Cost-per-install, or CPI, campaigns appear simple: an affiliate sends a user to an app, the user installs it, and the affiliate receives a payout. The commercial simplicity hides a difficult measurement problem. An install is not automatically evidence of a legitimate acquisition, and the last recorded click is not always the action that caused the install.
Affiliate fraud in CPI campaigns usually targets one of three things: the payout event, the attribution decision, or the evidence used to validate the install. Fraudsters may generate large volumes of low-quality clicks, inject an attribution claim shortly before an organic install, create fake or incentivized installs, or manipulate post-install activity so that an otherwise worthless user appears valuable.
This guide explains how to investigate CPI fraud without jumping from suspicion to accusation. It covers common attack patterns, the data needed for a defensible review, practical detection rules, prevention controls and the difference between traffic validation, fraud detection, blocking and payout decisions.
What affiliate fraud means in a CPI campaign
Affiliate fraud is the deliberate manipulation of traffic, attribution or conversion events to earn commission that was not fairly generated. In a CPI program, the conversion is usually an app install attributed to an affiliate click, although some programs also require a first open, registration, activation or another post-install event.
A suspicious install is not necessarily a fraudulent install. A new app, a mobile operating system update, a popular promotion or a tracking configuration change can create unusual patterns without malicious intent. The investigation should therefore test competing explanations and preserve evidence before changing payout status.
It is useful to separate four questions:
- Did an install occur? This is an event integrity question.
- Did the affiliate cause or materially influence the install? This is an attribution question.
- Was the user real and permitted under the campaign terms? This is a traffic quality and policy question.
- Should the payout be approved, held, adjusted or rejected? This is a commercial decision based on evidence and contract terms.
A reliable CPI fraud process keeps these questions separate. A device can be real but the attribution can still be manipulated. A click can be technically valid but generated through a prohibited placement. An install can be genuine but incentivized when incentives are not allowed.
How CPI affiliate fraud works
Click spam and attribution hijacking
Click spam is the generation of excessive clicks in the hope that some will fall inside the attribution window before an install happens. The user may discover the app through an organic search, an app store recommendation, a legitimate paid ad or an existing brand relationship. The spammer creates a large number of background or low-value clicks, then claims credit when one of those users installs.
Click spam does not require the click to be completely fake. A user may have touched an affiliate placement, but the placement may have had little or no causal influence on the install. Warning signs include unusually high click-to-install volume with weak post-install engagement, very short click-to-install times across a large share of conversions, and clicks arriving from placements that users are unlikely to notice.
Click injection
Click injection is a more targeted form of attribution abuse, commonly associated with Android environments. Malicious or abusive software detects that another app is close to completing an install and fires an affiliate click immediately before the install finishes. The affiliate then appears to be the last eligible source.
The timing pattern is central. A normal click may occur minutes or hours before the install, depending on the campaign and user journey. In an injection pattern, the click often occurs near the install completion or first open, sometimes with repeated timing concentrations across devices, publishers or sub-publishers.
Click timing alone is not proof. A user can legitimately click an offer and install quickly. The stronger case comes from timing combined with source concentration, repeated device or app signatures, inconsistent referrer data, suspicious background behavior and weak downstream quality.
Fake, emulated and farmed installs
Some fraud operations create installs using emulators, device farms, automation frameworks or large groups of low-cost human operators. The install event may be technically recorded, but the resulting user does not represent the audience the advertiser intended to buy.
Fake install indicators can include clusters of devices with identical or near-identical configuration values, impossible or highly repetitive activity sequences, rapid resets, suspicious emulator signals, abnormal language and timezone combinations, and many accounts sharing infrastructure. Device farms can be harder to detect because the devices may be genuine. In those cases, behavior, account reuse, IP changes and post-install activity become more important.
Incentivized installs and offer misrepresentation
Incent traffic is not inherently fraudulent if the campaign explicitly permits it and the user understands the reward. It becomes a compliance problem when incentives are prohibited, hidden, misleading or structured in a way that produces users who install only to collect a reward.
Look for high install volume with low retention, immediate uninstall behavior, identical activation paths, complaints about unexpected rewards, or publisher placements that promise cash or benefits despite a non-incentive campaign. Validate the placement itself rather than relying only on the affiliate’s description.
Install and post-install event manipulation
Some schemes do not focus on the install event alone. They manipulate registration, tutorial completion, subscription trials, deposits or other events that increase the value of an install. Methods can include scripted navigation, account recycling, stolen identities, fabricated device signals and repeated use of promotional codes.
If the CPI payout is based only on the install, post-install manipulation may still reveal that the source is low quality. If the program pays on a qualified event, event-level validation becomes essential. A high install rate with near-zero genuine usage, or a suspiciously perfect progression from install to activation, deserves review.
Data needed for CPI fraud detection
Do not begin with a dashboard showing only affiliate clicks and installs. A useful investigation joins attribution, device, network, app and commercial data at a common event level.
- Click data: click ID, timestamp with timezone and preferably UTC, affiliate ID, publisher or sub-publisher ID, placement, campaign, creative and landing context.
- Install data: install timestamp, first-open timestamp, app version, operating system, device identifiers permitted by policy, attribution provider result and conversion status.
- Network data: IP address or a privacy-safe network classification, ASN, country, connection type, proxy or hosting indicators and coarse geographic consistency.
- Device data: model, operating system version, language, timezone, advertising identifier status, emulator or integrity signals and reset or reuse indicators.
- Behavior data: session length, screens viewed, registration completion, retention, purchase or activation events, uninstall signals and the sequence between events.
- Affiliate data: contract terms, approved traffic sources, incentive permissions, sub-affiliate declarations, payout history, previous disputes and communication records.
Apply data minimization and access controls. Fraud analysis should not become an excuse to collect or retain personal data without a clear purpose. Use stable internal case IDs, document who accessed sensitive fields, and define retention rules before a dispute occurs.
Investigation workflow for suspicious CPI traffic
1. Define the conversion and the rule being tested
Write down what the affiliate is paid for and what the campaign permits. Is the event an install, first open or qualified activation? Is incentivized traffic allowed? Are brand-bidding, toolbars, push placements, sub-affiliates or paid social placements restricted? Many disputes are caused by vague terms rather than sophisticated fraud.
2. Establish a clean baseline
Compare the affiliate or publisher with relevant peers, not with a universal benchmark. Segment by country, operating system, app version, campaign, placement and date. A mixed source can look normal in aggregate while one sub-publisher is highly abnormal.
Useful baseline measures include click-to-install rate, click-to-first-open time, install-to-activation rate, retention, refund or chargeback rate where relevant, duplicate device rate, IP or ASN concentration and the share of conversions with missing or inconsistent fields.
3. Examine time relationships
Build distributions rather than inspecting a few examples. Review the time from click to install, click to first open and install to the first meaningful event. Look for spikes at implausibly precise intervals, an unusually large share of clicks immediately before installs, or patterns that begin after a tracking or payout change.
Preserve the raw timestamps and timezone assumptions. A reporting interface that rounds events to the hour can create false timing patterns. Confirm whether the recorded click is the original click, a redirect, a reattribution or a postback event.
4. Break down by publisher and placement
Affiliate-level averages can conceal sub-affiliate abuse. Require a publisher or placement identifier for every click where commercially and technically possible. A sudden increase from one sub-ID, app, website, toolbar, push network or media source is more actionable than a broad statement that the affiliate quality has declined.
When a source cannot provide placement-level transparency, treat that as a risk factor and consider changing the approval terms. Lack of evidence is not proof of fraud, but it limits how confidently payouts can be validated.
5. Test device and infrastructure reuse
Search for repeated device identifiers, advertising IDs, install tokens, IP ranges, emulator fingerprints, account details and behavioral sequences. Avoid simplistic rules such as one IP equals one fraudster. Mobile carriers, offices, universities and public Wi-Fi can legitimately place many users behind one address.
Instead, combine signals. Ten devices behind one carrier NAT may be normal. Ten devices with the same model, language, timezone, app version, event sequence and account pattern are more concerning.
6. Validate the app journey
Look beyond the install. Do users open the app, complete onboarding, remain active, use core features or generate the business outcome expected from the campaign? A low-quality cohort is not automatically fraudulent, but it can show that the source is unsuitable or that the campaign’s targeting and payout model need adjustment.
Use cohort comparisons carefully. Differences in geography, app version, onboarding friction and promotion type can affect retention. Post-install quality should support a wider case, not serve as a single automatic rejection rule.
7. Request evidence and preserve the case
Ask the affiliate for source URLs, placement screenshots, sub-affiliate paths, traffic acquisition details, incentive disclosures and an explanation of unusual dates or sub-IDs. Give a reasonable response window and record the request, response and decision.
Keep raw logs, query definitions, screenshots, attribution reports, contract clauses and payout calculations. A reproducible case is more useful than a long list of undocumented risk scores, especially when the affiliate challenges a clawback.
Practical CPI fraud signals
No single signal should automatically classify a conversion as fraudulent. Use layered evidence and label each result as a lead, a validated anomaly or a confirmed policy breach according to the standard of proof your program requires.
- Clicks and installs are heavily concentrated in a narrow time window without a campaign explanation.
- A high share of clicks occurs seconds before the install or first open.
- One publisher produces a sharp volume increase immediately after a payout or attribution change.
- Sub-publisher IDs are missing, recycled or inconsistent with the affiliate’s declared traffic sources.
- Devices, accounts or install tokens are reused across apparently separate users.
- Traffic comes from hosting, proxy or automated infrastructure at a rate that differs materially from comparable sources.
- Install volume is strong but first opens, sessions, retention or qualified events are unusually weak.
- Device, language, timezone, IP and declared country combinations are repeatedly inconsistent.
- Conversion data contains impossible sequences, duplicate events or timestamps that do not align across systems.
- Users report hidden incentives, forced redirects, unwanted app opens or misleading creative.
Prevention controls for affiliate install fraud
Make source transparency a program requirement
Require affiliate IDs, sub-publisher IDs and placement metadata in every tracking link or postback where possible. Prohibit undisclosed sub-affiliates and make the affiliate responsible for traffic generated through its downstream partners. The contract should define what evidence must be supplied during an investigation.
Use a staged payout process
Do not necessarily pay every install immediately. A review hold or delayed validation period can allow duplicate checks, post-install quality checks and attribution reconciliation. The period should be proportionate to the campaign and stated clearly in the agreement.
Staged payout is a prevention and commercial control, not proof that held traffic is fraudulent. Some legitimate conversions will need to wait for validation.
Protect attribution logic
Use an attribution window that matches the real user journey and review whether last-click rules create incentives for click spam. Where your measurement setup supports it, examine assist signals, view-through rules, re-engagement logic and reattribution settings. Make sure install and first-open events cannot be replayed or accepted without appropriate integrity checks.
Limit and monitor risky traffic sources
Define rules for incentives, brand terms, redirects, pop-ups, push notifications, software bundles, preloads and app-to-app placements. Blocking can be appropriate when a source violates a clear rule or presents unacceptable risk. It should not be confused with detection: a block stops or limits traffic, while detection identifies and evaluates suspicious behavior.
Use rate limits and anomaly alerts
Alerts can flag sudden volume changes, click spikes, abnormal click-to-install timing, new sub-publishers, geographic shifts and device reuse. Alerts are for triage. They should route investigators to evidence rather than automatically reject every conversion.
Detection, prevention, blocking and validation are different
These terms are often mixed together, which makes CPI programs harder to manage.
- Traffic validation checks whether required fields, tracking events and source declarations are present and technically consistent.
- Fraud detection identifies patterns that may indicate manipulation, automation, attribution abuse or policy violations.
- Prevention changes the program so abuse is harder or less profitable, through contract terms, staged payouts, source transparency and stronger event controls.
- Blocking stops a click, source, device, placement or conversion from proceeding according to an explicit rule.
Validation can show that an install event is well formed without proving that the affiliate caused it. Detection can identify a high-risk cluster without proving every conversion in that cluster is fraudulent. Blocking can reduce exposure but may create false positives. A strong program uses all four functions and records the reason for each action.
How to avoid false positives
False positives are expensive. They can remove legitimate affiliates, damage relationships, distort optimization and hide genuine problems behind noisy rules. Review anomalies by cohort and context. New countries, app releases, seasonal promotions, carrier changes and creative launches can all alter the data.
Use multiple independent signals before taking a severe action. A suspiciously short click-to-install time is more meaningful when paired with source opacity and weak post-install behavior. A shared IP becomes more meaningful when paired with device reuse and identical account sequences. A low retention rate becomes more meaningful when the traffic was sold as high-intent acquisition.
Consider graduated outcomes:
- Continue monitoring when the anomaly is weak or adequately explained.
- Request clarification and supporting evidence.
- Hold a defined cohort while validating the data.
- Reduce or adjust payouts where the contract permits and the evidence supports it.
- Pause a source when risk is material and the source cannot provide transparency.
- Terminate the relationship when a policy breach or deliberate manipulation is established.
A practical CPI fraud case example
Imagine an affiliate that normally generates 2,000 to 3,000 Android installs per week. Volume rises to 18,000 installs after a new sub-publisher appears. The affiliate reports a strong click-to-install rate, but most clicks occur within 10 seconds of the install, the sub-publisher field is missing for half the conversions, and first-session activity is substantially weaker than the affiliate’s previous cohorts.
Those facts justify a hold and investigation, not an immediate declaration that all 18,000 installs are fake. The analyst should verify whether a new promotion caused the increase, inspect raw event ordering, compare the pattern with other sources, check device and infrastructure reuse, and request placement evidence. If the data shows systematic last-second clicks from an undisclosed source and repeated device or event patterns, the case for attribution manipulation becomes much stronger.
The final decision should identify the affected dates, publishers, event IDs, contract clauses, evidence and calculation. That is more defensible than saying the traffic looked bad.
Recommended operating checklist
- Define the payable event and permitted traffic sources before launch.
- Require source and sub-publisher transparency.
- Record click, install, first-open and post-install timestamps in a consistent format.
- Monitor click-to-install timing and source-level volume changes.
- Compare cohorts by country, operating system, app version and publisher.
- Check device, account, IP, ASN and event-sequence reuse.
- Review post-install quality without using it as the only fraud signal.
- Hold or review anomalous cohorts under clear contractual terms.
- Request evidence from the affiliate and preserve the investigation record.
- Classify the result as validated, suspicious, policy-breaching or confirmed according to documented standards.
- Feed confirmed findings back into source approval, attribution and payout controls.
FAQ: affiliate fraud in CPI campaigns
What is CPI affiliate fraud?
CPI affiliate fraud is the manipulation of clicks, installs, attribution or post-install events to obtain install commission without delivering legitimate, permitted acquisition.
What is the difference between click spam and click injection?
Click spam creates many clicks in the hope that one receives credit for a later install. Click injection attempts to place a click immediately before an install completes, often to win last-click attribution.
Is every very fast install fraudulent?
No. Some users legitimately install an app soon after clicking an offer. Fast timing is a signal for investigation, especially when it appears in large clusters and is supported by other evidence.
How can I detect affiliate install fraud?
Analyze source-level volume, click-to-install timing, device and account reuse, network patterns, event ordering, sub-publisher transparency and post-install behavior together.
What data should a CPI affiliate pass back?
At minimum, use a unique click ID, affiliate and publisher identifiers, timestamps, campaign details and the fields needed to reconcile the click with the install and later events.
Can a real device be used for fraudulent attribution?
Yes. Attribution fraud does not require a fake device. A real user or device can be intercepted by click spam, click injection, forced redirects or an undisclosed placement.
Are device farms always detectable?
No. Some device farms use genuine phones and residential or mobile connectivity. Detection usually requires a combination of reuse, behavior, account patterns, timing and infrastructure analysis.
Should I block traffic from hosting providers?
Hosting or proxy traffic can be a useful risk signal, but blanket blocking can create false positives. Validate it against campaign context, device signals and downstream behavior before taking action.
What is a good click-to-install time?
There is no universal good range. It depends on the app, market, placement and user journey. Use comparable cohorts and investigate unusual concentrations rather than applying a global cutoff.
Does low retention prove affiliate fraud?
No. Low retention can result from poor targeting, onboarding friction, app quality or an unsuitable incentive. It shows that the traffic may be low value and can support a fraud case when combined with manipulation signals.
How should incentivized installs be handled?
State clearly whether incentives are allowed, what disclosures are required and which events qualify. Investigate hidden or misleading incentives as policy violations even when the install itself is technically genuine.
When should CPI payouts be held?
Hold a defined cohort when there is a material, documented anomaly that cannot yet be explained and the agreement permits review. A hold should have a scope, owner, evidence request and resolution process.
Can attribution providers prevent all CPI fraud?
No. Attribution tools can improve event reconciliation and identify risk signals, but program terms, source transparency, independent analysis and human review remain important.
What is the difference between suspicious and confirmed fraud?
Suspicious traffic has evidence of abnormality or risk. Confirmed fraud requires stronger evidence that the traffic or attribution violated the applicable rules or was deliberately manipulated.
How do I investigate a sub-affiliate?
Request the sub-affiliate identity, placement URLs or screenshots, acquisition method, campaign creative and traffic dates. Reconcile those details with click IDs, timing, device patterns and conversion quality.
Can I claw back every install from a bad affiliate?
Only if the contract and evidence support that action. Narrow the affected cohort where possible, document the basis for the calculation and give the affiliate a fair opportunity to respond.
What is the first control to add to a new CPI program?
Define payable events and require transparent publisher-level tracking. Without clear source identity, later fraud detection and payout disputes become much harder.
Semantic map
The following semantic relationships describe the main entities and investigation concepts covered in this guide.
- CPI campaign uses install attribution to calculate affiliate payouts.
- Affiliate fraud manipulates traffic, attribution or conversion events.
- Click spam generates excessive clicks to capture later installs.
- Click injection places a click near install completion to influence last-click credit.
- Fake install traffic uses automation, emulators or device farms.
- Install validation checks event integrity and required metadata.
- Fraud detection evaluates behavioral, temporal and infrastructure signals.
- Traffic prevention reduces the opportunity and profitability of abuse.
- Traffic blocking stops specified sources, devices or events under defined rules.
- Affiliate transparency requires publisher and sub-publisher identification.
- Post-install quality measures user behavior after the install.
- False-positive control compares multiple signals and relevant cohorts.
Related Traffic Fraud Lab resources
For a wider investigation, compare this CPI-specific workflow with the broader affiliate fraud guide, review techniques for click fraud detection, and examine bot traffic analysis. If the main concern is event integrity rather than source behavior, also review the material on conversion tracking fraud.