Catching device-reset fraud: 18% of 'installs' were one click farm

Catching device-reset fraud: 18% of 'installs' were one click farm
A UA team scaled a CPI campaign on a cheap incent source and CPI looked great at $0.42. Retention told another story — D1 was 4%.

Using Adjust's fraud signals plus a custom check on too-perfect click-to-install times (CTIT spike at exactly 7–11s), they flagged a cluster sharing reset device IDs and identical sensor entropy.

Clawback after analysis: 18% of installs (47k of 261k) were one device farm cycling resets.

✓ CTIT distribution alone surfaced it before retention did
✓ Source refunded under the MMP fraud appendix
✗ Fingerprint-based detection weakened on iOS post-ATT
✗ Two-week lag before clawback cleaves cashflow exposed

Verdict: watch CTIT histograms, not just CPI and D1.
Best for: buyers testing unknown incent inventory.