Millions of Android users and countless developers publish apps worldwide. That means you need to block every fraudulent app before it can cause damage.
With programmatic display ad spending higher than ever, advertisers running app-based campaigns must stay alert. Not every app is as legitimate as it seems.
We’ve studied fraudulent apps and found some in the Play Store with up to hundreds of thousands of user downloads. Every one of them has the potential to drain your advertising budget.
Just because an app is published, that doesn’t automatically mean it is safe.
Read on to discover how app-based ad fraud is performed, how to identify fake apps, and the devastating effects they can have on your campaigns.
- What detrimental effects do fraudulent apps have on advertising budgets?
- How do fraudulent apps get published?
- Why don’t app marketplaces always remove fraudulent apps?
- The common types and techniques used in app-based ad fraud
- How to identify fraudulent apps in the Play Store
- 5 examples of fraudulent apps found in the Play Store
- Being aware of fraudulent app publishers is only the first step
What detrimental effects do fraudulent apps have on advertising budgets?
Advertisers everywhere suffer major consequences from fraudsters targeting their ad campaigns.
Fake ad engagements
The bottom line: every fake ad engagement your campaign receives wastes more of your ad budget. Fraudsters capture a substantial share of ad budgets, money that could otherwise go to real, valuable users. And as you’ll see below, we’re not talking about a handful of user installs. We’re talking about hundreds of thousands.
Theft of payouts
Despite fraudsters faking the engagements, they still receive final payouts. Not only is this deeply unfair, but it results in the theft of real conversions. Advertisers still get invoiced for the fake views, which particularly impacts those using a CPM campaign model.
Skewed analytics
Often, your campaigns are only as good as your analytics. If fraudsters have flawed your data, it will negatively influence your future campaigns and ad spend budgets.
Reputation
Fraudsters publish most fake apps in beta mode, which means users cannot leave reviews and warn others against downloading them. These apps also frustrate users, who believe they’ll actually work, only to find out otherwise. Eventually, they cause reputational damage, since users associate the ads of the brands shown with the annoying experience on the app.
How do fraudulent apps get published?
Each app marketplace has its own regulations and requirements when it comes to publishing apps. Fraudsters are innovative and know how to get away with hosting fake apps and fraudulently engaging with ads in the Play Store. Some of the ad fraud techniques fraudsters use are sophisticated. But the methods they use to make apps seem harmless and legitimate, and avoid detection, are often quite simple. Let’s take a look at how they do it.
Publish apps in beta mode
Legitimate app developers use beta mode to get user feedback on features and test the waters. Fraudsters use it instead to soft-launch fraudulent apps and avoid garnering user reviews.
Basically, users can’t leave public reviews once they’ve installed and accessed fraudulent apps in beta mode.
Use fake content on the Play Store page
Fraudsters use legitimate-looking screenshots of an app in use, plus stolen or improvised text, to make an app appear safe. That lures users into installing it so fraudsters can generate fake ad impressions, clicks, and leads.
Purchasing existing apps
Sometimes, fraudsters buy existing apps that developers have abandoned or left dormant. They then use them to fraudulently display and engage with ads.
Why don’t app marketplaces always remove fraudulent apps?
App marketplaces have removed fraudulent apps many times once discovered. Google, for example, withdrew more than 1,700 Android apps infected with Bread malware in 2020 alone. But the core problem remains: fraudsters are able to publish them in the first place.
Even with Google, modern fraudsters can circumvent its prevention techniques and insert their apps into the Play Store.
Google does remove numerous fake apps. But the sheer number launched every day makes it nigh-on impossible for even Google to keep track of.
At Opticks, we analyzed and detected fraudulent apps before Google had the chance to identify them. Not only did we detect the fraudulent app traffic, but we blocked it from infiltrating clients’ ad campaigns.
To protect campaigns from fraudulent apps, we also regularly check that apps delivering traffic are on the Play Store. Plus, both our anti-fraud specialists and customers can view the app names delivering traffic to campaigns. This way, we can both check whether the app is wanted and also verify its legitimacy manually before blacklisting it.
The common types and techniques used in app-based ad fraud
There’s no single way that fraudsters attack your app-based ads. In fact, they employ many types of ad fraud and ad fraud techniques to illicitly engage with them and drain your budgets.
Below, we go through the most common types of ad fraud and the tactics fraudsters use to prey on your ad campaigns.
SDK spoofing
This bot-driven mobile ad fraud method sees fraudsters creating fake, though seemingly genuine, app installs and post-install events. They achieve this by adding code to an app that can later trigger simulated ad clicks, app installs, and fake engagements.
Fake app attacks
Similar to SDK spoofing, fraudsters also create fake app “attacks”. This method involves creating fake apps as part of a (usually sophisticated) fraud campaign for maximum diffusion.
Often, these apps look extremely similar to other well-known apps, sometimes even using the same branding, name, and content as them.
Silent, hidden background ads
Hidden background ads deplete advertising budgets with fake views. The 2020 Drainerbot campaign highlighted this type of app-based ad fraud, where fraudsters ran apps silently to generate fake video views.
Ask users to enable certain permissions in the app
Fraudsters are incredibly sneaky. Once users install an app, fraudsters ask them to allow extra permissions the app doesn’t actually need, just to deliver ads. A common global case: apps ask users to enable notification management, then abuse that permission to send hordes of ad-containing notifications.
Each permission granted enables certain actions, such as notification, internet, and “receive SMS” permissions. Some, like internet access, aren’t dangerous and require no user confirmation, while others require explicit confirmation.
Permissions that aren’t necessary for the app to run should raise suspicions of fraud. Think sending and receiving messages for a flashlight app, or notifications for a camera app.
Content locking and fake content techniques
Content locking is when you must register or click through to gain access to the app. As well as getting false permissions, fraudsters also try to disguise the ad register as if it is the app login.
As you’ll see from some of the real-life examples later in this article, fraudsters also use fake content to lure users into downloading apps. These apps promise features they don’t actually have, or that aren’t even technically possible.
How to identify fraudulent apps in the Play Store
Although Google has implemented multiple security checks to prevent malicious apps from entering the Play Store, several fraudulent apps remain undetected.
So, how can you spot fraudulent apps in the Play Store? There are a few tell-tale signs:
- Apps with zero user reviews and/or those published in beta mode can be a red flag for ad fraud. For this reason, it’s good practice to always double-check user reviews.
- Some apps promise to deliver features that aren’t possible or easy to perform via Android. If an app claims it can change the charging screen or recover deleted media, this is a likely tip-off that it’s fraudulent.
- Always check the developer’s email address and how many apps they’ve published. If they’ve only published one app and have an odd-looking email address, this app is probably not legitimate.
- If the app description is low quality, with typos and grammatical mistakes, that can signal a scam awaits after installation.
5 examples of fraudulent apps found in the Play Store
So, what do fraudulent apps actually look like? Below are five real-life examples found on Google’s Play Store, each with a minimum of 100,000 user downloads. Their potential for ad fraud is massive.
Ultra Games
100,000 user downloads
Ultra Games looks like a “game toolbox,” but as the video below shows, it contains nothing at all. This is a perfect example of the fake content technique.
Once the app is downloaded, it opens a full-screen ad. The app doesn’t actually work. It only opens the ad, and that’s what the advertiser pays for.
Since this app runs in beta mode (see above), users can’t leave reviews to warn others away from downloading it.
Flashlight LED
100,000 user downloads
Despite its name, the Flashlight LED app does not provide an LED flashlight upon download. It actually uses the hidden ad technique to illegitimately charge advertisers for unseen views.
As seen in the video, once the app is opened, a fake error — imitating a system error — appears. Flashlight LED also has a long loading screen before the app opens. This loading dialogue cunningly runs operations on a remote server, checking for ads to deliver to specific advertising segments or locations.
Like the Ultra Game app, Flashlight LED also runs in beta mode to avoid user reviews.
Recover App
500,000 user downloads
The Recover app is similar to the Flashlight LED app: it displays hidden ads, has a long loading screen, and is in beta mode.
Charging Animation Light
100,000 user downloads
The Charging Animation Light app pretends to show users a range of animations while their devices charge. In reality, it uses fake content, hidden ads, and beta mode techniques, with the same duplicitous loading screens and fake error messages as the apps above.
Pony Camera
500,000 user downloads
This app allows users to change their hair into “pony hair” via their cameras. However, they can’t access the app until they allow notification management permission, something the app shouldn’t actually need. This is actually a content locking technique the app uses to then constantly send ad notifications to users. Surprisingly, the app has no user reviews, even though it hasn’t been published in beta mode.
Being aware of fraudulent app publishers is only the first step
Marketplaces fail to catch and block many fraudulent apps, causing huge problems for advertisers.
Even though developers might look different on the surface, multiple ad fraud schemes have reached millions of installs. Their reach extends globally to multiple advertisers. You can manually check your placements and publishers for suspicious activity, but that isn’t an efficient use of your time and resources.
Opticks’ fraud detection solutions give you deep visibility into the origin of your traffic, including apps and their Play Store status. That helps block fraudulent app traffic before it can drain your budget and destroy your campaigns.
Want to learn how the expert team at Opticks can help protect your advertising campaigns? Contact our team today or start your free trial.