Affiliate fraud in app marketing: how to spot it before it reaches your invoice

Affiliate fraud is the cost nobody budgets for. When partners are paid per install or per event, some will try to claim credit for users they did not bring, or for users who do not exist. The good news is that most affiliate fraud leaves clear marks in your attribution data, if you know where to look.

This guide covers the most common types, the signals that expose them, and the terms we put in every partner agreement.

Why app campaigns attract affiliate fraud

App campaigns are measured automatically and paid at scale. A partner who can fake or steal a few thousand installs a day can earn real money before anyone reviews the numbers. Fraud also hurts beyond the invoice: it inflates install counts, hides your true cost per user and trains ad platforms on bad data.

The damage compounds. Budgets move towards the sources that look cheapest, and fraudulent sources often look cheapest of all. Without regular checks, a growing share of spend can drift to partners who deliver nothing real.

Common types of affiliate fraud

Click spamming

Also called click flooding. A fraudulent source sends huge numbers of clicks for users who never saw an ad, hoping to be the last click before an organic install. The partner then gets paid for users who would have installed anyway.

Signals: an extremely low click-to-install rate, installs spread evenly over days after the click instead of clustering soon after it, and organic installs that rise when the partner is paused.

Click injection

Malicious apps on Android devices detect when another app starts downloading and fire a click just before the install completes, stealing the credit.

Signals: a very short time between click and install, often just a few seconds, and click timestamps that come after the install began. The Google Play Install Referrer API gives your MMP the timestamps needed to catch this.

Device farms and install farms

Rooms of real phones, or emulators, install apps repeatedly and reset their device IDs to look like new users.

Signals: the same few device models and OS versions, installs from narrow IP ranges or data centres, near-zero day-1 retention and in-app events at unusual hours.

SDK spoofing and fake installs

Bots send fake install and event signals straight to measurement servers without any real device involved.

Signals: installs with no later engagement, events that arrive in perfect sequences, and failed signature checks. Most MMPs let you sign SDK traffic to block this.

Incentive misreporting

A partner sells traffic as non-incentivised but sends it from reward apps.

Signals: sharp spikes followed by fast drop-offs, low retention and referrers from known reward apps.

Brand bidding

On the web side of affiliate marketing, some partners bid on your brand name in search so they can claim commission on people who were already looking for you. Ban it in writing and monitor your brand search results.

Signals to review in your MMP every week

• Click-to-install time (CTIT) distribution for each partner and sub-source.
• Click-to-install conversion rate by sub-source.
• Day-1 and day-7 retention by source, compared with your organic users.
• Event-to-install ratio, for example registrations per install.
• Device and IP concentration, such as many installs from one network.
• Organic lift when a partner is paused, which points to click spamming.

MMP fraud tools, such as AppsFlyer Protect360 and Adjust's Fraud Prevention Suite, block many of these patterns automatically. Treat them as a first filter, not the whole review.

Contract terms that stop you paying for affiliate fraud

• The right to reject installs and events flagged by your MMP, with a clear deadline for disputes.
• Retention floors for each source.
• Sub-source transparency, so you can see and block individual placements.
• No brand bidding and no misleading creative.
• Reporting reconciled before invoicing, with a clawback window for fraud found later.

These terms work best alongside the right payout model. Our guide to CPI vs CPA explains why paying per action already removes much of the incentive to fake installs.

A simple weekly routine

• Export the fraud report from your MMP and check which sources were flagged.
• Compare each source's CTIT and retention against last week.
• Pause sub-sources that breach your rules, and tell the partner why.
• Record rejected installs, so the invoice matches what you accepted.

Key takeaways

• Affiliate fraud shows up in timing, retention and device patterns long before it shows up in revenue.
• Review CTIT, retention and conversion by sub-source every week.
• Switch on your MMP's fraud protection and back it with contract terms.
• Pay for actions where you can, and keep the right to reject bad traffic.

Filly Media screens every affiliate source before and during campaigns. To review your current partners or plan a cleaner affiliate program, get in touch.