The Forbes MFA Scandal and the $770 Million Programmatic Waste Problem
March 2026 | Croupier Blog
Adalytics documented that Forbes operated a secret subdomain — www3.forbes.com — as a made-for-advertising site since at least 2017. Real Forbes articles were repurposed into ad-guzzling slideshows with 200+ ads per page view. Bid requests were misrepresented as coming from forbes.com, so advertisers thought they were buying premium Forbes inventory.
They were buying a content farm wearing a Forbes mask.
What MFA Sites Are
Made-for-advertising sites exist to collect ad money, not to serve audiences. They are websites built around maximizing ad impressions with minimal content cost. Think "Top 10 Kitchen Gadgets You Need" pages with no author, no editorial oversight, and no reader who arrived on purpose.
MFA sites share common traits:
- High ad density (dozens to hundreds of ads per page)
- Low-quality or AI-generated content
- Traffic acquired cheaply through content recommendation widgets and social arbitrage
- No organic audience
They exist because ad exchanges treat them the same as real publishers. A bid request from an MFA site looks like any other bid request. The advertiser's DSP sees site.domain and bids accordingly. When the domain is forbes.com, the bid is high.
The Numbers
Pixalate's Q2 2025 report found $770 million in estimated programmatic ad spend funneled to MFA publishers in a single quarter. 6% of websites with open programmatic ads were flagged as MFA, up from 4% in March 2025. By Q3, 10% of global open programmatic web ad spend — approximately $716 million — went to MFA domains.
Adalytics' March 2024 report documented major brands including P&G, Unilever, Disney, Ford, Johnson & Johnson, and Pfizer with ads running on MFA sites. Kroger paid an effective CPM of $5,491 to reach a single consumer on an MFA site. H&R Block served 2,117 impressions to one person in 30 minutes due to broken frequency capping.
The ANA found that 45% of marketers paid higher CPMs for MFA inventory than for premium sites. A typical campaign ran across 44,000 websites with no quality control.
Why MFA Sites Persist
MFA sites are profitable for exchanges. They generate impression volume. Volume means liquidity. Liquidity means competitive auctions. Competitive auctions mean higher take rates.
Removing MFA inventory would thin the auction pool. Fewer impressions competing means lower clearing prices. Lower clearing prices mean less revenue for the exchange. So exchanges tolerate MFA the way Meta tolerates scam ads — each quarter's junk becomes the revenue baseline.
Brand safety tools don't catch MFA. MFA sites aren't offensive. They're just worthless. Brand safety asks "is this content harmful?" not "is this content real?" A slideshow of kitchen gadgets generated by GPT passes every brand safety check. It just doesn't convert.
AI Makes It Worse
Europol has warned that up to 90% of web content could be AI-generated by 2026. Some AI-driven MFA operations already push out 1,200+ articles daily. The cost of producing a convincing MFA site has collapsed.
Before generative AI, building an MFA site required at least some human labor — hiring writers, sourcing images, building templates. Now the entire operation can be automated. The content is free. The domain is cheap. The traffic comes from content recommendation widgets that don't check quality.
The volume of AI-generated MFA content is growing faster than detection mechanisms. Every fake publisher that enters the auction pool dilutes the quality of the inventory available to advertisers.
What Would Fix This
Brand safety doesn't work. Quality scores don't work (a niche podcast converts at 12% for SaaS and 0% for consumer packaged goods — quality depends on the match, not the publisher). Blocklists don't work because MFA operators rotate domains faster than lists update.
What works is measuring outcomes. If the advertiser issues cryptographic coupons through their ad channels and counts redemptions, they see which publishers actually convert.
The niche podcast with 5,000 listeners redeems 120 out of 1,000 coupons for a SaaS advertiser — 12%. The MFA site with 10 million pageviews redeems 0 out of 1,000. The numbers speak for themselves. No blocklist needed. No quality score needed. The advertiser sees their own conversion data.
An opt-in publisher leaderboard showing aggregated conversion rates by vertical would surface these numbers publicly. Advertisers could browse verified performance before buying. The MFA sites would rank at the bottom because they have no real audience to convert.
The Forbes subdomain fooled brand safety tools, ad exchanges, and DSPs for seven years. It would not fool a coupon that needs to be redeemed by a real customer making a real purchase.
Croupier is a blind relay for cryptographic coupon books. Learn more or request early access.