Glossary
What are fake installs?
Fake installs are fraudulent app installs generated by bots, device farms or SDK spoofing, designed to mimic real user behaviour closely enough to claim advertiser payouts.
How they are produced
- Device farms. Racks of real handsets installing apps repeatedly, often with automated interaction afterwards.
- [Emulators](/resources/glossary/device-emulator). Software mimicking devices, cheaper to run and easier to detect.
- [SDK spoofing](/resources/glossary/sdk-spoofing). No device at all — the install signals are fabricated directly.
- Incentivised humans. Real people paid to install and briefly use apps, which is the hardest variant to detect because everything about it is genuine except the motivation.
How to spot them
The signal that survives every technique is downstream behaviour. Fake users do not do the thing your product exists for.
A source with normal install volume and near-zero day-7 retention is the classic pattern. So is a cohort that completes the tracked event and nothing else — because the fraudster instrumented exactly what they are paid for and no more.
Device and network signals catch the cheaper methods: emulator characteristics, data-centre IP ranges, impossible hardware and OS combinations, and implausible uniformity in device models.
What makes them worth producing
Shallow payouts and weak oversight. If a source is paid a fixed amount per install with no downstream verification, the economics of faking are excellent.
Both conditions are within an advertiser's control. Paying against an event deep enough that faking it is expensive, insisting on sub-publisher transparency, and blocklisting on retention rather than on install counts changes the calculation directly.
The measurement backstop is a holdout: fabricated installs contribute no lift, whatever the attribution report says.
Common questions
Are incentivised installs fraud?
Not by most definitions — the users are real and consented. They are a quality problem rather than a fraud one, and should be cohorted separately rather than blended into general acquisition metrics.
What retention rate suggests fake installs?
Compare against your own organic baseline rather than a benchmark. A source at a small fraction of organic day-1 retention warrants investigation regardless of the absolute number.
More in fraud and validation
How invalid traffic is manufactured, and how it is caught.