How it works
Fake installs come from bots and emulators running in data centres, from device farms where real phones install apps over and over while resetting their identifiers, and from SDK spoofing, where a server imitates the messages an SDK would send without any app being installed. Stolen credit, or attribution fraud, uses fake clicks: click flooding and click injection. Detection looks at where traffic comes from (data-centre addresses, anonymising proxies and VPNs), at timing (the distribution of time between click and install), at volume (too many clicks from one device or address) and at what happens after the install.
Why it matters for an app team
Fraud takes budget directly and then a second time by corrupting the data used for decisions: a fraudulent source looks cheap and efficient, so more money is sent to it. Where networks are paid per install, the incentive is always present.
In practice
Example with made-up numbers: a source delivers 5,000 installs at $0.40 each. 3,000 of them come from a handful of data-centre address ranges and show no activity after the first open. $1,200 was paid for users who do not exist.
Common confusion
Low quality is not always fraud: a real but uninterested audience also retains badly. And good post-install numbers do not rule fraud out, because stolen organic users behave like the real users they are. No rule set catches everything, so rejected-install reports should be read alongside each network's conversion and timing patterns.