Click flooding

Click flooding (also called click spamming) is a form of attribution fraud in app advertising: the fraudster sends huge numbers of fake clicks tied to the devices of many people, then waits for some of them to install the app on their own, so the fake click becomes the “last click” and takes credit for the install. It is a type of click fraud that targets last-click attribution.

What is click flooding?

Most MMPs credit an install to the last click inside the attribution window. At Adjust, the default window for clicks matched by device ID is 7 days, and it can be set anywhere from 1 to 30 days (Adjust Help Center, Attribution windows, accessed October 2026). Fraudsters exploit exactly this. They send clicks for as many devices as possible, and whenever one of those devices installs the app within the 7 days, the fraudulent source gets paid.

Adjust describes the goal of click spam as “poaching” installs from organic users, people who would have downloaded the app anyway. The clicks can come from impressions reported as clicks, from servers sending lists of artificial clicks, or from an app that loads and clicks hidden ads while running in the background (Adjust Help Center, Distribution Modeling, accessed October 2026).

Why click flooding is hard to spot

The users whose installs are hijacked are real. They open the app, retain well, and sometimes buy, so the fraudulent source looks like a good channel. The damage shows up elsewhere: you pay for organic installs, the organic number in your reports drops, and more budget flows to a channel that brings in no new users.

Warning signs

The clearest signal is click-to-install time (CTIT). Adjust says more than 85% of installs from legitimate traffic happen within the first hour after the click. With click spam, the user never clicked an ad, so installs are spread evenly across the attribution window. If most of a source’s conversions happen 60 minutes or more after the click, Adjust starts rejecting attribution for that click and passes the install to the next valid source or to organic (Adjust, Distribution Modeling).

A few more signs:

• Millions of clicks but a click-to-install rate of only a few per thousand.
• The same device receiving repeated clicks on a regular cycle.
• Organic drops when the source is switched on and recovers by a matching amount when it is switched off.

The Media Rating Council requires accredited measurement providers to look at the time between impression, click and install (MRC, IVT Standards Addendum, June 2020). On Android, the Play Install Referrer API returns the referral link and the time the user actually clicked before landing on Google Play (Android Developers, updated February 2026), which gives the MMP more data to check against the clicks an ad network reports.

Click flooding vs. click injection

For more on the second type, see click injection.

Example (hypothetical)

A food delivery app pays ad network X VND 20,000 per install. In one month, X reports 2 million clicks and 4,000 installs, a rate of 0.2%. Over 60% of those installs happen 6 hours or more after the click. In the week X is paused, organic installs rise by about 900, close to the 1,000 installs X usually reports per week. Most of the VND 80 million paid to X each month is likely paying for users who came on their own.

FAQ

Is a long CTIT always fraud?

No. Adjust notes that real traffic can still get flagged, for example when a technical issue slows users down between the click and the install.

Does a shorter attribution window help?

Partly. A shorter window cuts the chance of catching random installs, but it also cuts legitimate installs that arrive late. Combine it with your MMP’s CTIT distribution filter.

If your organic numbers move in step with a paid channel being switched on and off, take a look at Adtek’s App User Acquisition solution.