Delhi, 8th September 2026: What happens when you switch off the TV? It stops running, but does it really? Probably not because even if the TV is off, somewhere right now, some ads are still running, quietly generating impression after impression in the background and brand is billed for each of them.
That is the alarming pattern uncovered in a new investigation by mFilterIt, a digital trust and ad-fraud intelligence platform, which has identified large-scale frequency-capping violations across Connected TV (CTV) environments; violations so concentrated that they point not to isolated glitches, but to a systemic exploit sitting inside the CTV supply chain today.
mFilterIt's analysis found that just one CTV environment accounted for 53.35% of all identified frequency-cap violations, with a second environment responsible for another 28.35%. Between them, two environments alone drove 81.7% of every violation observed — meaning the vast majority of this fraud isn't spread thinly across the ecosystem. It is concentrated, repeatable, and industrialized at the device level.
At the center of the exploit are proxy-sharing capabilities embedded within certain smart-TV app SDKs. These allow background network activity to continue firing ad requests even when nobody is watching and, in some cases, even when the screen itself is off. The request still looks technically valid, and impression still gets counted. The invoice still gets paid.
"CTV has emerged as a premium inventory for advertisers because of its ability to combine the impact of television with the precision of digital," said Amit Relan, CEO & Co-Founder at mFilterIt. He adds, a premium inventory cannot be evaluated only by whether an ad call was successfully made or if an impression was counted. When the same device repeatedly generates impressions beyond expected viewing behaviour, advertisers need to ask whether there was a genuine viewer and a real opportunity for the ad to be seen”.
Why every CTV advertiser should be concerned, not just the ones who got caught
Frequency caps exist for one reason: to stop advertisers from paying to show the same person the same ad over and over, and instead spread spend across real, incremental audiences. When those caps are silently broken at the device level, two things happen at once and both are invisible without independent validation:
· Reach is inflated. Dashboards report broad audience delivery that is actually the same handful of devices, repeatedly.
· Budget is drained. Every one of those repeat impressions is billed as if it reached someone new.
A small number of compromised environments can quietly siphon a disproportionate share of a brand media spend, and the campaign report at the end of the flight will still look clean.
Policy changes are a start. They are not a fix.
Restricting new app registrations tied to proxy-sharing capabilities and prohibiting residential proxy SDKs at the platform level are meaningful steps but mFilterIt cautions that platform policy alone cannot give advertisers visibility into the quality of every impression they have already paid for. Closing the door on new bad actors doesn't audit the ones already inside.
Brands need an independent validation layer capable of interrogating delivery at the impression level, including whether:
· The viewing environment demonstrated legitimate behaviour
· Device activity reflected the presence of a likely real viewer
· A single device repeatedly generated impressions beyond the defined frequency threshold
· An impression represented a genuine opportunity for the ad to be seen
· Delivery contributed to incremental reach rather than repetitive exposure to the same device
mFilterIt is urging advertisers and agencies to move beyond served-and-counted impression metrics and adopt independent third-party validation, device-level frequency-cap enforcement, real-time anomaly monitoring, and regular inventory audits; before, not after budgets are spent chasing devices instead of people.
