Install fraud in 2026: the 22% problem

AppsFlyer's 2025 fraud report puts annual exposure above $5.4 billion, with roughly 22% of non-organic installs carrying at least one fraud signal. A signal is not a conviction; most flagged installs get rejected or disputed before money moves. But the honest version of that statistic is still ugly: on a typical SDK-network media plan, one install in five arrives with something wrong attached to it. This guide covers how the money actually leaks, what changed this year, and the checks we run on every client account before a source earns budget.

The four mechanics, ranked by how they steal

Click flooding fires thousands of fake ad clicks at whole device populations, hoping to claim last-click credit when anyone installs organically later. It steals attribution, not installs; your install count looks fine while your organic column quietly empties into a paid source. Click injection is its nastier Android cousin: malware on the device detects a download in progress and fires a "click" seconds before first open, claiming credit for an install some other channel earned. Device farms and bots produce installs with no human behind them at all. And SDK spoofing fakes the install event itself, sending forged postbacks from devices that never touched your app. The first two poison your attribution; the second two poison your spend directly.

What changed: iOS got cleaner, organic got dirtier

Two structural shifts define the 2026 picture. First, iOS fraud rates fell from 17.5% to 11.7% between Q1 2025 and Q1 2026, dropping below Android for the first time on record. Apple's cryptographically signed postbacks in SKAdNetwork and AdAttributionKit are simply hard to forge, so the fraud economy migrated to the platform where spoofing still pays. Second, fraud stopped presenting as paid: 52% of fraudulent installs now masquerade as organic traffic. That matters even if you never buy a single SDK-network install, because inflated organic numbers corrupt every incrementality read and every "paid vs organic" argument in your next budget meeting.

Reading your own account: five signals

You do not need a forensics team; you need the MMP reports you already pay for and one suspicious afternoon per month. The click-to-install-time distribution is the sharpest tool: a real Android user takes minutes between click and first open, so a source whose installs cluster under 10 seconds is injecting clicks, and a source with a huge tail of multi-day CTITs is flooding them. Then check new-device rate, because a source sending 90% factory-fresh device IDs is a farm. Then day-1 retention by source: cohorts that never come back are bots or misled humans, and it costs you either way. Then geo and device-model mismatches against your actual audience. And finally the flattery check, the same instinct we apply on thetesting bench: an IPM or CVR far above every honest source is not a breakthrough, it is an exhibit.

The boring clauses that do the real work

Fraud defense is mostly procurement. Before a new source gets a euro: non-incent inventory only, stated in writing, because rewarded-install traffic is legal fraud against your retention curve. Attribution measured by your MMP, never the network's own dashboard. A dispute window of at least 30 days, so rejected installs become refunds rather than lessons. Source-level transparency, meaning sub-publisher IDs in every postback, because "blended" traffic is where the 22% hides. And fraud-tool verdicts written into the insertion order as billing truth. Protect360 on AppsFlyer and the Adjust fraud suite both reject in real time; the clause makes their rejections financially binding instead of decorative.

How we run it on client accounts

Sources get the same treatment our creatives get: a written entry hypothesis, a probation budget, and a kill condition agreed before launch. A typical probation reads: two weeks, €2,000 cap, CTIT distribution reviewed at day 3 and day 10, kill if flagged installs exceed 8% or if the cohort's D1 retention lands more than a third below the account median. Most sources pass. The ones that fail were going to fail with your money either way; the probation just decides how much of it they take first. Fraud never becomes zero. It becomes a controlled tax, somewhere in the low single digits, instead of a fifth of the plan.