Install fraud detection  is a genre of mobile ad fraud ranging from low-tech tactics like device farms to more advanced schemes such as click injection, SDK spoofing and more. Fraudsters use software emulation to mimic human behavior when clicking on ads, downloading apps and then deleting them once they’ve reached their CPI quota.

One way to detect these fraudsters is by looking for a long timeframe between an ad click and a resulting app install. Another good check is looking for a high number of new installs from the same IP on a single day. This could indicate a bot farm trying to circumvent ad blocking or limit ad tracking by repeatedly reinstalling and redownloading an app on the same device, in order to appear as a new user and bypass detection mechanisms.

Securing Your App Growth: A Guide to Preventing Fraud in App Install Campaigns

Incentive ad campaigns often involve paying for active users rather than simple app downloads, so fraudsters have to adapt and find ways to trick these platforms into giving them credit for fake engagement. One way they do this is by factory resetting devices, installing and uninstalling an app, then re-setting the device ID to claim credit for a new install. This is often done by groups of people who are paid to do so as part of an app install farm.

This type of fraud can be spotted by looking at the average time to first in-app event for different countries. Another good check is comparing the data from your MMP with that of your analytics tool and other external sources to look for unreasonable discrepancies.