Install fraud

App install campaigns often pay per install (CPI/CPA), sometimes several dollars each. That price attracts two families of fraud.

The first is fake installs: installs that never happened on a real person's phone. They come from emulator farms, device farms that install, open and delete apps, then reset the device ID to look new, and SDK spoofing, which sends fabricated install messages directly to measurement servers without any device at all.

The second is stolen attribution: the install is real, but a fraudster claims the credit, through click injection or click spamming. That form is sneakier because the users exist; the advertiser simply pays for organic growth.

Mobile measurement partners detect install fraud with click-to-install-time analysis, device-ID reset detection, checks for emulator and rooted-device traits, SDK message signing, app-store receipt validation, and post-install behaviour such as retention and in-app events. A cohort that installs but never opens the app twice is a red flag. Fraudsters increasingly fake post-install events too, so advertisers who pay on deeper events still need verification.

Think of it like this

It is like a gym paying a promoter per new member signed up, and the promoter filling the forms with made-up names, or with people who had already walked in to join.

An example

A fintech app in Indonesia pays $2.50 per install. One partner delivers 40,000 installs a month, but 60% of the devices were first seen that week, share identical hardware models and never complete sign-up. The MMP rejects them and the partner's invoice is cut.