Google told a solo developer he got 21 app installs in one day. His own admin panel counted 1. The other 20 were bots, and they’re probably picking on your ad budget too. Fake app installs have become the quiet tax on anyone buying users, and the industry’s own data says most of it hides in the one place nobody checks.
The story comes from Nick Abe, who runs Dayzle, a small puzzle app. He turned on a Google Ads campaign for Android at CA$40 a day, optimized for installs. Two weeks and CA$220 later, his numbers fell apart in a way every small advertiser should study.
The $220 lesson in app install fraud
The campaign started slowly. Abe set a target cost per install of CA$1.50, and Google couldn’t find installs that cheap, so it barely spent. Then he removed the target as a test. Spend immediately doubled the daily budget to CA$80, and Google proudly reported 21 installs.
One problem. The admin panel said 1. And that gap is the first symptom of fake app installs: the ad platform’s number and your app’s number disagree.
So he did what a numbers guy does: dug into the raw analytics. All 21 new Android devices that day were real devices, sort of. But 20 of them were running an old version of the app that the Play Store had stopped serving days earlier. You can’t download an old version from Play. Those phones got the app from somewhere else, a saved copy of the file, even though every single one claimed Google Play as its installer.
Then they opened the app once, spent zero seconds on any screen, and vanished. Twenty-eight different phone models across nineteen states. For twenty phones. That’s not variety, that’s a costume change.
Over the full two weeks the math got ugly: 56 installs billed by Google, 33 showing that exact bot pattern, 7 more from countries the campaign never targeted, and 13 actual humans. Those 13 real people finished 92 games between them. The app is good. The ads never really reached anyone.
How the bot farm beat the algorithm
Here’s the part that should make you uncomfortable, because it’s not a hack in any classic sense. The bots played by Google’s measurement rules and won anyway.
The farm’s routine: watch the shortest video in the ad group, don’t click it, then install the app from a stashed copy of the file instead of the store. Why skip the store? It’s faster, and Play might notice. Google counts a video view followed by an install as a conversion. So every fake install made the campaign look better, which told Google’s algorithm to send more ads to the farm, which triggered more fake installs.
A perfect loop that converts your ad budget into a bot farm’s revenue. Nobody broke in. The system paid them.
And before you file this under “tiny app, edge case”: AppsFlyer’s State of Fraud for Marketers 2026 analyzed 106.4 billion installs across 246,000 apps and found that organic traffic, the channel every marketer treats as the clean baseline, now accounts for 52% of all fraudulent installs. Affiliates and organic together carry roughly 9 in 10 fake installs. Juniper Research projects global ad fraud losses of $172 billion in 2026. If a bot farm can find a CA$40-a-day puzzle app, your budget is already on someone’s list.
Five checks that catch fake app installs
You don’t need enterprise fraud tooling to spot fake app installs. You need one evening and your analytics export.
- Compare installs to your own panel. Google’s install count and your in-app analytics should roughly match. A gap wider than 20-30% is a flare.
- Check app versions of new installs. Real users come from the current store version. A cluster on an old, yanked version means someone’s sideloading a saved copy.
- Look at session zero. Open once, zero seconds on screen, never return. One user like that is a bad night. Thirty-three is a farm.
- Watch device and geography spread. Dozens of phone models across many states, all behaving identically, is a costume, not a crowd. Same with installs from countries you never targeted.
- Track a real-action ratio. Divide users who do the thing that matters (finish a game, place an order) by billed installs. Dayzle’s was 13 of 56. Yours should be much better than that.
Run these weekly, not yearly. Fraud campaigns burn hot and fast: Abe’s farm found his CA$40-a-day budget within days of loosening a constraint. A monthly audit would have caught it two weeks and CA$150 too late. For scale context, AppsFlyer found self-reporting networks like Google and Meta account for only about 1.5% of measured fraud, while the gap between affiliate fraud rates and SRN rates hit 36x by early 2026. Translation: the cleaner the channel looks on paper, the more the bots work everywhere else, so audit accordingly.
Make your campaign expensive to fake
Abe’s smartest move wasn’t a fraud filter. It was changing what a “win” means. His campaign now optimizes for “won a puzzle” instead of “opened the app.” As he put it, a script can open an app and click around; making one solve a Sudoku is another level of effort entirely.
That’s the general principle: optimize for in-app actions a bot can’t fake cheaply. Purchases, level completions, form submissions verified server-side. The further the goal sits from “install,” the more fraud costs the fraudster, and they go bother someone easier. You don’t have to outrun the bots. You just have to be more expensive to farm than the next app.
Keep an eye on costs too. If a campaign suddenly spends double your daily budget the moment you loosen a constraint, that’s not always genius targeting. Sometimes it’s fake app installs finding you.
What to do if you were hit
File Google’s invalid traffic form. That’s the official channel for disputed clicks and installs, and it’s where Abe’s refund request sits now. Bring your evidence: the version mismatch, the zero-second sessions, the out-of-geo installs. Screenshots plus a raw analytics export beat a paragraph of anger.
Then assume the refund may take a while and restructure meanwhile. Switch the campaign goal to a real in-app action, add the checks above to your weekly routine, and pause anything whose numbers you can’t reconcile with your own panel. Ad platforms will keep optimizing toward whatever you reward. Reward only what real users do.
The bigger picture
Fraud migrates to wherever scrutiny is weakest. AppsFlyer’s data shows owned-media fraud up 221% year over year and DSP fraud up 59%, because everyone tightened affiliate measurement and the bots moved house. It’s the same pattern we saw when AI job applications flooded recruiters and created the application doom loop, and again when AI agents ran real businesses and earned exactly nothing: automation finds the gap between what a system measures and what actually matters, then lives there. Conversational AI tools like voice feedback bots are changing the demand side too, which is why checking who’s real on the other end of a metric is becoming a core skill, not a paranoia.
Run the five checks on your current campaigns this week. If the numbers reconcile, sleep well. If they don’t, you just saved yourself $172 billion’s worth of company.
