Click spamming

Definition

Click spamming is install fraud in which a party reports large volumes of clicks that no user ever made, so that any install occurring later inside the attribution window is credited to them.

Also called click flooding or click stuffing, it is a volume attack on a last-touch model. The fraudster does not need to fool anyone about a specific install; they need only to have a click on file for enough devices that some of them install anyway. It is cheap, it is detectable statistically rather than case by case, and the detection is one distribution chart.

The economics that make it worth doing

A click costs the fraudster essentially nothing to report. If your click window is seven days, every spammed click is a lottery ticket that pays out whenever that device installs your app for any reason at all — including from a TV ad, a friend's recommendation, or the App Store's own search results.

The last row is the one worth staring at. Widening the attribution window from seven days to thirty does not merely change reporting — it multiplies the payout of a click-spamming operation, because a longer window catches more of the organic base per spammed click. Generous windows and click spam are the same problem.

The CTIT distribution is the test

Real clicks are followed by an install fairly quickly, because a real user who taps an ad and decides to install does it in one sitting. Click-to-install time for an honest channel is heavily front-loaded: most installs land within the first hour, and the tail thins fast. A spammed channel produces the opposite shape, because the click and the install are causally unrelated — so the gap between them is essentially uniform across the window.

A near-uniform distribution across days is the signature. It says the click carries no information about when the install happened, which is exactly what you would expect if the click did not cause it. Compare that with click injection, whose signature is the opposite extreme — a spike in the first seconds.

-- Bucketed click-to-install time by source. Run per source, never
-- pooled: a single blended average hides exactly the shape you need.
SELECT
  source,
  CASE
    WHEN ctit_seconds <  10       THEN '1. under 10s'
    WHEN ctit_seconds <  600      THEN '2. 10s-10m'
    WHEN ctit_seconds <  3600     THEN '3. 10m-1h'
    WHEN ctit_seconds <  86400    THEN '4. 1h-24h'
    ELSE                               '5. over 24h'
  END AS ctit_bucket,
  COUNT(*) AS installs,
  ROUND(100.0 * COUNT(*) / SUM(COUNT(*)) OVER (PARTITION BY source), 1) AS pct_of_source
FROM (
  SELECT
    source,
    TIMESTAMP_DIFF(installed_at, clicked_at, SECOND) AS ctit_seconds
  FROM attributed_installs
  WHERE installed_at >= CURRENT_TIMESTAMP() - INTERVAL 30 DAY
    AND clicked_at IS NOT NULL
)
GROUP BY source, ctit_bucket
ORDER BY source, ctit_bucket;

Run it per source. A blended average across all channels is the one presentation guaranteed to hide the finding, because a healthy majority pulls the mean back into a plausible-looking range while the offending source keeps its shape.

Corroborating signals

• Conversion rate far below every other channel. Millions of clicks producing a fraction of a percent of installs is the attack, not bad creative.
• Click volume that does not track impression volume. Clicks should be bounded by inventory served.
• Flat hourly click distribution. Real human clicking has a daily rhythm; scripted clicking often does not.
• Post-install behaviour matching organic exactly. Poached organics behave like organics because that is what they are.
• No lift in a holdout. The decisive test — if pausing the channel does not reduce installs, it was never causing them.

That last one is worth doing before any dispute. Retention and revenue curves indistinguishable from organic are suggestive; a geo holdout in which total installs do not move when the channel is paused is close to conclusive, and it is an argument no network can answer with their own logs.

Structural defences help more than filters. Shorter click windows shrink the payout directly. Prioritising deterministic matches over modelled ones removes the ambiguity spam exploits. And reporting view-through separately stops a spam channel from hiding inside a view-through total.