Fraud Detection Reports
Fraud detection reports will help protect you against fraud attempts on your campaigns. With multiple types of fraud, there are several types of reports you can generate to detect and protect yourself from fraud. You will have filters and thresholds to help narrow down and take action right away on any suspicious activity. To access these reports go to Reports > Fraud Detection Reports.
💡Note
For each of these fraud detection reports, it's important to note that anomalies or mismatches do not guarantee fraud. They are red flags that may warrant further investigation. Always consider the broader context and look for patterns when analyzing suspicious activity.
Filters On Every Report
Filter | Definition | Example |
Date | Date & time range you want to generate a report | 2023-08-01 to 2023-08-31 |
Granularity | The time period the data is displayed |
|
Level | The entity hierarchy of data displayed |
|
Tolerance Range | A range that is considered non-fraudulent. The report will be loaded for the values that don’t fall into this range. | 0.01% to 15% |
Group By | The cohort that your data will be organized by |
|
Minimum Conversions | The amount of conversions needed before shown on the report | 10 |
💡 Additional Notes
In all reports, only approved conversions are considered.
We do not consider discarded traffic.
You can find actions logged in 'Audits' with the action type, for eg., "Offer Paused" or "Publisher Blocked"
Abnormal Conversion Rate
The report provides details on unusual spikes or inconsistencies in campaign performance, majorly focusing on conversion rates. This can be detected through a deviation of the expected conversion rate, either unusually high or low, indicating potential fraud.
If a campaign or partner that typically has a conversion rate of 1% suddenly jumps to 20% without any changes to the campaign itself (targeting, budgets, etc.). This could indicate bots or fake users being used to drive the numbers. With this report and the thresholds you put, you will clearly detect any abnormalities and be able to take action.
Unique Filter | Definition | Example |
Minimum Clicks | The amount of clicks needed before shown on the report | Generate a report for campaigns having a minimum of 1000 clicks |
Abnormal Device Distribution
The report It offers insights into suspicious device distribution, highlighting irregularities like excessive conversions from identical devices. When the distribution of users across various device types or models deviates significantly from the expected distribution.
The percentage is the total traffic coming from the respective device model on that offer.
Abnormal Distribution Example
If your app's user base is known to be primarily on iPhones with the latest update, but suddenly there is a spike of installs from outdated iPhones or uncommon devices, this could indicate fraud. In the report, you will clearly see the device distribution and any inconsistencies so that you can take action against abnormal device distribution.
💡Tip
Report data is distributed by device model, you can further group by country, OS, and user agent.
Bot Detection
The report provides a concise overview of suspicious bot-related activities by checking user behavior within the app. This helps to detect automated scripts or software that imitates human user behavior of clicking or installing and more.
The percentage is the traffic share that imitates the bot-related activities.
Bot Examples
If your app receives a large number of clicks in a short time span, or there is a repetitive pattern in clicks, then this behavior can indicate bots. Utilizing this report, you can detect odd user behavior to help identify bots and take action to stop them.
💡Tip
While the case mentioned above can be a good indicator; bots can also imitate behaviors within the app. For example, increasing engagement with positive behaviors for fraudulent purposes, such as inflating clicks or gaming reward systems.
Action Steps
Account managers can use bot detection to identify and block fraudulent activities. This is done by identifying clicks and impressions generated by bots. While also assessing traffic quality by filtering out bot-generated traffic to ensure account managers are engaging with real customers. Which eventually leads to saving the budget and improving campaign performance.
Click Spamming
The report highlights any unusual or abnormal patterns in click data based on configured CTIT. This allows you to detect when traffic sources generate large volumes of fake clicks with the idea that some of those fake clicks will be attributed to real conversions.
The percentage is the share of traffic filtered as fraud.
Click Spamming Example
An organic user will install the app normally (without clicking on the ad), however a partner will generate a fake click just before the install is registered, and try to claim attribution and compensation for that install. This report will help to detect strange traffic patterns, with the use of CTIT, so you can take action against click spammers.
Unique Filter | Definition | Example |
CTIT (Click to install time) | Set the CTIT minimum threshold, in minutes or hours, for the data to be shown |
|
Device Mismatch
The report checks the click and conversion device mismatch and discrepancies, identifying fraudulent behaviors. Basically, it detects if there is a discrepancy between the device that clicked on an ad and the device that performed a conversion.
So if an ad is clicked on a Samsung Galaxy S10, but the app install is recorded from an iPhone 12. This inconsistency can indicate fraud, and you will be able to identify such cases here in this report.
GEO Mismatch
The report examines whether the click and conversion originated from different geographical regions.
If an ad is clicked in the UK, but the app install occurs in Brazil a few minutes later. This geographical inconsistency can be a red flag. Here you can view any geographical mismatches that may lead to taking action against suspicious activity.
Proxy Detection
The report provides a summary of proxy-server-related details to highlight deceptive activities by identifying conversions from proxy IPs. This helps to detect traffic that comes from proxy servers which can hide a user's true IP address. While proxies can be used for legitimate purposes, they can also be exploited for fraud.
For example, if a significant portion of app installs come from known proxy IP addresses. This can indicate that someone is trying to disguise the true origin of the installs, potentially to commit fraud.
SDK Fraud
The report highlights suspicious Software Development Kit (SDK)-related activities by comparing various discrepancies between the app events and the App Store version. If there is any Fraudulent activity originating from the SDK (eg. generating fake installs, clicks, or events), then you can use this report to detect SDK fraud by utilizing various thresholds and filters like the "Store Version".
For example, if an app integrates a third-party SDK for additional functionalities. Suddenly, there's a spike in app installs, but no actual increase in user engagement or in-app activity. This could be because the SDK is fraudulently inflating install numbers.
Unique Filter | Definition | Example |
Store Version | The app's latest version in the app store | 1.2 |