How it works
Click flooding, also called click spamming, sends huge numbers of clicks for devices that never saw an ad, in the hope that some of those people later install the app on their own. Under last-touch rules the fake click then claims the install. Click injection is more precise and specific to Android: a malicious app on the device notices that a new app is being installed and fires a click in the seconds before it is first opened. Both are caught through timing. Flooding produces a very low click-to-install conversion rate and installs spread evenly over many hours or days after the click. Injection produces installs within seconds of the click, or a click time that falls after the installation had already begun, which the Play Install Referrer timestamps reveal.
Why it matters for an app team
The advertiser pays for users who would have come anyway, and organic or honestly earned installs are relabelled as paid. Budgets then move towards the fraudulent source because its numbers look good.
In practice
Example with made-up numbers: a source sends 2,000,000 clicks and is attributed 1,000 installs, a conversion rate of 0.05%, with install times spread flat across seven days. That pattern points to click flooding.
Common confusion
Neither technique creates fake users, so retention and revenue look normal and quality checks alone will not catch it. That is the difference from fake installs produced by bots or device farms.