Myth: a short click-to-install time always means fraud
The rule of thumb everyone repeats: CTIT under 10 seconds = click injection, block it. Sometimes. Often it's just a fast download.
Click injection does produce suspiciously short CTIT because the fraudulent click fires moments before install completes. But pre-loaded apps, fast Wi-Fi on small apps, and deferred deeplink flows also produce sub-10s legit installs. A flat low-CTIT filter nukes real users on fast connections.
✓ CTIT distribution analysis is a legit injection signal
✓ A spike of near-zero CTIT from one publisher is a real flag
✗ A blanket low-CTIT block kills fast-download legit installs
✗ Click injection on Android moved to flooding too — CTIT alone misses it
Look at the shape of the distribution, not a single threshold. Injection shows an unnatural cluster at the floor; clean traffic shows a smooth curve.
Verdict: use CTIT distributions for diagnosis, skip the single-threshold block — it false-positives real users.
Best for: anti-fraud analysts hard-coding a 10-second CTIT cutoff.
In-App Bench
@InAppBench
Myth: a short click-to-install time always means fraud
Этот пост опубликован в Telegram-канале In-App Bench. Подписаться можно по ссылке: @InAppBench.