# Event Risk Explained

<a href="https://pxa.impact.com/student/activity/1117601?sid=0c0e3e5c-54c9-4435-9bee-ebcdccb7f292&#x26;sid_i=0?utm_source=app.impact.com&#x26;utm_medium=owned-platform&#x26;utm_content=pro-350&#x26;utm_campaign=help-center" class="button primary">Take the PXA course</a>

Event Risk helps you protect your metrics and spend from invalid non-human events by monitoring clicks and conversions for suspicious activity. It helps to:

* Understand the quality of users your partners drive clicks from, informing partnership and optimization decisions.
* Protect vulnerable payout events from invalid non-human activity.
* Optimize based on accurate *human* performance metrics.

#### What are invalid non-human events?

Any click or conversion that didn’t originate from a user intentionally carrying out the action. Invalid events can be intentional and malicious, but are often a result of innocent by-products of the way people use the internet.

{% tabs %}
{% tab title="Innocent & Unintentional" %}
There are an increasing number of innocent bots crawling the internet in today's ecosystem. Examples include bots extracting data for price comparison services or AI models and search engine bots whose purpose is to index and display relevant information on the web. Despite having no intention of affecting your metrics or payouts, these bots frequently click on tracking links while crawling websites to find more information.
{% endtab %}

{% tab title="Intentional & Malicious" %}
In a performance program, there are two categories of malicious intent you may come across.

<details>

<summary>Invalid events</summary>

The event itself was carried out by non-human activity. Clicks, Leads, and Installs are most susceptible here as it’s much easier to create a click with a bot, fill out a form, or download an app than it is to complete a purchase (although stolen credit card information can still be used to carry out purchases, it's less common).

</details>

<details>

<summary>Misattribution</summary>

The action event was legitimate, but the referrer wasn’t. The goal of a bad actor in this case is to take credit for driving real user actions by injecting or stuffing clicks into the user’s browser or device without them knowing.

</details>
{% endtab %}
{% endtabs %}

#### How does Event Risk help?

Event Risk can help to enhance decision-making and mitigate potential threats by evaluating interactions in a structured way. This section explores how this is achieved this through five key components:

<details>

<summary>Click scoring vs action scoring</summary>

Clicks and conversions are both scored for risk signals.

Clicks are scored for risk signals specifically based on data associated with a specific click.

Actions are scored based on conversion-specific data signals as well as referrer-level data. So, if an action’s referrer has a risk signal, that will be inherited by the action.

</details>

<details>

<summary>Reason codes</summary>

The different risk signals analyzed by impact.com are categorized into [*Reason Codes*](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/reason-codes-reference), which represent the different types of observed behavior.

Due to the nature of risk detection, and the different signals and patterns we look at, some signals can be ‘stronger’ indicators of non-human or invalid activity than others. For this reason, the Reason Codes are categorised into *Risk Levels*, which represent the confidence in the signal.

</details>

<details>

<summary>Risk levels</summary>

While determining the intent behind an event exhibiting invalid traffic signals can be challenging, impact.com’s detection system assesses the likelihood each [reason code](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/reason-codes-reference) being non-human and categorizes it into a risk level.

**Critical**

The request has either specifically declared that it is a crawler (e.g. via its user agent), or another signal indicates with almost certainty that it is not a genuine event.For clicks with `CRITICAL` risk level, strict click filtering is applied. See [Filter High-risk Traffic](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/filter-high-risk-traffic) for more information.

Actions with `CRITICAL` risk signals are automatically reversed and can be reviewed in [risk review](#action-risk-review).

**High Risk**

These signals often consist of innocent invalid traffic, but can also represent malicious activity. They are highly unlikely to represent human intentional activity, but there are rare cases of false positives.

For clicks with `HIGH_RISK` signals, choose a click filtering setting to apply. For actions with `HIGH_RISK` signals, review the [Event Risk Reports](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk) to help inform next steps like if you agree that these actions should be invalidated.

See [Filter High-risk Traffic](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/filter-high-risk-traffic) for more information.

**Suspect**

Suspect signals are not included in the basic version of Event Risk.The exception to this rule is Conversion Spoofing. These are marked as `SUSPECT`.

</details>

<details>

<summary>Click filtering</summary>

Clicks are the most vulnerable events to invalid traffic since there is no purchase to complete and no form to fill out. Click Filtering protects the integrity of your performance metrics and from unwanted CPC payouts impact.com

Learn more about the 3 click filtering settings and how to [Filter High-risk Traffic](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/filter-high-risk-traffic).

</details>

<details>

<summary>Action risk review</summary>

Any action with a critical risk signal will be required to be reviewed and explicitly approved in order to make it payable to partners.

In addition to any critical action risk signal, any action flagged for Conversion Spoofing by action tracker validation rules will be added to Risk Review. Learn more: [Review at Risk Actions](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/review-at-risk-actions).

Only pixel action trackers are vulnerable to conversion spoofing. To set up rules, [contact support](https://app.impact.com/support/portal.ihtml?createTicket=true).

</details>

#### Reporting

Event Risk reports give you an unfiltered view of risk in your program, allowing you to understand the overall quality of events driven by your partners. In addition, specific events identified as a risk or misattribution can be isolated for you to review before taking further action.

The [Risk by Partner](https://app.impact.com/secure/advertiser/protect/event_monitoring/report/viewReport.report?handle=16555) report gives you an aggregate overview of the total risk for each partner’s clicks and actions, their associated action cost, and other risk indicators like conversion rate. This helps to give you a holistic view of the partner’s risk levels. To dive deeper, more granular data can be found using the *show* filter.

You can group by or filter for: `Partner`, `Shared ID`, `RefDomain` and `RefGeo`(Country) to isolate risks to specific sources of a partner, and apply minimum click and action count filters to help highlight the highest risk areas.

{% hint style="info" %}
**Remember**: Not all non-human activity is malicious.
{% endhint %}

<details>

<summary>Risk Level Details</summary>

This breaks down the total risk into the risk level categories. Raw Click Risk Includes *Critical*, and *High Risk* signals. Remember that *Critical Risk* clicks are already pre-filtered and you have the option to do the same for *High Risk* Clicks in [Click Filtering](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/filter-high-risk-traffic), so this group of filters allows you to understand to what extent your click metrics are already protected in performance reports.

</details>

<details>

<summary>Cost &#x26; Revenue Details</summary>

The default view shows the cost associated with actions at all risk levels. These details break down revenue and cost by risk level, allowing you to understand the impact of taking action at the risk level for a given partner. For example if you reverse all *High Risk* level actions for a particular partner, what will the payout implications be for that partner.

</details>

<details>

<summary>Click Reason Codes % | #</summary>

Click Reason Codes are the specific flags that are seen on the click level if you are interested in more granular details of a risk in the partner's traffic. See the [Reason Codes Reference](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/reason-codes-reference) for further details.

</details>

<details>

<summary>Action Reason Codes % | #</summary>

Action Reason Codes are the specific flags that are seen on the action level if you are interested in more granular details of a risk in the partner's traffic. Reason Codes pre-pended with `REF_` indicates that the risk signal was inherited from the referring click of the action. See the [Reason Codes Reference](https://help.impact.com/brand/performance-program/protect-and-monitor-your-performance-program/event-risk/reason-codes-reference) for further details.

</details>
