What is install fraud detection?
Install fraud detection is how an attribution platform identifies fake or stolen installs, using rules and signals applied to each install and the click behind it. The goal is to separate real users from bots, device farms and credit-stealing tactics.
The main detection methods
- Click-to-install timing: a very short gap between click and install suggests click injection. A flat, uniform spread of delays suggests click flooding.
- IP signals: one IP generating many clicks or installs, or an IP that differs between click and install, can indicate bots or spoofed requests.
- Device signals: repeated clicks from one device identifier, or many installs from one device, point to scripted traffic or a device farm.
- Click patterns: extreme click volume with a very low conversion rate, or clicks recorded after the install began, can signal install hijacking.
- SDK integrity checks: installs reported without the signature of a real SDK on a real device may be SDK spoofing.
Why no single signal is enough
Genuine users sometimes install quickly, and shared networks can put many people behind one IP. Effective detection combines signals and then checks the source's quality downstream, for example retention and event completion, using post-install event tracking.
Detection versus response
Detection only labels an install. What happens next is a separate choice.
- Flag for reporting: the install is tagged so you can dispute or pause a source.
- Stop downstream signals: the install's postbacks are held back, so flagged installs do not reach ad networks. See rejection postback.
- Reject before credit: some systems refuse the install before attribution. See pre-attribution fraud rejection.
Reading the results
- Look at sources, not single installs: a handful of flags is noise, while a source with a high share of flagged installs is a pattern.
- Check timing curves: real installs decay after the click, while fraud often looks flat or implausibly instant.
- Re-tune over time: new fraud tactics and changing traffic mean rules need periodic review.
Related: install validation and attribution fraud.
How Linkrunner does this
Fraud Control provides 8 rule templates: click injection, install hijacking, SDK spoofing, SDK spoofing with IP mismatch, click flooding by IP, click flooding by device, installs from fraudulent clicks and reinstalls from fraudulent clicks. Each rule can Tag only, or Tag and withhold postbacks. Attribution is never changed, and Fraud Control is included on every plan.