METAPHASICGet access

Writing20 October 2026

Your Fraud Report Is a Horoscope

If the vendor cannot tell you what was wrong with the click, the verdict is not detection — it is a mood.

I have a friend who reads horoscopes. She tells me Mercury is in retrograde, which explains why her laptop crashed. I ask how Mercury knows about her laptop. She says it is complicated.

I thought of her when I read a fraud report recently. The vendor had flagged 12,000 clicks as invalid. The reason? "Anomalous traffic patterns."

That is not a reason. That is a mood.

When you buy traffic, you are not buying a mystery. You are buying a set of facts. A browser. An IP address. A timestamp. A sequence of requests. Some of those facts can be wrong. A browser can lie about what it is. A data centre can pretend to be a residential address. A session can be stitched together by a script.

But if the vendor cannot point to which fact was wrong, the verdict is not detection. It is astrology.

A conclusion without a premise is not a finding. It is a vibe.

Ask the obvious question: what did you observe?

What contradicted what?

Which signal triggered the label?

How strong was it?

Can I check the reasoning myself?

Can I take it to the partner who sold me the traffic and have the argument?

Usually, you do not know.

And here is the uncomfortable part. The vendor may not know either.

Modern fraud detection runs on models. Models are excellent at finding correlations across thousands of clicks. They are terrible at explaining themselves. That is not a criticism of the people building them. It is a property of the tool. A model can tell you that a click looks like other clicks it has seen before. It cannot tell you why, because the "why" is buried in a few million learned weights.

So the vendor hands you the output. "Invalid." Maybe with a confidence score. "Invalid, 87%."

That does not help. It makes it worse.

Because now you have a number you cannot audit, cannot challenge, cannot take anywhere. A probability is not an explanation. A probability is a way of not saying what you found.

"Invalid, 87% confidence" is astrology with decimal places.

A real explanation looks different. It sounds like this: "This browser reported itself as Safari on iOS, then answered a question only Chromium can answer." That is a fact. You can take that to the publisher. You can watch them try to explain it. That is detection. The other thing is a horoscope.

Why does the horoscope version persist? Not because anyone is evil. Because ambiguity is convenient.

When the reasoning stays on the vendor's side, the customer cannot check it. Nobody has to intend that for it to be the outcome. If every wrong call becomes an argument about your configuration, your threshold, your tolerance, the vendor never has to defend the evidence. That is a structural consequence, not a plot.

So what should a buyer of traffic do?

Stop accepting the conclusion. Demand the observation.

Ask your vendor: "What did you observe, and why does it mean what you say it means?"

If the answer is "the model determined" or "anomalous pattern", you have been handed a horoscope.

And horoscopes are fine for entertainment. They are not fine for deciding which publisher gets paid.

The next time someone tells you your traffic is invalid, ask them to show you the contradiction. If they cannot, you are not buying fraud detection. You are buying a subscription to the stars.