Basically all "spyware" traffic is encrypted, you can however see which IP's users of your network connects to (and some meta-data such as domain name, protocol and hand-shakes) using for example Wireshark or tcpdump. My guess is that the fraud is detected by monitoring the traffic on the ad server, see that a "impression" is registered from their test phone's IP, and by looking at the phone they affirm that no ad was displayed.