The installs that look good but aren't: what fraud signals revealed

The indie developer's blind spot

If you're shipping an app and spending on user acquisition, you probably know which channels are driving installs. Google Play, App Store Search Ads, maybe a few ad networks you've tested. But here's what most indie developers don't see: whether those installs are actually real.

Not in the sense of some dramatic fraud ring. Real as in, did an actual person tap 'Install', or did a bot click through? Real as in, is that user going to launch your app tomorrow, or did the install register on a burner device that'll never touch it again?

When you're bootstrapped or working with a small team, you don't have the budget for enterprise attribution tools. You also don't have the time to chase down network-by-network performance data. That blind spot is expensive. We've heard from developers losing 15 to 20 percent of their acquisition budget to low-quality installs, and they didn't even know it was happening.

What fraud signals actually tell you

Attribr's Pro tier includes a feature we call fraud signals plus ad-network roll-up. It sounds technical, but the point is simple: we show you which installs are likely fraudulent, and we aggregate that data by the networks they came from.

Fraud signals in Attribr aren't a separate service. They're baked into the attribution logic itself. When an install comes in, we're already running deterministic and probabilistic matching to figure out where it came from. Part of that process involves flagging installs that match patterns we know are problematic: device resets within minutes of install, installs from devices that'll never authenticate properly, rapid-fire installs from the same network range, that sort of thing.

In the dashboard, you see a breakdown by network. Network A shows 2,400 installs this month, 87 percent of which look legitimate. Network B shows 1,800 installs, but only 64 percent pass the fraud signal check. Suddenly you've got a data point that matches your gut feeling. You can pause that network, dial down spend, or use it for different campaigns.

A studio in Berlin told us last month they caught a network inflating their numbers by about 400 fake installs per week. They had no idea until they looked at the roll-up in Attribr. That's roughly £2,000 a month they were wasting.

Why roll-up matters more than individual signals

You could argue that individual fraud signals are the real win here. Catch one bad install, block it, move on. But that misses the pattern.

Ad networks aren't monolithic. The same network might be running legitimate campaigns for one partner and questionable stuff for another. When you aggregate fraud signals across all installs from Network X, you start to see whether the network itself is the problem, or just one campaign within it.

Roll-up also lets you compare networks side by side. If you're testing three networks at once (which most sensible developers do), you want to see which one is actually delivering real users. The dashboard shows you retention cohorts grouped by network, so you can see not just the fraud signal count, but whether those flagged installs were ever going to stick around anyway.

We spent three months building the roll-up views because we kept hearing the same request: 'I don't want to download a CSV and run a pivot table. Show me the story.' So we did.

The Rippl connection

Here's something worth mentioning. Attribr is the only attribution SDK with a direct bridge to Rippl, our performance marketing platform. If you're using Attribr, you can see exactly which Rippl promoter drove each CPI install. That's powerful on its own.

But when you combine that with fraud signals and network roll-up, it gets better. You can now see not just which promoter is sending installs, but which promoters are sending installs that pass fraud checks and actually retain. You can reward the promoters who deliver real users. You can also see if a promoter is cherry picking their best installs and sending you the rest, because the data will show it.

Integration without the complexity

Pro tier users sometimes ask if this complexity means a harder integration. It doesn't. The SDK itself is still 50KB, zero third-party dependencies, less than 50ms launch overhead. Three lines of code in Swift or Kotlin, and you're running Attribr. The fraud signals and roll-up happen server side. You don't need to configure anything special. You just turn on Pro, log in, and the dashboard starts showing you the numbers.

That's because we believe the tool shouldn't add friction. If you're a solo developer or a small team, you're already juggling enough. We wanted to make sure that access to this kind of data didn't require hiring someone to interpret it.