How Click Flooding Works
Click flooding is a volume game. The fraudster does not know which people will install your app, so they send clicks for as many devices as possible and wait for chance to do the rest. If a person installs your app organically and one of the flooded clicks for that device or IP falls inside the lookback window, last-click attribution credits the install to the flooding source.
The clicks come from many places. Some are fired in the background from apps or web pages where users never saw an ad. Some are generated on servers with harvested advertising IDs or IP addresses. Some come from ad formats that count a tiny impression as a click. The common thread is that the click had nothing to do with the install.
Flooding is cheap to run and hard to notice without the right reports, which is why it remains one of the most common types of mobile ad fraud.
Signals in the Data
Conversion rate is the first warning. Real ad clicks convert to installs at rates that vary by channel but are rarely microscopic. A source producing millions of clicks and converting a tiny fraction of a percent is matching coincidences, not driving installs.
Click-to-install time is the second. Real clicks lead to installs mostly within minutes or hours, with a falling tail. Flooded clicks produce a flat distribution stretched across the whole lookback window, because the install timing is random relative to the click.
The third is correlation. When a real source doubles its clicks, its installs rise. When a flooding source doubles its clicks, installs barely move, because they are your organic users. Plot the source's daily installs against your organic trend: if they move together, the source is likely stealing organic credit.
Click Flooding by IP and by Device
Flooding operations often reuse the same infrastructure, which gives you sharper rules. Many clicks from one IP address in a short time rarely reflect real people, even on shared networks. Many clicks tied to the same device signals point to one machine generating traffic. Both patterns are easier to act on than statistical distributions, because they identify specific clicks rather than whole sources.
Linkrunner's Fraud Control library includes click flooding rules by IP and by device. You can preview how a rule would have affected past installs, adjust the thresholds, and then turn it on to tag matching installs or withhold their postbacks. Flagged installs stay in your reporting totals so you can review them and raise them with the partner. See fraud protection.
Prevention
Start with lookback windows. A 30-day click window gives flooded clicks a month to collide with organic installs. Many teams keep longer windows only for self-attributing networks and trusted partners, and use shorter ones elsewhere. Linkrunner lets you set click lookback windows from 1 to 30 days, with Google and Meta defaulting to 30 and other networks to 7.
Ask for sub-publisher IDs on every click so you can isolate the source within a network. Watch your organic install trend closely: a falling organic line while a paid source grows without matching spend or click growth is a classic sign. And review new sources daily in their first weeks, before their numbers become part of your baseline.
Why It Matters Beyond Payouts
The payout is the visible cost. The hidden cost is bad decisions. Flooding makes your organic growth look weaker and a fraudulent channel look stronger, and because the stolen users are real and engaged, the fraudulent channel's cohort metrics look excellent. Budgets move toward it. Fixing click flooding often changes the answer to "what is actually driving our growth," which is worth more than the recovered spend.
Click Flooding and Self-Attributing Networks
Self-attributing networks such as Google, Meta and Apple Ads claim installs through their own integrations rather than through click links, so they are not a channel for click flooding in the usual sense. Flooding mostly enters through networks and affiliates that send clicks through tracking links, especially those that resell inventory from many sub-publishers.
That shapes where to look. Start with link-based sources that show the classic signals, rank them by flagged installs, and drill into sub-publishers. A single sub-publisher often accounts for most of a network's flooding.
Also check the interaction between sources. When a flooded click and a self-attributing network both claim the same install, the attribution rules decide who wins, and a flooding source can take credit from a legitimate paid channel as well as from organic. Reviewing overlap between claims is a useful way to see how much a flooding source is costing your other channels, not just your organic baseline.