The Rise of Link Jumpers and Ghost Completes
Blog | November 1, 2022
Right now, there is a major fraud trend plaguing the largest sample vendors and a major survey tool. It stems from an antiquated approach to links and redirects.
In an age of fraud running wild in the survey ecosystem, this is a problem. In this post, we’ll explain two common kinds that have our attention in the industry right now: Link Jumpers and Ghost Completes.
What is a “Link Jumper?”
A link jumper refers to someone that gets into a survey by hacking the entry link and “jumping” into a
a new project they were not assigned to initially.
What is a “Ghost complete”?
A ghost complete is a similar concept, with a different approach. The fraudster figures out the sample vendor’s redirect convention on the front end. The fraudster is then able to trigger multiple “completes” in the sample engine for a survey they never entered
Case Study
Let’s take a generic Decipher survey URL as an example.
https://selfserve.decipherinc.com/survey/selfserve/ABCD/123456?list=YZ&or1=JHKLMNOP123&decLan
g=simplifiedchinese
It does not take a hacker to see how clearly the project variables show in the URL. For example:
- Language is shown.
- Job # is shown.
- Sample Vendor code is shown.
What this tells a fraudster:
- He/she can detect what country to present from (via a third-party proxy).
- He/she can jump to other projects in Decipher based on the simple project number convention.
- He/she can associate with a particular sample vendor.
After a few experiences on that vendor to Decipher setup, any novice fraudster has a field day. The vendor redirect constructs are probably figured out by then too.
When do market researchers catch this? Usually at the end of the field, when IDs are reconciled between client and vendor.
Lately, there have been many client stories about major sample vendors aggressively demanding to
reconcile IDs that had no survey data, only to discover a pattern of this problem across projects in the
same week or two. The opposite can also occur- where a survey is populated by so many responses tied to IDs the vendors cannot reconcile. Usually, this event is only known on the vendor side and almost never communicated to the client. Sound familiar? Maybe this explains that odd pushback you got from a vendor recently on ghost complete IDs.
What you can do
The good news is, there are remedies for this. I’ll suggest a few.
- Reconcile IDs 2-3 times during the field with sample vendors. We automate this process in our business, but it can also be done manually via the researcher and their sample project manager.
- Use a fraud prevention system with a proven track record before your survey and within your survey.
- Identify vendors’ ability to use server call attribution connections in their supply chain.
- Do a once-over on your vendor redirect convention. Does it use long hashes? Or does it use simple systems that reveal project #s and member IDs?
- What about tracking quality by vendors? Identify metrics that matter most and track them against sample vendors to drive utilization and demand.
Most security gaps that remain are due to a lack of technical sophistication among many MR firms. As
the major consumers of online sample traffic, MR firms have a right to demand higher security of
themselves and their vendors. OpinionRoute is dedicated to helping MR firms take that next step in their
tech journey. Might as well start with leveling up your survey security.
If you are seeking assistance in leveling up your survey security game, feel free to hit us up. We can
support you within a project or within your overall strategy. We’d love to learn more about your needs.