Click Spamming: Paying a UA Agency for Your Own Organics

A few weeks after publishing our first case study on install fraud sold by a reputable French UA agency, a different client came to us with a question that had nothing to do with fraud, at least on the surface: why were organic installs dropping month after month while paid volumes looked stable?

We audited the account. We found fraud again, again bought through a UA agency, but of a different kind. The first case was SDK spoofing: fake installs that never existed. This one was click spamming: real installs, mostly organic, hijacked by an attribution game. The client was paying a partner for users who would have installed anyway. This case study walks through what we found, how we proved it, and what happened when the source was paused.

The starting point: a mysterious drop in organics

The client is a consumer app with a healthy organic base and a mix of paid channels, including a UA agency selling network traffic on a CPI basis. Nothing looked alarming in the dashboards. CPI was low, paid installs were steady, the agency reported month after month within target. Yet organic installs, which had been the app's largest source for years, were sliding, and nobody could explain why. ASO rankings had not moved, store conversion rate was drifting down slightly, and there had been no product change.

Because Scalebay handles UA and data together, our first reflex was not to look at ASO. It was to look at what the paid channels were doing to attribution.

What the audit found

We pulled raw click and install logs from the MMP for the agency's traffic over the last few months. The numbers spoke for themselves:

• 89 million clicks generated for only 30,742 attributed installs
• Click-to-install conversion rates between 0.01% and 0.07%, far below anything you see on legitimate mobile inventory
• Performance well under mobile acquisition benchmarks on every quality metric
• A strong click spamming / click flooding signature: massive click volumes with no corresponding user intent
• Installs landing hours, sometimes days, after the "click" that supposedly caused them
• Low traffic quality and degraded retention on the attributed cohort
• Traffic that was most likely not incremental at all, built to win attribution rather than to bring users

The mechanism is well known. A network fires enormous volumes of fake or invisible clicks (background ads, pre-loaded clicks, click injection on Android). Most of them lead nowhere. But when a user who was going to install the app anyway does so within the attribution window, the last-click model credits the network. The advertiser pays a CPI for an organic user, and the organic line in the dashboard goes down by exactly the amount the paid line goes up.

There is a second cost that is easy to miss. All those clicks go to the App Store product page. Tens of millions of visits that convert at 0.01% crush the store conversion rate, and the App Store algorithm reads a page that does not convert as a page that should rank lower. So click spamming does not only steal organics after the fact; it suppresses them upstream too. That was the missing explanation for the ASO drift.

Our recommendations

We gave the client a short list, in this order:

• Analyse click-to-install time (CTIT) by source to identify abnormal distributions. Legitimate traffic peaks in the first minutes; spammed traffic is flat and long-tailed.
• Check the concentration of installs arriving several hours or days after the click.
• Temporarily pause the agency's source entirely.
• Measure how total install volume evolves during the pause.
• Check whether attributed installs fall without any significant impact on the overall total.
• Confirm or invalidate the click spamming / attribution hijacking hypothesis from that data, not from the agency's reporting.

The test: "prove us wrong"

The agency disputed the analysis, as agencies do. So we asked the client for one thing: pause the source for two weeks and watch total installs, not attributed installs. If the traffic was incremental, the app would lose the 30,000-odd installs per period the agency was billing for. If it was not, the installs would simply move back to the organic column.

The result was immediate. Organic installs rose by more than 10% within days of the pause, and total install volume did not drop. The users had never left; they had been relabelled. The client had been paying a UA agency for their own installs.

The results

• Click spamming confirmed by the pause test: attributed installs disappeared, total installs held
• Organic installs up more than 10% immediately after the source was paused
• Store conversion rate recovering as the fake click traffic stopped hitting the product page
• Budget previously spent on the agency reallocated to channels with demonstrated incrementality
• Click-to-install time and install-timing checks added to the client's monthly UA reporting

What we take from it, and what you should check

This is the second fraud case we have uncovered in a few months, on two different accounts, sold by two different UA agencies. The pattern is not that agencies are dishonest. It is that resold network traffic is opaque by design, the agency itself often cannot see sub-publisher behaviour, and MMP dashboards show attributed installs without ever asking whether those installs would have happened anyway.

A few lessons worth keeping:

• A drop in organics with stable paid volumes is a fraud signal, not an ASO problem, until proven otherwise.
• Click-to-install conversion under 0.1% is not "top of funnel traffic". It is click spamming.
• The only real incrementality test is a pause. If total installs hold when a source is paused, you were paying for attribution, not for users.
• Click fraud has a hidden ASO cost: it drags down store conversion rate and store rankings.
• Ask any traffic seller for sub-publisher IDs, CTIT distributions and install timing before signing. If they cannot provide them, treat the traffic as unverified.

At Scalebay, uncovering fraud has become a recurring part of our audits, not because we look for it, but because it keeps showing up when you check attribution data against reality instead of against a partner's report. If your organics are sliding and nobody can tell you why, or if you buy network traffic in black-box mode, get in touch. A two-week pause test costs nothing and answers the question for good.