Is hidden fraud draining a third of mobile app ad budgets?
Kochava has uncovered a sophisticated fraud scheme, labeled Monolith Fraud by its data scientists, which is siphoning millions from app install campaigns running within the walled garden of a trusted super publisher.
Kochava’s findings report Monolith Fraud consumed on average a third or more of ad budgets. For some leading brands, in the worst cases, more than two-thirds of attribution claims from the network were for fake devices.
According to Grant Simmons, VP, Kochava Foundry: “Monolith Fraud is a sophisticated operation hiding in plain sight, veiled within sources considered the safest in the business. Unlike garden-variety click farms, Monolith Fraud utilises virtual machines (VMs) that meticulously mimic real devices. These VMs are programmed to emulate authentic install behaviours: downloading apps, opening them, and even faking app usage patterns. What sets them apart? Their attempts at sophistication, but also the shortcuts fraudsters take that expose their schemes.”
The Kochava team uncovered that these VMs create app install traffic that on the surface appears legitimate. However, when examined with high-resolution data, tell-tale patterns emerge, including:
- Constrained device signals: Fraudulent installs often report unusual consistency in device parameters, such as identical battery level, screen brightness, and device volume. Real user devices naturally produce diverse data, whereas VMs operate in bulk with rigid, non-random settings.
- Zombie installs: Most fraudulent installs skip critical steps like registering or even opening the app, a step real users routinely take but bots avoid.
- Suspicious install timing: These installs tend to occur in tightly packed, sequential clusters, with timing and fingerprint patterns never exhibited in organic user behaviour.
Simmons continued: “What makes Monolith Fraud particularly alarming is its origin. Rather than coming from suspect ad networks or relatively unknown partners, this fraud is emanating from within the publisher and sub-publisher inventory network of a major, self-attributing, owned and operated super publisher. In other words, a source that the entire industry is conditioned to trust.”
“These platforms have long been the gold standard for transparency and authenticity. Now, however, fraudsters are adapting, exploiting even these upper-echelon traffic sources. This signals that the safety net the industry has relied upon for years may no longer exist.”
The overall impact for brands and developers is staggering:
- Budget impact: As previously noted, in the worst cases, more than a third of ad budgets were routed to these fraudulent installs.
- Attributed conversion impact: On a cohort of impacted brands, Monolith Fraud consumed as much as 22-55% of total app attributions.
- Attribution claims for fake devices: For one major brand, two out of every three attribution claims from the network were for fake devices. For other brands, the rate was between 11–34%.
Simmons continued: “We are the first and only mobile measurement partner (MMP) to bring this Monolith Fraud to light and it’s because of our unique data collection and retention strategy.”
Instead of discarding “redundant” event and install data, as many other MMPs do to save on data storage costs, Kochava stores granular device signals, event timings, and user engagement data. This enables Kochava to dive in and explore subtle anomalies that other solutions overlook.
“Compounding the matter is the fact that walled-garden super publishers don’t share all impressions and click signal data, only the records for one-to-one conversion claims. This lack of holistic data stifles fraud prevention methodologies that observe anomalous ad signal indicators,” Simmons stated.
“If you’re observing unexplained dips in retention, lower engagement and registration rates, unusual device parameter consistency or rapid-fire installs—do not ignore it. These could all be red flags, especially if you’re running campaigns with premium, owned and operated network placements,” concluded Simmons.
