The bid request says CTV. Nobody is required to check. So here is how to check

Connected TV is the fastest-growing line on most media plans I see, in the US, the UK, Australia, the Gulf and India alike. It is also the line with the weakest paperwork.

In September 2026 the person who maintains the rulebook for programmatic bid requests said two things in the same hour. First: "Tech Lab doesn't have enforcement power." Second, about streaming inventory: if you accept only a deal ID and do not insist on an app bundle ID, "you could think that you're buying from a perfectly legitimate seller and it's full fraud." (IAB Tech Lab's OpenRTB lead, quoted by ADOTAT, 15 September 2026.)

That is the CTV market in two sentences. A rulebook with no police, and a loophole the author can recite from memory.

The good news is that every file you need to close the loophole is public, and the checks take minutes. The bad news is that nobody gets paid to run them, so almost nobody does.

How big the gap is

Pixalate found 43% of CTV bundle IDs it saw in Q3 2025 were malformed, unidentified or fraudulent, and that 80% of fake Roku bundle IDs copy the name of a real brand. In India, where festive CTV spend has grown from about Rs 180 crore in 2022 to about Rs 1,200 crore this year (roughly US$140 million, BestMediaInfo, 16 September 2026), an ad-fraud monitoring firm found 15.86% of festive CTV impressions broke their frequency cap and 16.47% were blocked as invalid traffic. One smart TV was sending more than 7,600 ad requests a day. No family watches that much television.

The reach numbers everyone plans against are also softer than they look. India's headline figure of 207 million CTV viewers comes from a survey commissioned by a media agency group and a buying platform. It is a good study. It is not a currency. In the US, VideoAmp and Nielsen One Ads both stepped away from independent MRC accreditation in July 2026. If the reach is unaudited and the supply is unverified, the plan is two assumptions stacked on top of each other.

Six checks, in the order a supply path lies

A supply path lies in a fixed order, so check in that order. Each check names the field in the bid request and the public file it is tested against.

1. The app. Does app.bundle in the bid request match a real app in a real app store? A similar name is not enough. It has to be the same ID.

2. The file. Does that app publish an app-ads.txt file, and does it list the seller offering you the inventory, with the right account ID? The file sits at a public web address. It takes ten seconds to open.

3. The seller. Does the exchange's sellers.json list that seller ID, and is it marked PUBLISHER or INTERMEDIARY? An intermediary selling "direct" inventory is your first red flag.

4. The chain. How many nodes are in the schain object? One or two is normal. Five means four companies you have never heard of are each taking a cut.

5. The device. Is device.devicetype a television (3 or 7 in OpenRTB), and does the user agent agree? A "CTV" impression that arrives with a mobile user agent is a phone wearing a costume.

6. The label. Does the content object match what the deal is being sold as? Premium sports at a bargain CPM is usually a mislabelled slot.

For each check there is a question for your SSP, and for each question there is a standard dodge. "That data is not available." "All our partners are vetted." "The deal ID covers that." The follow-up is always the same: please send the files. They are public. If they will not send them, you have your answer.

The workaround when nobody will send you anything

You do not need the SSP. Take your log-level data or your top 50 placements report. Put the bundle IDs in one column. In the next column, pull each app's app-ads.txt with a spreadsheet import function (IMPORTDATA in Google Sheets does it). In the third column, search that file for your SSP's seller ID. Anything that returns blank is inventory you are buying on trust. It is a two-hour job, and the first time you do it the result is usually a very quiet meeting.

What we do about it

Every campaign we launch goes through these six checks before it goes live. Campaigns go live within 48 hours of the brief, and only after the checks pass. That gate is a big part of why our execution accuracy runs at 99.9%, with a root-cause note on every error. None of the checks is clever. They are simply run every time, by a system, rather than by whoever happens to be on shift.