Click injection

In app marketing, the ad network credited with the last click before an install usually gets paid (see attribution). Click injection hijacks that rule. A bad app already on the phone, often a flashlight or cleaner app, notices when the user starts installing something else, then quickly sends a fake click on behalf of a fraudulent source. The real install, which the user chose organically or because of a different ad, is credited to the fraudster.

The mechanism relies on the phone broadcasting install activity to other apps, which is why it historically affected Android most. Google's Play Install Referrer API gives MMPs timestamps for when the click happened and when the install started, so a "click" logged after the download began is a strong signal.

The classic detection signal is click-to-install time (CTIT): a real user needs time to see an ad, visit the store and download, but injected clicks show abnormally short gaps, often a few seconds. Injection is classed as attribution fraud and SIVT. It is different from click spamming, which floods clicks hoping to get lucky, and shows long, flat CTIT distributions instead.

Think of it like this

It is like someone standing at the checkout who, just as you pay, shouts "I recommended this shop to them!" and pockets the referral bonus.

An example

An MMP sees 12,000 installs from one network in India where 70% of clicks arrive less than 10 seconds before the install begins, compared with a typical spread of minutes to hours. The installs are rejected as injected.