The anatomy of mobile ad fraud: Modified Click Spam
A sure sign of Classic Click Spam is abnormal TTI (Time to Install) distribution. TTI is the measurement of time between clicking on the ad (impression) and the actual install time. Anti-fraud detection of abnormal TTI has forced fraudsters to adjust. Now they attempt to “cut off the long tail” of TTI over several days, making Click Spam more complicated to detect. At Scalarr we call this Modified Click Spam and consider it a part of the New Face of Mobile Fraud category.
1. In 2018 Modified Click Spam was responsible for 14,9% of all fraud cases.
2. A large number of clicks in relation to installs (CR < 0.5%) is just one of the signals that you are dealing with Modified Click Spam.
3. Fraudsters commonly use Modified Click Spam techniques together with new ways of infecting devices, like through public Wi-Fi access points.
How Modified Click Spam works
1. The first steps are similar to Classic Click Spam.
2. Fraudsters use techniques in Modified Click Spam to try to limit the TTI distribution of their traffic to no more than 1 day, avoiding Classic Click Spam detection.
3. The fraudsters send a new ad click each day, so the last "click" time will be “fresh” and within one day before the device user actually installs the app/game.
How to deal with Modified Click Spam
In addition to other identical detection methods for both Modified Click Spam and Classic Click Spam, you should pay attention to a more granular TTI distribution per hour. For Modified Click Spam, the distribution will be more flat. Although click-spammers can manage the attribution window with click updates, they cannot force the real user to download the app/game organically when they need it.
Read Scalarr’s Ultimate Guide to Mobile Fraud Types to understand more about dealing with Modified Click Spam in all specific cases.
The general principle of “mixes” grounds on the conscious use of several various types of fraud to get over the known protection measures of fraud ...
Fraud is an adaptive crime, so it needs special methods of intelligent data analysis to detect and prevent it