The scale of mobile ad fraud
According to Interceptd data, fraudulent installs were responsible for losses of $50 million per day in Q2 2019 alone. On Android, 31% of traffic in that period was classified as fraudulent (up 4 percentage points from Q1 2019). On iOS, the figure was 25% (up 3 percentage points).
These numbers reflect a serious and growing industry-wide problem. Fortunately, with the right knowledge and data analysis, it can be effectively combated.
The main types of mobile ad fraud
Click Spamming
Click spamming involves triggering clicks for users who never actually clicked. A mobile website can fire clicks in the background with no visible ads. A mobile app can generate such clicks at any moment, as long as it runs in the background on the user's device. Eventually, when the user installs the app being measured, the fraudulent click is attributed to what would otherwise be an organic install — and the fraudster receives a commission.
Click Injection
Click injection is a more advanced form of click spamming. It occurs when a fraudulent app is installed on a user's device, running in the background and capable of detecting when other target apps are being installed. At the moment the installation completes, the fraudulent app fires a click — again stealing what would have been an organic conversion.
Device Farms
Device farms are the lowest-tech form of mobile fraud: simply hundreds or thousands of phones, operated by a small number of people, on which target apps are mass-installed. Fraudsters use VPNs to assign installs to the correct geolocation. Devices are regularly reset to change their IDs, allowing the same apps to be reinstalled repeatedly.
How to detect and block fraudulent traffic
The most important tools are knowledge of fraud methodologies and deep analysis of available app data. The prerequisite is proper app measurement integration — without it, you're working blind.
Click-to-install time (CTIT)
CTIT is the time elapsed from ad click to app installation. Typical download speeds mean the process takes at least 30 seconds. A significantly shorter CTIT indicates Click Injection. An unusually long CTIT (roughly over 2 hours) suggests Click Spamming.
GrowthLift's platform allows advertisers to set acceptable CTIT intervals for both Click Injection and Click Spamming. Any install falling outside those parameters is counted with zero commission. The platform also shows, at the campaign statistics level, what percentage of a given publisher's traffic is flagged as suspicious — allowing advertisers to make informed decisions about whether to retain or remove a partner.
Geolocation of clicks, installs, and in-app events
Traffic from device farms or bots is often masked through VPNs. Compare the geolocations of clicks, installs, and in-app events to detect suspicious discrepancies — in extreme cases, a click and install might be registered in country X while user activity inside the app is attributed to country Y.
Install-to-event conversion and retention rate
Installs from device farms are followed by near-zero engagement — the app is typically deleted within a very short time. Low retention and low in-app conversion rates are clear signals of fraudulent traffic quality.
Click-to-install conversion rate
An unusually high conversion rate may suggest incent traffic. An unusually low rate may indicate basic click spamming. Establish Hard KPIs before campaign launch — including acceptable conversion rate ranges — and agree that installs falling outside those parameters will not be compensated.
Knowledge and data analysis are the key
Fraud risk in mobile is real and growing — but with the right tools, the right platform, and the right data analysis approach, it is entirely manageable. GrowthLift's platform provides the visibility and control advertisers need to protect their campaigns and budgets.
