The Security Breach We All Feared Has Happened

[00:00:01] It is Wednesday, July 3rd. Today, the hack nobody wanted, how a leading two-factor authentication app used by marketers worldwide is now exposed. Plus, TikTok slows down, a deep dive into Google's changes to its ads platform, and the clever technique consumers are using to see if you

[00:00:21] are gouging them. I'm Tod Maffin. That's a head today in Digital Marketing. A major hack has put millions of accounts at risk and the hack happened at the one place you don't want it to, a provider of two-factor authentication services. The service in question

[00:00:39] is called Authy. It's a two-factor authentication app that competes with the popular Google Authenticator. It's one of those apps that generates a six-digit code when you're trying to log into a website. The company that owns Authy is Twilio, the large SMS

[00:00:53] marketing platform. It says hackers were able to get data associated with millions of Authy accounts, including phone numbers. This happened apparently because Twilio left an endpoint in their API open without any login requirements. They say they've closed that

[00:01:10] now. The hackers posted their find on a forum and claimed to have downloaded 33 million phone numbers of account holders. Tech Crunch and its reporting of this today spoke to Rachel Tobak from Social Proof Security who explained, quote, if attackers are able

[00:01:24] to enumerate a list of users' phone numbers, then those attackers can pretend to be Authy to those users, increasing the believability in a phishing attack to that phone number, unquote. There is sadly not a lot you can do other than to update the mobile app

[00:01:41] and change your password there. This is not the first data breach that Twilio has suffered. Two years ago, a group of hackers got into the files of more than 100 of its clients. With that data, they conducted a huge phishing operation around the world.

[00:01:55] In the end, 10,000 employee credentials from at least 130 companies were stolen. Ad spending on TikTok has been growing year over year, but the pace has slowed since a potential US ban was announced in March. According to media radar, ad spend in

[00:02:15] March rose 19% compared to the previous year, but growth cooled to 11% in April and 6% in May. 9 out of 20 advertising categories saw month over month increases in April with consumer services leading the way up 115% according to Sensor Tower. Despite this, the

[00:02:34] average daily spend on TikTok dropped by 2% month over month in April. Four of the top 10 advertisers, including Target and DoorDash, reduced their spend. Some brands have shifted their focus on TikTok from brand awareness to more performance-driven

[00:02:51] goals since the potential ban announcement. Some analysts say that shift is what's caused the deceleration in ad spend growth. But while spend is down, the price is up. TikTok's CPMs for upper funnel metrics increased by 15% year to

[00:03:07] date. And TikTok's user growth, especially among younger people, is stagnating. The percentage of weekly users aged 18 to 24 has dropped from 35% in 2022 to 25% in 2024. Users aged 35 to 44 increased slightly. Average daily time spent on TikTok also decreased though only from 52 to 51 minutes.

[00:03:33] 80 is time to check in with our Google ads correspondent Jill Sasken-Gales. Jill spent six years at Google ads. Today she runs the Inside Google Ads training program for marketing practitioners and is host of the Inside Google Ads

[00:03:49] podcast. Jill, good morning. Hello. Hello. So Google announced some updates to query matching last week. Was this a big deal? I call this a medium deal. Yeah, there was some cool announcements. Really two separate things that I guess

[00:04:03] Google does bundle together for us. First is how brand queries are handled. And second is how misspellings are handled. So on the brand side, brand restrictions are now renamed brand inclusions. And so what that means-

[00:04:19] Which is good. Which is good. It's more clear because we used to have two features which you and I spoke about a couple months ago, brand restrictions and brand exclusions. And it's hard to keep track of what each of those

[00:04:29] means. So now we have brand inclusions and brand exclusions. And they work like they sound like if you add brand inclusions to a broad match keyword campaign, it lets it know what kind of searches you would like to show on.

[00:04:44] And if you add brand exclusions, it lets know what kind of searches you don't want to serve on. And so practically this is because when you use broad match keywords, the broad match keyword Google Ads course,

[00:04:57] that really gives Google permission to show your ads on anything that has anything at all to potentially do with the idea of Google Ads course, including meta ads, training, learn Google ads. Like it can go really, really broad there. And so because of that, your own brand queries

[00:05:15] would often sneak in there and even competitor brand names can sneak in there. So what these two features let you do with brand exclusions, you can say I want to use broad match keyword, but I don't want to

[00:05:24] advertise in my brand or vice versa. I want to use broad match keywords and only advertise in my brand. So that's kind of the first part of this announcement. And the misspellings part, what is that about?

[00:05:36] This is an interesting one and definitely was not on my 2024 bingo card. So right now if you want to exclude misspellings, you have to look at every single potential way your keywords could be misspelled and

[00:05:49] exclude those. And so now Google is saying that when you add a negative keyword, like let's say you have a negative keyword for learn meta ads, if someone types in learn MEAT, learn meet ads, I guess, that's a misspelling.

[00:06:04] And that would also be excluded now by your negative keywords. So that's the negative part of misspellings. The really, really interesting part and I think the part most practitioners are looking forward to is misspellings being included in your search term report.

[00:06:18] So when you advertise, you pick your keywords, they match to certain user searches and you can see those searches in your search terms report. But a lot of the search terms you can't see due to privacy reasons. They're just kind of lumped under other search terms.

[00:06:32] And it's a big controversy in the PPC community that you can't even see what you're advertising on. And so with this change by adding misspellings as sort of variations of what the user intended to search for, Google's ads liaison, Jenny Marvin shared that about nine percent

[00:06:48] more search terms will now be visible. So whereas before these misspellings, you wouldn't even be able to see them. They would just be lumped under other search terms. Now they will be visible to you and you can optimize accordingly. So more visibility, more control.

[00:07:03] That's a rare thing to get from Google, but we're getting it here. You know, whenever Google makes these announcements, there's usually like a little bit of good, a little bit of bad. It's kind of a bit of a teeter-totter. Where would you put this?

[00:07:13] Is this I mean, this kind of feels like a net positive at the end of the day, these two announcements. It is a net positive. I'm sure Jenny was very excited to share these announcements with the community, but there's a potential caveat there.

[00:07:25] So, you know, your average Google ads user not going to see a difference. They're probably not going to be using most of these features. If you're a practitioner, I think these brand inclusion and brand exclusion features will encourage more people to test broad match keywords.

[00:07:39] And then, of course, being able to see those misspellings in your search term report, having them excluded as negatives. These are all good things. But the part that's not mentioned anywhere here, about why Google may be doing this, not only out of the goodness of Google's heart,

[00:07:52] but because of the way matching works and the way search interacts with performance max. So let's say someone searches Google ads course and you have a search campaign that could show an ad there and a performance max campaign that could show an ad there.

[00:08:06] The way that works is if you have an exact match keyword, search will win. But otherwise it's kind of up in the air and a lot of times performance max will win. So with these changes here today, it is encouraging people

[00:08:19] to use more broad match keywords rather than exact match. And because all these different misspellings are just taken care of now, it's encouraging people not to have all these misspellings as keyword, which again would get performance max more leeway. So I think the hidden reason, in my opinion,

[00:08:36] why Google might be doing this is to kind of set the stage for people to have fewer keywords and fewer controls, which will allow for more automation and formats like performance max to take over in your account. But that's just my personal theory.

[00:08:49] Well, I think it I think in the end it's fairly good news. I for one am more excited about the fact that this is one of the few interviews that you and I have done in this year where we have not mentioned a I want.

[00:09:02] It was really hard, Todd, but I tried my best. All right, Joe, thanks. Thank you. Joe's asking Gales is our Google ads correspondent. She's here every second Wednesday. You can learn more about her Google ads training program at our affiliate link at today in digital.com slash GA.

[00:09:23] A really interesting piece in business inside of this morning talks about how consumers are using the reorder items function in Instacart's mobile app to see just how much prices have gone up in the last few years. One fellow profiled in the piece compared his past and present

[00:09:39] grocery bills and found his thirty five dollar order from twenty nineteen would now cost more than sixty two dollars if he reordered the same products. He shared this on his TikTok where it's gone a little viral. Another TikTok user reported that their Walmart plus order

[00:09:54] tripled in price over just two years, although that was possibly due to the app replacing out of stock items with pricier alternatives. Don't blame inflation alone for it. Cumulative inflation over the past five years is around twenty three percent.

[00:10:11] That's high for sure, but it's not triple part of the issue might be shrinkflation, which reduces item sizes. And of course, it's the outliers that tend to go viral in its coverage business insider analyzed past Instacart orders from Los Angeles and New York City.

[00:10:26] One order from twenty twenty increased twenty two percent over four years. Another was up seventeen percent. All that to say if you are a merchant and you sell things online and your prices have gone way, way up in the last few years.

[00:10:40] And you would rather maybe not make it so obvious. I'm not saying, you know, like remove the reorder. Fuck, I wouldn't say that or like I wouldn't say hide it or make like the background text the same color as the four round.

[00:10:55] Every social media platform has its own tick on YouTube. It's smash that like button on Facebook Marketplace. It's is it still available? And on TikTok, it's often send this to a friend. The creator doesn't really care about your friend.

[00:11:10] They care about you tapping that send button on TikTok. It's considered one of the strongest algorithmic signals. Your video will get more reach if 100 people send it to a friend and if 100 people tap like now, Instagram appears to be picking up on that

[00:11:26] and some new advice from the app's head says you should do that as well. Quoting Adam Masari, quote, don't force it as a creator. But if you can when you're making content, think about making content that people would want to send a friend to

[00:11:40] to someone they care about and it will help your reach over time, unquote. You might have even seen them moving in this direction. They recently started showing how many sends were logged for each post. This has been in testing for a year or so.

[00:11:54] It looks like it's rolling out more widely now. A recent Harvard Business Review study of tens of thousands of posts found that while you can exploit emotion to get engagement, there is a specific emotion you should reach for if you want that engagement

[00:12:08] to be a send or a share. Quoting from that study, quote, articles with a large number of comments were found to evoke high arousal emotions such as anger and happiness paired with low dominance emotions where people felt less in control

[00:12:25] such as fear on the other hand, social sharing was very connected to feelings of high dominance where the reader feels in control, such as inspiration or admiration, unquote. So again, high dominance is an emotion that's within the user's control, a feeling that they can regulate.

[00:12:44] Low dominance is the opposite. Think anger or fear. Again, quoting Harvard Business Review, quote, our study found that admiration and happiness have a strong correlation with high dominance. This makes sense since the motivation for sharing upbeat content may be rooted in self-preservation.

[00:13:01] Passing on a positive emotional experience makes others feel good, which in turn makes the share look good, including an element of surprise can help magnify the content's positive balance, unquote. We have a link with more information about that Harvard Business Review study in today's email newsletter,

[00:13:17] which you can sign up to for free by tapping the link at the top of the show notes or going to today in digital.com slash newsletter. What do you want to be? Do you want someone who understands you like no other?

[00:13:31] Someone who can be your wish and want to experience the most beautiful adventure of your life with you? The shopping platform Shopify revolutionizes millions of companies worldwide. With Shopify, you only focus on your online shop, without programming or design knowledge.

[00:13:50] Thanks to the efficient integration and intuitive social media and online marketplace integration, you can sell and sell through Instagram, eBay and Co. It was never easy to reach new target groups. Shopify offers on a single secure platform all tools to build up your online business.

[00:14:09] Test without cost and present a business of the world. shopify.de slash try visit. Simply enter shopify.de slash try and start. Made for Germany, powered by Shopify. Let's be honest, retros can be boring. And if you're the organizer, you know it's more than just running a meeting.

[00:14:30] You have to synthesize and categorize themes, get the team involved, design next steps and make it all a fun safe space where teammates want to participate. Miro is the visual collaboration platform that helps you run effective, engaging and actionable retrospectives.

[00:14:47] We use Miro at our agency to map out a client's messaging for our engagement team. That can be complicated, a lot of if bends, but making it visual and sharing it directly with our client, sped things way up. Plus, our side can share spitballing ideas with private mode.

[00:15:03] The client doesn't get to see our thoughts until we've decided on the approach. Whether you work on the marketing side or in product design, engineering or UX, bring your team together on Miro and your first three Miro boards are free when you sign up today at

[00:15:19] Miro.com. That's three free boards at Miro.com. Proton, the privacy focused email platform has launched a new document platform that would compete with Google Docs. The proton doc system though is end to end encrypted, meaning not even they can see within the documents.

[00:15:39] This starts rolling out today, starting with a web based documents editor. It includes everything you'd expect, changes, formatting, adding links and images in the likes, collaboration features like real time editing and commenting are also built in. Proton docs encrypts not just the content, but also keystrokes,

[00:15:58] mouse movements and file paths, making it somewhat unique among the major document editors. It might come as a surprise to many that Google Docs does not offer true end to end encryption for all its users. While it does encrypt files in transit and while they're being

[00:16:14] stored, Google holds those encryption keys, which means that Google has the ability to access and view the contents of your files anytime they want. Organizations that pay for Google Workspace can use client side encryption, which encrypts files before they are uploaded

[00:16:30] to Google Drive with only the customer holding those encryption keys, but it's still not truly end to end, which is considered the gold standard. And we'll wrap up with a quick jump over to the lightning round. Meta announced today that threads is now used by more than

[00:16:49] 175 million users, but that's people who sign on just once a month. The more important metric is those who sign on daily. Meta has not shared those numbers yet, which as the Verge notes quote suggests threads is still getting a lot

[00:17:03] of flyby traffic from people who have yet to become regular users. The IAB Tech Lab final report on Google's privacy sandbox is out and the group concludes that Google's new sandbox will limit the marketing industry's ability to deliver targeted ads, putting smaller companies and brands especially at risk.

[00:17:24] An interesting think piece at Media Post for those of you who spend time in the retail media space, takes a deep look at Walmart's entry into the space both on the ad side and the fulfillment side. We have a link to that in today's newsletter as well.

[00:17:37] It is the fourth of July tomorrow that is an American holiday. We are in Canada, but we still take the American holidays mostly off because most of our news comes from the US and when there's an American stat holiday, no news really happens.

[00:17:49] That is on a Thursday, which means that a lot of Americans are taking Friday off as well, which means that there probably won't be a lot of news that anyway, all that to say we're taking a four day weekend starting now.

[00:17:59] And next week, my wife and I are going on holidays. Unfortunately, we still do not have our associate producer, the intrepid Steph Gunn back from Matt Lee. She's coming back in September. And so next week will be a little bit different.

[00:18:11] I wish I could tell you what it will be exactly, but I have not figured that out yet. I'm actually secretly working tomorrow doing agency stuff, of course, and we'll be figuring out what we do next week as well.

[00:18:22] At the very least, you will have two episodes in there either marketing science episodes or perhaps some documentaries about the world's most famous ad campaigns, which we worked on last year. We may end up rerunning those. That's next week. We take Mondays off in the holiday because again,

[00:18:36] slow news. So that means that our next regular episode in terms of the newscast will be just under two weeks from now, July the 16th. Don't forget to follow us on social media. We are almost everywhere. Facebook, Instagram, YouTube, LinkedIn, TikTok, threads, masted on Blue Sky, Snapchat

[00:18:59] and even Pinterest. Go to todayindigital.com slash social or tap the link in the show notes. So that will do it for this week until I see you next Tuesday and Thursday with those prepackaged episodes. Today in digital marketing is produced by EngageQ

[00:19:12] Digital on the traditional territories of the Sunamik First Nation on Vancouver Island. Our production coordinator is Sarah Gild. Our theme is by Mark Flevis ad coordination by Red Circle. I'm Todd Mappen. Thank you so much for listening. Have a restful long weekend if you are

[00:19:27] taking one and I'll see you again soon. Wusstest du, dass 10.000 der deutsche Unternehmen bereits Shopify nutzen? Von innovativen Startups bis hin zu Familienunternehmen mit langer Tradition? Die Commerzplattform Shopify revolutioniert Millionen von Unternehmen weltweit. Mit Shopify kannst du Produkte über beliebige Kanäle verkaufen.

[00:20:06] Ob persönliches POS System oder umfassende e-Commerce Plattform. Auch Social Media und Marktplätze wie Facebook, Instagram und eBay werden unterstützt. Dank der ständig wachsenden Auswahl innovativer Funktionen und des zuverlässigen technischen Supports ist es ganz einfach dein Business mit Shopify aufzubauen.

[00:20:24] Ob Produktpräsentation oder bestell und Zahlungsabwicklung. Shopify bietet alles was du für die Verwaltung deines Business brauchst. So kannst du dich ganz auf dein Business konzentrieren. Shopify kostenlos ausprobieren und dein Business voranbringen. Shopify.de-try besuchen. Also Shopify.de-try. Made for Germany. Powered by Shopify.