Short answer: click injection and click spamming steal credit for installs, usually organic ones you would have got anyway. Both leave a trace in the time from click to install, often called CTIT. Injected clicks arrive seconds before the install, or even after it began. Spammed clicks spread thinly over days. Checking that timing, and trusting the Play Install Referrer first, catches most of it.
What is click injection?
An app already on the phone watches for other apps being installed. The moment an install starts, it fires a fake ad click, so that the last click before the first open is its own. The install was real; the credit is stolen.
The giveaway is speed. A real install needs the store page, a download and a first open, so it begins well after the click. An injected click lands seconds before the install began, or after it.
What is click spamming?
Also called click flooding. A fraudster sends huge numbers of clicks for people who never saw an ad, hoping some of them later install on their own. When one does, the old click is the last one on record and takes the credit.
The giveaway is spread. Real clicks turn into installs mostly within the first hours. Spammed clicks produce installs scattered almost evenly across the whole attribution window, at a very low conversion rate.
How do I spot them in my data?
Chart the time from click to install for each source, and look for these patterns:
| Pattern | Likely cause |
|---|---|
| Many installs less than about 10 seconds after the click | Click injection |
| Clicks recorded after the install began | Click injection |
| A long, flat tail of installs days after the click | Click spamming |
| Huge click counts with almost no installs | Click spamming |
| Most installs within the first hours, then a quick fall | Normal |
Then compare the source with your organic installs. If its "installs" rise and fall exactly in step with your organics, it is probably claiming them.
How does the Play Install Referrer help?
The Play Store records when the click on the store link happened and when the install began, by the device's clock and by Google's. A click that came after the install began cannot have caused it. The Install Referrer guide lists every field.
More importantly, a referrer match does not depend on which click came last. The referrer holds the link the person actually used to reach the store, so a fake click fired elsewhere on the phone cannot change it.
What does Measura do?
- Referrer first. Measura matches installs on the Play Install Referrer before any other signal, so the store's record wins over a last-second click.
- The 10-second rule. A click less than 10 seconds before the install, or after the install began, loses the credit. It stays in the install's trace as a rejected candidate, with the measured seconds and the reason, and the install goes to the next candidate or to organic.
- A clock you can trust. That timing is measured against Measura's server clock, adjusted by how long ago the phone recorded the install on a clock the user cannot change. The phone's own date is often wrong on low-cost devices, and a wrong date must never make a genuine click look impossible. When that adjusted time is missing, the check does not run.
- Named fraud rules. Clicks and installs are also checked for things like hundreds of clicks a minute from one network, scripted user agents, emulator traces and one device producing many installs. Each rule that fires is shown by name.
- Tagged, not hidden. Nothing is deleted or blocked automatically. You see the evidence and decide, and the fraud report is on every plan, Free included.
The rules and their thresholds are published in the methodology.
Questions people ask
Is a very fast install always fraud?
Not on its own. One fast install proves little; a pattern across many installs from one source is what matters. That is why Measura keeps the rejected click visible instead of deleting it.
What should I do when a source looks fraudulent?
Take the evidence to the network or agency that sold you the traffic. A trace that shows a click 3 seconds before the install is something they can check too.
Does fraud checking need the advertising ID?
No. Timing, the Play Install Referrer and network signals work without it.