Comment by 0_gravitas

So, this works only for a subset of ads, specifically, ads that are CPC (cost-per-click) (sometimes called CPL -> cost-per-link), this wouldn't work for CPA campaigns (cost-per-action), which only pay out when a sign up or some other arbitrary action is performed by the user.

The larger adtech companies will have some form of bot-activity-detection, _but_ plenty will let it all just slip on by. (I've personally written a Babashka script at $job that checks performance of our publishers, and flags any fraudulent-seeming activity)