The fraud crisis
According to Interceptd's Q2 2019 Mobile Ad Fraud Report, fraudulent installs cost the industry $50 million per day.
The scale is staggering:
- Android: 31% of analyzed traffic was fraudulent (up 4 points QoQ)
- iOS: 25% of traffic was fraudulent (up 3 points QoQ)
The good news? With proper knowledge and data analysis, you can fight back effectively.
Understand the fraud types
Click Spamming
Fraudsters generate clicks for users who never actually clicked. Invisible clicks fire in the background—on mobile websites or in apps running silently.
When a user later installs your app organically, that fraudulent click gets attributed to it, and the scammer gets paid.
Detection: Look for unusually long delays between click and install (e.g., >2 hours).
Click Injection
A more sophisticated form of spamming. The fraudster's app detects when legitimate apps are being installed, then injects a fake click just before the installation completes.
This steals credit for organic installs.
Detection: Watch for click-to-install times (CTIT) that are suspiciously short (e.g., <30 seconds). Normal install time is at least 30 seconds due to network speeds.
Device Farms
The least technical method. Fraudsters operate hundreds or thousands of phones (with VPN to mask location) and manually install your app repeatedly on reset devices.
Detection: Monitor for repeated installs from the same device IDs, unusual geographic patterns, or install surges with zero in-app activity.
Key detection metrics
Click-to-Install Time (CTIT)
Measures the lag between clicking an ad and installing your app.
- Under 30 seconds: Suspicious (indicates injection)
- 30 seconds – 2 hours: Healthy range
- Over 2 hours: Suspicious (indicates spamming)
Set these thresholds in your MMP to auto-reject fraudulent traffic with zero payout.
Geo-Location Consistency
Compare the location of clicks, installs, and in-app events. Device farms often use VPNs, creating mismatches (e.g., click in UK, install in Nigeria, user activity in Pakistan).
Track geographic anomalies per publisher and block if suspicious patterns emerge.
Conversion & Retention Rates
Device farm installs show near-zero conversion and retention. If users install but never engage, it's a red flag.
Analyze:
- % of installs that activate (launch the app)
- % that complete first action (registration, purchase, etc.)
- Day 1, Day 7, Day 30 retention
Low-quality traffic will fail these benchmarks spectacularly.
Fraud-fighting strategy
- Integrate a robust MMP (AppsFlyer, Adjust, Kochava)
- Set CTIT thresholds to auto-reject click spamming and injection
- Monitor geo patterns for VPN-masked device farms
- Measure conversion and retention to identify low-quality sources
- Black-list publishers showing consistent fraud patterns
These steps won't eliminate fraud entirely, but they'll dramatically reduce your exposure.
