Install Fraud

Install fraud is when app installs are recorded and paid for under an ad source even though they are fake, or are real installs that the source did not actually bring in. Advertisers who pay per install (CPI) or per in-app action (CPA) take the loss directly.

What is install fraud?

It comes in two groups. The first creates installs with no real user behind them: phone farms with hundreds of real devices installing and deleting apps over and over, bots running on emulators, or SDK spoofing, which sends fake install signals straight to the measurement server. The second group steals credit for installs that really happened. Click flooding fires off huge volumes of fake clicks in the hope of catching an organic install, and click injection slips in a click at the exact moment the user is installing the app.

The second group is harder to see. The users are real and retention looks fine, but you have paid for people who would have downloaded the app anyway.

2025 and 2026 data

AppsFlyer’s State of Fraud for Marketers 2026 report analyzed 106.4 billion installs across 246,000 apps, from Q1 2025 to Q1 2026. Some of the findings (AppsFlyer, June 2026):

• 52% of fraudulent installs sat in organic traffic, the channel that gets the least scrutiny. Affiliates accounted for nearly 40%.
• In Q1 2026, the fraud rate for affiliates was 36 times higher than for self-reporting networks (SRNs) such as Google and Meta.
• The iOS fraud rate fell from 17.5% to 11.7%, dropping below Android for the first time.

In Vietnam, the fraud rate fell from 29% in Q1 2025 to 20% in Q1 2026. The report puts the drop down to one specific fraud operation shutting down, not to a cleaner market (CMOtech Asia, citing the AppsFlyer report, July 2026). Keep in mind that this data comes from one mobile measurement partner (MMP), not from the whole industry.

Warning signs

The Media Rating Council requires accredited measurement providers to count only installs tied to valid impressions and clicks, and to look at the time between them: a gap that is implausibly short is a fraud signal. So are users who never open the app after installing or who uninstall right away (MRC, IVT Standards Addendum, June 2020). In your daily reports, that looks like this:

• Installs spiking from one sub-publisher while almost nobody opens the app on day two.
• Click-to-install times bunched into a few seconds, or spread evenly across 7 days.
• Many installs from the same IP range, the same device model and the same old OS version.

What platforms have added to stop it

On Android, the Play Install Referrer API returns the referrer click time and the install start time as recorded by Google Play itself, which gives MMPs timestamps that do not depend on the ad network (Android Developers, updated February 2026). On iOS, AdAttributionKit (available since iOS 17.4) sends postbacks carrying Apple’s digital signature. Apple advises counting only postbacks whose signature can be verified and ignoring everything else (Apple Developer, accessed October 2026).

Example (hypothetical)

A finance app runs CPI through affiliates at VND 25,000 per install and is billed for 8,000 installs. The MMP flags 2,400 of them as fraudulent, so the app does not pay the VND 60 million for those and pays only VND 140 million for the remaining 5,600. Suppose 1,000 of those 5,600 were organic installs with stolen credit that nobody caught. The real CPI is then VND 140 million divided by 4,600, or about VND 30,400.

How is install fraud different from click fraud?

Click fraud fakes clicks and hurts campaigns paid on CPC. Install fraud goes after installs and post-install events. The two often show up together, because fake clicks are the tool used to claim credit for installs.

Frequently asked questions

Do you need to worry about install fraud on Google App campaigns or Meta?

Less than with affiliates, going by the AppsFlyer data above. You should still turn on your MMP’s fraud filters for every source and compare retention across channels.

What happens if fraud is found after you have already paid?

That depends on the contract. Affiliate contracts should state clearly that installs flagged as fraudulent by the MMP will not be paid for, and set a deadline for reconciliation.

If you are running CPI across several sources and want to check the quality of those installs, take a look at Adtek’s App User Acquisition solution.