Click redirection

Click redirection (also called auto-redirect fraud) is a type of mobile web fraud in which a publisher’s page runs code that sends users to an app store page or an advertiser’s landing page through the publisher’s tracking link, even though the user never chose to click the ad. If the user later installs the app, the publisher gets credit for the install.

Click redirection belongs to the app and MMP attribution group of ad fraud. The overview page compares it with web, lead and affiliate fraud.

What is click redirection?

Someone is reading football news on an unfamiliar site and taps a “watch video” button. The site opens an extra tab that runs through an ad network’s tracking link and stops on the app’s Google Play page. The user closes the tab and goes back to the video, but the click has already been recorded. If that person installs the same app on their own a few days later, the install may be credited to the publisher.

The MRC names this behavior directly in its IVT 2.0 standard: its “manipulated activity” category covers forced new browser windows, forced tabs, forced mobile app installs (mobile redirects) and forced clicks (MRC, IVT Standards Addendum, June 2020). The MRC puts this category under sophisticated invalid traffic.

Why is click redirection harder to filter than other fraud?

Each redirect is a real visit to the store. On Android, the link also leaves a referrer in Google Play, so the install looks like it was attributed with certainty. Unlike click hijacking, which needs malware on the device, click redirection only needs a web page and a script.

The one thing missing is user intent, so the evidence shows up in post-install quality. The MRC requires app install measurement providers to look at post-install activity as well: no usage, or an uninstall, can also signal invalid traffic, and invalid installs may be linked to clicks created through redirects.

How have browsers cut back on redirects?

Google announced on the Chromium Blog (November 2017, updated June 2018) that starting with Chrome 68, any redirect coming from a third-party iframe would show an infobar instead of navigating, unless the user had interacted with that frame. Chrome 68 also blocks the case where a click opens the destination in a new tab while the main tab is pushed to a different page (Chromium Blog, Expanding user protections on the web, November 2017).

For fake video play buttons and transparent overlays that catch every click, Google added the Abusive Experience Report in Search Console. That report lists automatic redirects with no user action as an abusive experience (Google Web Tools Help, Abusive Experience Report, accessed October 2026). According to the Chromium Blog, sites that are not fixed within 30 days have new windows and tabs blocked by Chrome.

These protections target third-party iframes and flagged sites, so they shrink click redirection without wiping it out.

Example (hypothetical)

An English-learning app pays a mobile web ad network 18,000 VND per install. This month the network reports 1,500 installs, or 27 million VND. The day 1 return rate for this group is only a third of other sources, and one sub-publisher records more clicks than impressions. It is time to pause the source and ask for the placement list.

Legitimate redirects vs. click redirection

Click redirection is a form of click fraud. The stolen install may be an organic install or may belong to another legitimate source.

Frequently asked questions

MMP tracking links redirect too. Is that a problem?

No. A tracking link always redirects after the user clicks an ad. It becomes fraud when the redirect happens and the user never clicked that ad at all.

Can advertisers check for it themselves?

Partly. Compare click rate, retention rate and uninstall rate by sub-publisher, then ask the ad network for the list of sites where your ads ran.

To see how Adtek plans and controls app install sources, visit our App User Acquisition page.