Click injection

Click injection is a type of attribution fraud on Android: an app already on the phone detects that the user is installing another app, then fires a fake click just before that app is opened for the first time so it can claim credit for the install. For installs from Google Play, the technique has been largely neutralized by the timestamps in the Play Install Referrer API.

What is click injection?

A user finds an app on Google Play on their own, or taps a legitimate ad, and then taps Install. While the app is downloading, another app on the same device learns that a new package is about to appear and immediately sends a click, along with the device’s advertising ID, to the measurement platform. When the app is opened for the first time, the fake click is the most recent one, so under last-click rules it wins.

Only Android is affected, because the operating system uses broadcasts to tell other apps when a new app has been downloaded, and any app can listen to those broadcasts (Adjust Help Center, Click Injection filtering, accessed October 2026). Google Play explicitly bans apps that send fake attribution clicks to get paid for installs their network did not drive (Google Play Console Help, Ad Fraud, accessed October 2026).

The advertiser pays CPI for installs that were really organic installs or came from another source. Worse, the fraudulent source looks like the best performer in the reports and gets even more budget.

The changes that made click injection obsolete on Google Play

• 2017: Google launched the Play Install Referrer API, which pulls data directly from the Play Store. March 1, 2020: Google deprecated the install_referrer broadcast, saying the new API was better at preventing spoofing and attribution fraud (Android Developers Blog, November 2019). The API returns both the time the link was clicked and the time the install began (Android Developers, Play Install Referrer Library, February 2026).
• Android 8.0: apps targeting API 26 or higher can no longer declare receivers for implicit broadcasts in the manifest, and ACTION_PACKAGE_ADDED is not on the exemption list (Android Developers, February 2026).
• Android 11: the list of installed apps is filtered by default, and the QUERY_ALL_PACKAGES permission has to be approved by Google Play (Android Developers, Package visibility, October 2026).

The deciding signal is the install begin timestamp. Adjust compares the click time with install_begin_time: a click that arrives after that point is treated as injected and rejected, and a second filter layer uses install_finish_time recorded by the SDK. Rejected installs appear under the label Rejected Install; Click Injection and are reattributed to the legitimate source or counted as organic.

The remaining gap is installs from outside Google Play and Huawei AppGallery. Without a referrer API that reports when the install began, the filter can only rely on install_finish_time, so apps distributed through third-party stores or APK files are still at risk.

Illustrative example (hypothetical)

A finance app runs Android campaigns at a CPI of VND 15,000. Network A reports 2,000 installs for the month, worth VND 30 million. When the raw data is checked, 1,200 of those installs have a click time later than install_begin_time. Without filtering, VND 18 million would be paid for installs Network A did not drive.

Click injection vs similar fraud types

All three belong to the click fraud family that targets attribution, unlike fully fake installs, which are covered under install fraud. How to read the distribution of time from click to app open is explained in the CTIT entry.

Frequently asked questions

Is iOS affected by click injection?

According to Adjust, no, because the technique depends on Android’s new-install broadcasts.

I already use an MMP. What else should I do?

Check that the filter is turned on and which mode it is in. Adjust offers Strict (rejects every click from a tracker that has a flagged click) and Normal (rejects only the flagged clicks). Then reconcile invoices against the post-filter install count.

If you want to review your Android traffic sources and how you reconcile with networks, see Adtek’s App User Acquisition page.