management), a managing publisher carries responsibility for the inventory of the child publishers it manages. A child publisher's IVT problem becomes the managing publisher's clawback, and the managing publisher passes it down. If you manage other sites, or you sell through a partner that aggregates inventory, an IVT event on a property you barely monitor can still hit your payment. The same propagation applies to direct deals: an agency that buys your inventory through our SSP and receives an IVT report will file against the deal, and the deduction follows the deal ID back to you.
The Attack Vectors That Trigger Clawbacks
Understanding how invalid traffic enters your inventory tells you which controls to build. The vectors fall into four groups, and each one produces a different signature in your logs.
Purchased and incentivized traffic. The most common cause of clawbacks is traffic a publisher bought. Cheap traffic packages from marketplaces, pop-under networks, or "guaranteed visitors" services deliver bot traffic, click-farm traffic, or users paid to visit pages. The seller of that traffic rarely discloses its origin, and the buyer of your advertising does not care that you did not generate it intentionally. Incentivized traffic behaves the same way: reward apps, loyalty programs, and "earn credits for viewing" schemes produce humans with no purchase intent and abnormal session patterns, and many verification vendors classify them as invalid.
Spoofing and domain fraud. A fraudster copies your domain or a near-variant of it, sells counterfeit inventory on that domain, and the resulting IVT attaches to your site's reputation even though your servers never served the impression. Domain spoofing also inflates CPMs on the counterfeit side because buyers think they purchase premium inventory. The IAB Tech Lab ads.txt specification exists specifically to counter this vector: a public, crawlable list of your authorized sellers lets buyers reject inventory that claims to come from your domain but lacks a matching entry. Publishers who maintain accurate ads.txt files, and app publishers who maintain app-ads.txt files, cut off a large share of spoofing-driven claims before they start.
On-page manipulation. This group includes ad stacking (layering multiple ads so only the top one is visible), pixel stuffing (rendering a 728x90 ad inside a 1x1 frame), hidden iframes, auto-refresh configurations that reload ads faster than any human could view them, and click baiting layouts that generate accidental clicks. These tactics sometimes survive for months because they inflate short-term revenue, and then a single verification report claws back the entire period. Auto-refresh deserves special mention: refresh intervals under 30 seconds, or refresh without viewability confirmation, frequently trigger SIVT classifications even when the audience is fully human.
Botnets and compromised devices. Malware-infected devices load real pages with real cookies, which makes them the hardest vector to catch from a publisher dashboard alone. Device hijacking operations run headless browsers with forged fingerprints, and residential proxy networks route bot traffic through real consumer IP addresses so geo-filtering fails. The IAB Tech Lab Ad Fraud Disclosures framework tracks these emerging attack types as the industry discloses them, and reviewing those disclosures helps you understand what verification vendors will flag in the coming quarters, before the claims reach your payment report.
A fifth vector sits outside your site entirely: competitor sabotage. A rival can point bot traffic at your pages to trigger an IVT classification and damage your account standing with demand partners. You cannot prevent it, but you can detect it early, and the detection controls below are what turn a sabotage attempt into a two-day anomaly instead of a clawback.
Controls That Reduce IVT Before It Reaches Demand
The cheapest clawback is the one that never gets filed, and prevention happens on three layers: supply-chain transparency, page configuration, and traffic monitoring.
Supply-chain transparency. Publish a complete and current ads.txt file at your root domain, listing every SSP and exchange authorized to sell your inventory, including us if you work with us. If you operate apps, publish app-ads.txt as well. Verify that your demand partners publish accurate sellers.json entries and attach a complete SupplyChain object to bid requests. Buyers automate rejection of inventory with broken supply-chain metadata, so a stale or incomplete ads.txt file does not just expose you to spoofing, it also suppresses your bid volume.
Page and ad configuration. Audit every ad slot for viewability compliance: ads must occupy real, visible space with dimensions that match the declared creative size. Remove any stacked, hidden, or zero-opacity placements. If you use auto-refresh, set intervals of 30 seconds or longer and refresh only slots that were viewable at the moment of refresh. Cap refresh counts per session. If you run Prebid.js, review your configuration for stale bid caching and confirm that timeout settings do not cause ghost impressions, because bid responses without a rendered ad still count as measurable impressions in some audit paths.
Traffic source discipline. Never buy traffic from unverified vendors, and treat any offer priced dramatically below market rates as bot traffic until a week of traffic analytics proves otherwise. Document every traffic acquisition you make: the vendor, the campaign dates, the promised audience, and the landing pages. If a traffic source later triggers an IVT claim, that documentation separates a deliberate fraudster from a publisher who made a bad purchase, and demand partners treat those two cases very differently.
Monitoring thresholds. Set baseline expectations for your site's normal pattern: pages per session, session duration, bounce rate by geography, direct traffic share, and time-of-day distribution. IVT typically announces itself as a spike in one of these metrics: direct traffic jumping from 8 percent to 35 percent of total sessions, average session duration collapsing to a few seconds, or a single country suddenly generating triple its usual share of impressions. Review these metrics weekly. A publisher who catches an anomaly on day three can block the source and notify demand partners before a billing cycle closes; a publisher who catches it on day forty receives a clawback.
Documentation That Wins Disputes
Every clawback dispute turns into a comparison of two evidence sets: the buyer's verification report against your server records. You cannot control the first, but you can fully control the second, and most publishers fail here before the dispute even begins.
Retain ad server data for at least 12 months. Google Ad Manager (GAM) keeps historical reports, but export and archive the granular ones: impression-level logs where available, line item delivery by day, geo breakdowns, and viewability metrics per slot. Back up your web analytics history, because analytics platforms sometimes cap retention on free tiers. Store your ads.txt change history with dates, since demonstrating when you added or removed an authorized seller often resolves spoofing claims.
Keep a decision log for anything that affects delivery. When you change a refresh interval, remove a placement, or start a traffic campaign, record the date, the change, and the reason. When a demand partner asks "was this traffic organic," a dated log answers with authority, and a memory does not.
For every traffic acquisition, keep the invoice, the vendor's traffic description, and a screenshot of the campaign settings. For every anomaly you detect, capture the analytics screenshots at the time you detect them, plus a note on the action you took. If you blocked a suspicious referrer on March 4 and a claim arrives in May covering March 1 to March 10, that record shows you acted in good faith, and good faith shortens disputes and preserves account standing.
Finally, keep records of your own verification posture. If you ran any independent IVT measurement on your inventory, archive those reports. If your demand partner provides IVT dashboards, export them monthly. A dispute goes better when you can show that your own instruments, not just the buyer's, were watching the inventory in question.
How to Dispute a Clawback With Evidence
When a deduction appears, move quickly but methodically. Demand partners usually set a dispute window, often 30 days from the payment report, and claims that arrive late get dismissed on procedure regardless of merit.
Step 1: Request the itemized claim. A clawback line item on a payment report is not a claim, it is a conclusion. Ask your partner for the campaign, the date range, the impression counts, the IVT classification (GIVT or SIVT), the verification methodology, and where possible the impression IDs or a data sample. Reputable partners provide this; a partner that refuses to substantiate a deduction tells you something about the relationship.
Step 2: Reconstruct the period from your own data. Pull your ad server delivery, your analytics, and your decision log for the claim's date range. Match the claimed impression volume against your served volume: a claim for impressions exceeding what your ad server recorded is a spoofing claim, not a traffic-quality claim, and that changes your entire argument. A claim matching your served volume with anomalous session metrics points to a traffic source, and your acquisition records identify it.
Step 3: Build the dispute file. Include a timeline, the evidence above, the corrective actions you took, and a specific request: full reversal, partial reversal, or a re-audit of the flagged period. If you detected and blocked the source mid-period, argue for a partial reversal covering the post-action dates. Partial wins are the most common outcome, and they are worth pursuing: a 40 percent recovery on a large claim is real money.
Step 4: Escalate through the right channel. Route the dispute through your partner's support desk with the file attached, and keep all correspondence in writing. If you sell through multiple partners, as most publishers do, notify all of them when you find a genuine traffic-quality problem on your site, because one buyer's detection predicts the next buyer's claim. Publishers who self-report an issue almost always keep their account; publishers who wait for the second claim often do not.
One caution: never dispute on the argument that the traffic looked fine to you. Verification vendors measure against device fingerprints, IP reputation databases, and behavioral models you cannot see from a dashboard. Dispute on discrepancies, documentation, and corrective action, because those are the things your partner can defend upstream when they take your case to the buyer.
How We Handle Filtering at WireAds
Our position in the supply chain gives us a role in clawback prevention that sits upstream of your controls. We aggregate demand from Prebid, OpenRTB (oRTB) connections, Google MCM with Google AdX, and direct deals from global and local brand agencies, and we apply fraud and brand-safety filtering before that demand reaches your inventory. Our ad sources hold the highest quality standards, and we filter unwanted ads and low-quality demand aggressively, because a clean demand stack protects both sides: you avoid creatives that drive malicious or misleading behavior, and buyers avoid the inventory patterns that generate IVT claims downstream.
On the traffic side, the same filtering discipline works in your interest when a dispute arises. Because we operate CPM-based and pay Net 30, we see the deduction chain from both directions, and we can tell you what a claim contains, which campaign it references, and what evidence the buyer used. When you dispute a clawback with us, you get the itemized detail in step one without a fight, because our support desk pulls it as standard practice.
We work globally, across web, app, and CTV/OTT, in every country with Google monetization, and IVT patterns differ meaningfully across those formats. CTV inventory in particular faces a growing share of spoofing and device-farm claims, and app inventory faces app-ads.txt gaps. Whatever format you monetize, the defense structure stays the same: transparent supply-chain files, disciplined page configuration, monitored traffic, and retained records.
A Monthly Routine That Keeps You Ahead
Clawback protection decays if you treat it as a one-time project. Set a monthly review with five checks, and it takes under an hour.
First, verify your ads.txt and app-ads.txt files still match your active partner list, with no expired entries and no missing new ones. Second, export your IVT and viewability reports and compare them against the prior three months, looking for trend breaks rather than single-day spikes. Third, review your traffic source mix for new referrers, new geographies, and shifts in direct traffic share. Fourth, confirm your ad configuration is unchanged: refresh settings, slot visibility, and declared sizes. Fifth, archive everything, dated, into the folder that will become your dispute file if a claim ever arrives.
Publishers who run this routine typically keep IVT rates in the low single digits, and low single-digit IVT rarely triggers clawbacks at all. The publishers who lose revenue to clawbacks are almost always the ones who discover the problem in a payment report instead of in their own data. Keep the data, run the checks, and the clawback arrives as a small, disputable line item instead of a month of erased earnings.
