Context: Large brand, large budget, confusing results
A large international brand with dozens of locations nationwide was actively investing in mobile app promotion. UA (User Acquisition) budgets amounted to tens of thousands of dollars per month. The numbers in the advertising dashboards looked weak, but there was no clear understanding of the cause—why this was happening.
When the team began looking deeper—at retention, in-app activity, and actual orders—the picture became even more terrifying. A significant portion of the "installs" did not convert into a single target action, and the ad-to-app conversion yielded poor sales. It was as if the users were simply evaporating...
"We saw that ads were set up and being shown to users, thinking everything was working correctly. When we started investigating why the conversion to the first order was so low, it became clear: a significant share of the traffic was low-intent or completely non-target. Our actual customers were barely seeing the ads."
Diagnostics: What exactly was happening with the traffic
Step 1. Cohort funnel analysis
The first step was a detailed cohort analysis of advertising traffic sources, cost, and goal completions. Installs from different channels were compared not by quantity, but by quality: Day 1, Day 7, Day 30 retention, first-order conversion, average check, and ad-to-install conversion.
The gap was colossal. Organic users converted to their first order at a rate of around 40%. Users from a portion of the paid channels—less than 3%. This discrepancy could not be explained solely by differences in audience quality.
Step 2. Identifying fraud schemes
A detailed, visit-level analysis of the traffic revealed several classic fraud schemes operating simultaneously.
- Click Injection. Malicious apps installed on real users' devices tracked organic installations and, milliseconds before they completed, generated a "final click" claiming to be from a paid source. The brand was paying the affiliate network for users who arrived entirely on their own. This traffic accounted for over 2.4%.
- Device Farm traffic. A portion of the installs was generated by device farms—real smartphones controlled by automated scripts. The devices completed the entire installation process, launched the app, and simulated initial actions—but went no further. This traffic accounted for over 12%.
- Click Fraud. Competitors and automated services systematically clicked on advertising banners, artificially exhausting the daily budget. Ads were turned off in the middle of the day—exactly during the peak activity period of the target audience—and the budget was wasted on empty clicks without a single target action. This traffic exceeded 17%.
Step 3. Assessing the scale of losses
Following detailed attribution, it became clear that over a third of all paid installs were either direct fraud or zero-value users acquired through incentivized traffic disguised as organic.
The real CPI (Cost Per Install for a user who completed at least one order) turned out to be 2.3 times higher than what the advertising dashboards displayed.
Numbers before we started
Conversion to first order from paid channels: less than 3%
Share of fraudulent and low-quality installs: over 30%
Real CPI vs declared CPI: ×2.3
Day 7 retention of paid users: critically lower than organic
Solution: Multi-layered protection across all funnel stages
Level 1. Pre-click filtering
At the first level, a traffic source analysis system was implemented to operate before the click was even registered by the ad platform. Every ad click was verified against a database of suspicious IPs, device parameters, and source behavior patterns.
Clicks originating from known botnets, historyless VPN addresses, and devices with suspicious fingerprint parameters were blocked immediately—preventing budget deductions.
Level 2. Post-install behavioral biometrics
The second layer operated on the landing page users visited prior to installing the app. While standard pixels log visits without distinguishing humans from bots, our system analyzed on-page behavior: scroll depth, time to click the install button, cursor movement patterns, and repeat visits from the same device.
Sessions exhibiting non-human behavior were excluded from optimization audiences—ensuring the ad platforms stopped treating them as the benchmark for a "good user."
Level 3. Audience cleansing and algorithm retraining
Fraudulent profiles were systematically purged from all retargeting and lookalike audience segments. As a result, Facebook and Google algorithms received a clean training dataset consisting solely of real users who had genuinely placed orders.
This drastically improved not only the quality of new campaigns but also the efficiency of active automated bidding strategies: they stopped optimizing towards "perfect" bots. Consequently, the cost of acquiring a real user dropped significantly.
Level 4. Revising partnership agreements
Based on the granular traffic quality data collected for each partner, cooperation terms were aggressively revised. Sources exhibiting a high share of fraud were disabled. The budget was reallocated entirely to channels that demonstrated actual conversion into orders.
Results: What changed in 60 days
Key metrics post-implementation
- +30% real installs with the exact same advertising budget. Money that previously vanished into fraud began acquiring genuine, living users.
- First-order conversion increased 4x — jumping from less than 3% to over 12% across paid channels.
- Real CPI decreased by 40% — achieved by excluding fraudulent installs from calculations and efficiently reallocating the budget.
- Day 7 retention grew by 22% — platform algorithms finally began bringing in an audience that resembled actual buyers, rather than bots.
- Budget savings exceeded 25% — funds that were previously paid out for fraudulent traffic were safely redirected into performing channels.
Why the result was exactly this
The key insight of this case study is that fraud in mobile User Acquisition inflicts double damage. The first, most obvious damage: you pay for installs that do not exist. The second, hidden damage: the data generated by fraud traffic poisons the very algorithms that subsequently optimize your campaigns. By removing the fraud, you don't merely save money—you fix the compass that guides your entire advertising budget.
This is exactly why the results were disproportionately large relative to the operational changes: the same budget, practically the same channels, and the identical team—but with fundamentally superior traffic quality and clean data feeding the learning algorithms.
Main takeaway
"The problem wasn't that we were spending too little money on advertising. The problem was that a third of the budget was going to the wrong place. Once we fixed that, the numbers grew on their own, without any increase in investment."
Intelligent protection for your online advertising with ClikBy
We engineered AI Selena not just as a standard filter, but as a comprehensive behavioral biometrics system. The platform analyzes over 130 explicit and implicit indicators (ranging from cursor movement speed to the minutiae of network protocols) in real-time.
- Ensemble machine learning: we combine 5+ ML models specifically to recognize synthetic identities and Device Farm traffic.
- Zero-Trust Attribution: we rigorously verify every install, neutralizing threats like Click Injection and SDK Spoofing.
- Adaptive thresholds: the system autonomously lowers filter strictness during high-volume sales periods to drastically minimize False Positives.
Read more about how ad fraud protection operates in our detailed guide: how anti-fraud works in modern advertising.
Order anti-fraud protection for advertising (Google Ads, Meta Ads, and other platforms)
