Attribution fraud

What is Attribution fraud?

Attribution fraud is the practice of falsely claiming credit for mobile app installs or in-app conversions without generating the actual user action. Fraudsters manipulate attribution systems to intercept or fabricate conversion signals, redirecting payment away from legitimate sources. Attribution fraud causes direct financial losses for advertisers and distorts campaign analytics, making accurate measurement and optimization impossible.

How it works

Attribution fraud exploits the mechanics of mobile measurement, where ad networks and affiliates receive payouts based on credited conversions. Fraudsters use several techniques to insert themselves into the attribution chain and claim credit they did not earn.

Click Flooding

Click flooding, also called click spam, involves sending massive volumes of fraudulent click signals across many device IDs. The goal is to register a click just before a legitimate user installs an app organically or through another channel. If the fraudulent click falls within the attribution window, the fraudster receives credit for the install.

Click Injection

Click injection is a more targeted form of fraud on Android devices. Malware installed on a user's device listens for broadcast signals indicating an app download has begun. The malware fires a fake click at that moment, ensuring the fraudulent source is the last recorded touchpoint before install. This technique produces high apparent conversion rates and is harder to detect without click-to-install time (CTIT) analysis.

SDK Spoofing

SDK spoofing generates fake install and event signals by replaying legitimate network traffic. Fraudsters reverse-engineer the communication between an app's SDK and the attribution provider, then fabricate install reports without any real device or user being involved. No real impressions, clicks, or installs occur.

Device ID Reset Fraud

Device ID reset fraud, also known as device reset fraud, involves repeatedly resetting a device's advertising ID after each fraudulent install. This allows a single physical device or a small farm of devices to register as multiple unique users, inflating install counts and draining advertiser budgets.

Install Hijacking

Install hijacking occurs when malware intercepts the install referrer signal on a device that is genuinely downloading an app. The malware replaces the legitimate referrer with a fraudulent one, stealing attribution credit at the last moment before the install is recorded.

Fake Referral URLs and IP Spoofing

Fraudsters also craft referral URLs that mimic legitimate affiliate or publisher sources, and spoof IP addresses or device fingerprints to make fabricated conversions appear to originate from real users in targeted geographies. These techniques defeat basic source-level filtering and require behavioral and fingerprint analysis to detect.

Why it matters

Attribution fraud directly inflates cost-per-install and cost-per-action spending by diverting budgets to fraudulent sources that deliver no real users. Beyond the financial loss, fraudulent conversion data corrupts campaign analytics, leading marketers to misallocate budgets toward channels that appear to perform well only because fraud inflates their numbers. Campaigns optimized on polluted data produce poor downstream results, as the users attributed never actually exist or engage. Legitimate publishers and affiliate partners are also harmed when fraudulent sources displace their earned credit. Detecting and blocking attribution fraud requires a combination of anomaly detection on CTIT distributions, IP and device fingerprint analysis, publisher-level traffic auditing, and integration with a mobile measurement partner (MMP) that applies multi-layered fraud detection across the attribution pipeline. Maintaining blocklists of known fraudulent sources and requiring app-ads.txt compliance from supply partners reduces exposure to the most common fraud vectors.

How to detect and protect against attribution fraud

Protecting campaigns from attribution fraud requires both technical controls and ongoing monitoring practices.

1. Analyze click-to-install time (CTIT) distributions. Legitimate installs take a realistic amount of time between click and install. Statistically abnormal CTIT distributions, such as installs occurring within seconds of a click or after unusually long delays, indicate click injection or click flooding respectively.

2. Monitor install volume anomalies by publisher and sub-publisher. Sudden spikes in install volume from a specific source, especially without proportional increases in downstream engagement, signal fraudulent activity. Use sub-publisher reporting to isolate problematic traffic sources.

3. Enforce app-ads.txt and ads.txt compliance. Requiring supply partners to maintain authorized seller files limits the ability of unauthorized actors to resell or misrepresent inventory.

4. Apply device fingerprint and IP analysis. Clusters of installs sharing IP addresses, device characteristics, or behavioral patterns identify device farms and emulator-based fraud.

5. Implement server-to-server (S2S) postback verification. S2S postbacks make it harder for fraudsters to intercept or replay attribution signals compared to client-side tracking alone.

6. Use an MMP with integrated fraud detection. Platforms like Airbridge apply rule-based and machine-learning fraud detection across attribution data, flagging and rejecting suspicious installs before they affect reporting or trigger payouts.

7. Maintain and update blocklists. Known fraudulent publishers, IP ranges, and device IDs should be blocklisted and refreshed regularly based on ongoing traffic analysis.

Related concepts