SDK spoofing

SDK spoofing is a type of fraud in which the fraudster sends click, install and in-app event signals straight to the measurement server, built to look exactly like signals from the real SDK, even though no install or action ever happened. It is a form of install fraud that targets the connection between the app and the measurement platform.

What is SDK spoofing?

Most apps that run ads include the SDK of an MMP such as AppsFlyer, Adjust or Singular. When a user opens the app for the first time, the SDK sends a request to the MMP’s server to record the install, then sends further events such as sign-ups and purchases. If a fraudster figures out the structure of these requests, they can generate them from their own server without any phone ever installing the app.

The Media Rating Council classes this as sophisticated invalid traffic (SIVT), under “falsified measurement events”, which includes falsified conversion attribution data (MRC, IVT Standards Addendum, June 2020).

Why it is hard to detect

Encrypting the connection is not enough. Adjust explains that TLS stops outsiders from reading the data, but it does not stop someone from sending fake install or event data to the app’s endpoint (Adjust Help Center, SDK signature, accessed October 2026). The fake request has the right format, so the server accepts it like any other install. Each install looks normal on its own. The fraud only shows when you compare it with data from another source. Fraudsters can also send sign-up and purchase events along with the install to get past filters that only judge post-install user quality.

How to block SDK spoofing in 2025 and 2026

Sign every request. Adjust uses SDK Signature: each request is signed with its own algorithm, and the server rejects any request without a valid signature. In most cases, the library already ships with Adjust SDK v5. On Android, you have to add the app signing certificate fingerprint to the allowlist. If you leave it empty, the app’s traffic can still be spoofed (Adjust, same source).

Use the platform’s attestation. Google fully shut down the SafetyNet Attestation API in January 2025 and moved to the Play Integrity API (Android Developers, accessed October 2026). A Play Integrity verdict tells you whether the app is a version Google Play recognizes (PLAY_RECOGNIZED or UNRECOGNIZED_VERSION) and whether the device meets integrity standards (Android Developers, updated October 2026).

Trust Apple-signed postbacks. On iOS, SKAdNetwork and AdAttributionKit postbacks are digitally signed by Apple. Apple’s guidance is to count only postbacks whose signature verifies and to ignore any that fail this step (Apple Developer, accessed October 2026). Fraudsters don’t have Apple’s key, so they cannot create a valid postback themselves.

Warning signs in your reports

• Installs attributed to an SDK version or app version you never released.
• In-app purchase revenue in the MMP that is far higher than the transactions recorded by the App Store or Google Play.
• A sharp rise in installs from one source with no matching login sessions on the app’s own server.

SDK spoofing vs. similar fraud types

See also click injection and bots.

FAQ

If I already use an MMP, am I protected by default?

Not necessarily. Request signing usually has to be turned on, configured with your certificate and set to enforce before it does anything. Ask your app engineers whether it is on, and whether it is blocking or only warning.

Can SDK spoofing distort SKAdNetwork data?

SKAdNetwork and AdAttributionKit postbacks are sent by the device and signed by Apple, so they are much harder to fake. The part that is easy to fake is the device-level data the MMP collects on its own through its SDK.

If you need to review your app measurement setup before raising the budget, the Adtek team can go through it with you. Reach us through the contact page.