How the interviewer opens it
“Design a service that detects invalid advertising clicks from bots and coordinated abuse. It must make fast decisions and assess past clicks while limiting errors against legitimate users.”
The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.
What to clarify first
- Decision meaning and charges
- Correction window and closure
- Scale and read to write mix
- Latency
- Availability, consistency, and durability
- Available signals and fraud types
- False positive definition
- Late events and labels
- Retention
- Scope limits
The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.
Scope of a strong answer
Core requirements
- Accept click events and return initial decisions
- Detect bots and coordinated abuse across related clicks
- Revise past decisions when new evidence arrives
- Apply charge rules and corrections within a fixed window
Usually out of scope
- Ad auctions and ad selection
- Payment processing and invoice delivery
- Detailed model development
- A complete conversion attribution service
What interviewers ask about
- Decision speed and missing data
- Each click needs a fast decision, but recent behavior arrives later. Missing evidence must not become proof of fraud.
- Related clicks across publishers and devices
- Coordinated abuse can remain below each local threshold. Shared networks and popular publishers can produce similar patterns without fraud.
- Changes to past decisions
- Late evidence can reverse decisions. Charge corrections must remain correct despite duplicate messages, delayed messages, and a fixed financial deadline.
- Errors against legitimate users
- Labels cover a biased sample. Temporary holds and later revisions can harm legitimate traffic even when final decisions look correct.
Common mistakes
- Treating a shared IP address as proof that clicks come from one actor
- Using only individual click rules and missing coordinated abuse
- Treating missing data as fraud evidence
- Handling decision versions without an atomic financial deadline check
- Leaving suspicious charge rules or closure behavior undefined
- Measuring only final errors and ignoring holds or earlier incorrect decisions
The bar by level
- Senior (L5/E5)
- Designs feature windows, versioned corrections, and atomic closure. Evaluates cumulative false positives through independent audits. Explains failures and safe recovery.
- Staff (L6+/E6+)
- Defines ownership across regions and reconciles decisions with frozen charges. Sets release limits despite biased labels. Plans clock authority, recovery capacity, and privacy changes.
Sources · 1 reference
These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.
SysRound · 1 record
No company association
Design an ad click fraud detection system
Reported date not specified
Source snapshot: Nov 12, 2026
View source