{"id":6962,"date":"2026-10-20T21:53:12","date_gmt":"2026-10-20T14:53:12","guid":{"rendered":"https:\/\/adtek.agency\/glossary\/sdk-spoofing\/"},"modified":"2026-10-20T21:53:12","modified_gmt":"2026-10-20T14:53:12","slug":"sdk-spoofing","status":"publish","type":"mona_glossary","link":"https:\/\/adtek.agency\/en\/glossary\/sdk-spoofing\/","title":{"rendered":"SDK spoofing"},"content":{"rendered":"

SDK spoofing is a type of fraud in which the fraudster sends click, install and in-app event signals straight to the measurement server, built to look exactly like signals from the real SDK, even though no install or action ever happened. It is a form of install fraud<\/a> that targets the connection between the app and the measurement platform.<\/p>\n

What is SDK spoofing?<\/h2>\n

Most apps that run ads include the SDK of an MMP<\/a> such as AppsFlyer, Adjust or Singular. When a user opens the app for the first time, the SDK sends a request to the MMP’s server to record the install, then sends further events such as sign-ups and purchases. If a fraudster figures out the structure of these requests, they can generate them from their own server without any phone ever installing the app.<\/p>\n

The Media Rating Council classes this as sophisticated invalid traffic (SIVT), under “falsified measurement events”, which includes falsified conversion attribution data (MRC, IVT Standards Addendum, June 2020<\/a>).<\/p>\n

Why it is hard to detect<\/h2>\n

Encrypting the connection is not enough. Adjust explains that TLS stops outsiders from reading the data, but it does not stop someone from sending fake install or event data to the app’s endpoint (Adjust Help Center, SDK signature, accessed October 2026<\/a>). The fake request has the right format, so the server accepts it like any other install. Each install looks normal on its own. The fraud only shows when you compare it with data from another source. Fraudsters can also send sign-up and purchase events along with the install to get past filters that only judge post-install user quality.<\/p>\n

How to block SDK spoofing in 2025 and 2026<\/h2>\n

Sign every request.<\/strong> Adjust uses SDK Signature: each request is signed with its own algorithm, and the server rejects any request without a valid signature. In most cases, the library already ships with Adjust SDK v5. On Android, you have to add the app signing certificate fingerprint to the allowlist. If you leave it empty, the app’s traffic can still be spoofed (Adjust, same source).<\/p>\n

Use the platform’s attestation.<\/strong> Google fully shut down the SafetyNet Attestation API in January 2025 and moved to the Play Integrity API (Android Developers, accessed October 2026<\/a>). A Play Integrity verdict tells you whether the app is a version Google Play recognizes (PLAY_RECOGNIZED or UNRECOGNIZED_VERSION) and whether the device meets integrity standards (Android Developers, updated October 2026<\/a>).<\/p>\n

Trust Apple-signed postbacks.<\/strong> On iOS, SKAdNetwork and AdAttributionKit postbacks are digitally signed by Apple. Apple’s guidance is to count only postbacks whose signature verifies and to ignore any that fail this step (Apple Developer, accessed October 2026<\/a>). Fraudsters don’t have Apple’s key, so they cannot create a valid postback themselves.<\/p>\n

Warning signs in your reports<\/h2>\n