Before we wrote a single line of the ad serving code, we spent two weeks thinking about fraud. An ad marketplace with weak fraud protection quickly becomes worthless — advertisers lose money to fake clicks, developers get banned for suspicious activity, and trust collapses on both sides.
We chose to build rule-based fraud detection rather than ML-based detection for one reason: at launch scale, ML models have insufficient training data. Rules are transparent, auditable, and immediately effective.
WaitJI AI has three potential fraud vectors:
Every impression request includes the originating IP address. Our backend enforces a hard limit of 50 impressions per IP per hour. This eliminates the most naive form of impression fraud — running a script that hammers the impression endpoint.
The threshold of 50/hour was chosen based on realistic Claude Code usage. A developer using Claude Code intensively for one hour generates 60–80 prompts — but each prompt only generates one impression. The 50/hour limit catches fraud while staying well above the ceiling of legitimate usage.
After a click on an ad, the same user cannot generate another valid click for 30 seconds. This is enforced server-side — client-side enforcement can be bypassed trivially.
The 30-second cooldown reflects real user behaviour: a developer who sees an interesting ad and clicks it is not going to click the same ad again 5 seconds later. Any click pattern below 30 seconds is definitionally fraudulent.
Referral earnings (10% of a referred developer's impressions) are tracked as separate impression records with an isReferralBonus: true flag. This allows us to audit referral fraud independently — a developer who refers 50 fake accounts is detectable because the fake accounts generate suspicious impression patterns.
The admin panel includes a fraud flags dashboard. Any developer whose impression rate exceeds 3× the platform average for their usage time gets automatically flagged for manual review. Flagged accounts are not auto-banned — we review them before taking action, because aggressive auto-banning creates false positive risk for legitimate power users.
We do not have device fingerprinting or VPN detection yet. These are on the roadmap for Q3 2026. Our current fraud detection catches the vast majority of fraud attempts — the remaining attack vectors require more sophistication than we have seen from bad actors at our current scale.
Perfect fraud detection is impossible. The goal is to make fraud unprofitable — if the expected earnings from fraud are less than the risk of account ban, rational bad actors will not bother.
Join thousands of Indian developers earning with Claude Code.
Start earning free →