Device ID reset fraud

What is Device ID reset fraud?

Device ID reset fraud is a mobile ad fraud technique in which a fraudster resets or spoofs the unique device identifier on a real or compromised mobile device to make it appear as a new, previously unseen device. This allows the fraudster to repeatedly bypass fraud detection systems that rely on device ID blacklists or install deduplication logic. The result is fraudulent installs, fake accounts, and illegitimate ad revenue generated from the same physical device cycling through multiple identities.

How it works

Device ID reset fraud exploits the way mobile attribution systems use device identifiers, such as GAID (Google Advertising ID) on Android and IDFA (Identifier for Advertising) on iOS, to track and attribute installs and in-app events.

Gaining Device Access

Unlike many other fraud techniques, device ID reset fraud does not require rooting or jailbreaking. Both Android and iOS expose a standard, user-facing setting that lets anyone reset their advertising identifier (GAID on Android, IDFA on iOS) without elevated privileges, which is exactly what makes this fraud technique easy to run at scale. On iOS, this matters less than it once did: since Apple introduced App Tracking Transparency (ATT) in iOS 14.5, IDFA is returned as all zeros for any user who has not granted tracking permission, which has pushed most iOS-side fraud toward SKAdNetwork manipulation rather than IDFA resets.

Cycling Device Identities

The fraudster resets the device's advertising identifier using this standard OS setting, uninstalls the target app if it was previously installed, and reinstalls it. Each reset produces what appears to attribution systems to be a completely new device. The fraudster then triggers an ad click, installs the target app, and potentially completes post-install events to claim a cost-per-install (CPI) or cost-per-action (CPA) payout. The cycle repeats continuously on the same physical hardware.

Operating at Scale with Phone Farms

Device ID reset fraud is frequently deployed in phone farms, where banks of physical devices are operated simultaneously. Each device can cycle through dozens or hundreds of fresh identities, generating a high volume of fraudulent installs from a relatively small number of devices. This makes the fraud difficult to detect through device-level signals alone, since each reset produces a seemingly legitimate new device fingerprint.

Detection Signals

Measurement platforms detect device ID reset fraud through several behavioral signals. Abnormally short click-to-install times (CTIT) indicate automated rather than organic behavior. Devices showing an unusually high number of first-time installs across a short time window are flagged as suspicious. Inconsistencies between device metadata, such as mismatched hardware fingerprints, OS versions, or IP address patterns, also reveal fraudulent resets. Duplicate IP addresses appearing across many attributed installs are a supplementary indicator of coordinated device ID cycling, though carrier NAT and shared networks can also produce this pattern.

Why it matters

Device ID reset fraud directly inflates install counts and drains advertising budgets by generating payouts for installs that have no genuine user behind them. Advertisers paying on a CPI or CPA model lose budget to fraudulent conversions that will never produce real lifetime value. Beyond wasted spend, fraud skews campaign performance data, making it harder to identify which channels and creatives are genuinely effective. Attribution models fed with fraudulent install data produce inaccurate signals, leading to poor optimization decisions. Fraud detection systems that rely solely on device-level blacklists are rendered ineffective because each reset creates a clean identity. This is why modern fraud detection combines device signals with behavioral analytics, CTIT analysis, and anomaly detection to identify patterns that survive a device ID reset.

How to protect against device ID reset fraud

Protecting against device ID reset fraud requires a layered detection strategy that goes beyond simple device ID blacklisting.

1. Monitor click-to-install time (CTIT). Fraudulent installs triggered by automated scripts show abnormally short CTIT values, often measured in seconds rather than the minutes or hours typical of genuine users. Set CTIT thresholds and flag or reject installs that fall outside normal ranges.

2. Analyze post-install behavior. Fraudulent installs rarely exhibit meaningful post-install engagement. Tracking in-app events and comparing engagement rates across traffic sources reveals sources with high install volume but near-zero downstream activity, a strong indicator of device ID reset fraud.

3. Check for duplicate IP addresses. A single IP address or IP range generating a disproportionate share of installs suggests coordinated fraud from a phone farm, though this is a supplementary signal since carrier NAT, corporate networks, and shared Wi-Fi can also produce it. Because phone farms use real devices on residential or mobile IPs rather than data center ranges, cross-referencing against data center IP ranges is more useful for catching emulator-based fraud than device ID reset fraud specifically.

4. Use device fingerprinting cautiously, and only where policy allows. Even when device IDs are reset, hardware-level attributes such as screen resolution, CPU type, and OS build may remain consistent, and comparing them across installs can help identify devices cycling through multiple identities. On iOS, Apple's Developer Program License Agreement prohibits deriving data to uniquely identify a device, so this technique is generally limited to Android.

5. Partner with an MMP that includes fraud detection. A mobile measurement partner such as Airbridge applies a combination of fraud validation rules, including CTIT-based lag time thresholds, device-information-based conversion traffic checks, touchpoint frequency capping, and IP blocklisting, then responds in tiers ranging from tagging a touchpoint as fraud to withholding its postback to excluding it from attribution entirely. This multi-signal approach catches fraud that survives a device ID reset, protecting attribution integrity and ad spend.

6. Maintain and update blocklists. Even though device ID reset fraud bypasses static blacklists, publisher-level and sub-publisher-level blocklists remain a useful layer. Combine them with behavioral rules to build a more resilient defense.

Related concepts