Install validation is the process of verifying that a reported app install is genuine. Without validation, your attribution data includes fake installs from device farms, emulators, SDK spoofing, and other fraud techniques. Accurate attribution depends on knowing which installs are real.<\/p>\n\n\n\n
This guide covers install validation techniques. For click injection specifically, see click injection detection<\/a>. For attribution fraud broadly, see attribution fraud: detection and prevention guide<\/a>.<\/p>\n\n\n\n In a typical mobile ad campaign, 10-30% of reported installs may be fraudulent (according to industry estimates<\/a>). If you spend $50,000 on a campaign that delivers 10,000 installs, and 2,000 of those are fake, your effective CPI is $6.25 instead of $5.00. More importantly, your attribution data is corrupted: you are optimizing campaigns based on data that includes fake users.<\/p>\n\n\n\n Both Apple and Google provide receipt validation APIs that confirm an install came from the official app store.<\/p>\n\n\n\n iOS: App Store Receipt<\/strong><\/p>\n\n\n\n The App Store receipt<\/a> is a cryptographically signed file that proves the app was downloaded from the App Store:<\/p>\n\n\n\n Server-side validation:<\/p>\n\n\n\n Android: Play Integrity API<\/strong><\/p>\n\n\n\n The Play Integrity API<\/a> (successor to SafetyNet) verifies that the app is genuine, the device is not rooted, and the install came from Google Play:<\/p>\n\n\n\n Verify that attribution SDK events are coming from your actual app, not from a spoofed SDK:<\/p>\n\n\n\n Verify installs on your server by checking multiple signals:<\/p>\n\n\n\nWhy Install Validation Matters<\/h2>\n\n\n\n
Validation Techniques<\/h2>\n\n\n\n
App Store Receipt Validation<\/h3>\n\n\n\n
func validateAppStoreReceipt() -> Bool {\n guard let receiptURL = Bundle.main.appStoreReceiptURL,\n FileManager.default.fileExists(atPath: receiptURL.path) else {\n return false \/\/ No receipt, not installed from App Store\n }\n\n guard let receiptData = try? Data(contentsOf: receiptURL) else {\n return false\n }\n\n \/\/ Send to your server for validation\n \/\/ Your server calls Apple's verifyReceipt endpoint\n return sendToServerForValidation(receiptData)\n}\n<\/code><\/pre>\n\n\n\nasync function validateAppleReceipt(receiptData: string): Promise<boolean> {\n \/\/ Try production first\n let response = await fetch('https:\/\/buy.itunes.apple.com\/verifyReceipt', {\n method: 'POST',\n body: JSON.stringify({ 'receipt-data': receiptData }),\n });\n\n let result = await response.json();\n\n \/\/ Status 21007 means sandbox receipt, retry with sandbox URL\n if (result.status === 21007) {\n response = await fetch('https:\/\/sandbox.itunes.apple.com\/verifyReceipt', {\n method: 'POST',\n body: JSON.stringify({ 'receipt-data': receiptData }),\n });\n result = await response.json();\n }\n\n return result.status === 0; \/\/ 0 = valid\n}\n<\/code><\/pre>\n\n\n\nclass IntegrityChecker(private val context: Context) {\n suspend fun checkIntegrity(): IntegrityResult {\n val integrityManager = IntegrityManagerFactory.create(context)\n\n val nonce = generateNonce() \/\/ Server-generated nonce\n\n val request = IntegrityTokenRequest.builder()\n .setNonce(nonce)\n .build()\n\n val response = integrityManager.requestIntegrityToken(request).await()\n val token = response.token()\n\n \/\/ Send token to your server for verification\n return verifyOnServer(token, nonce)\n }\n}\n<\/code><\/pre>\n\n\n\nSDK Signature Verification<\/h3>\n\n\n\n
interface InstallEvent {\n appId: string;\n sdkVersion: string;\n timestamp: number;\n signature: string;\n deviceInfo: DeviceInfo;\n}\n\nfunction verifySDKSignature(event: InstallEvent, secretKey: string): boolean {\n const payload = `${event.appId}:${event.timestamp}:${event.deviceInfo.deviceId}`;\n const expectedSignature = hmacSHA256(payload, secretKey);\n return event.signature === expectedSignature;\n}\n<\/code><\/pre>\n\n\n\nServer-Side Install Verification<\/h3>\n\n\n\n
interface ValidationResult {\n valid: boolean;\n score: number; \/\/ 0-100 confidence score\n flags: string[];\n}\n\nfunction validateInstall(event: InstallEvent): ValidationResult {\n const flags: string[] = [];\n let score = 100;\n\n \/\/ Check 1: Device ID format\n if (!isValidDeviceIdFormat(event.deviceInfo.deviceId)) {\n flags.push('invalid_device_id');\n score -= 40;\n }\n\n \/\/ Check 2: Timestamp sanity\n const now = Date.now() \/ 1000;\n if (Math.abs(now - event.timestamp) > 3600) {\n flags.push('timestamp_drift');\n score -= 20;\n }\n\n \/\/ Check 3: Known emulator signatures\n if (isEmulatorSignature(event.deviceInfo)) {\n flags.push('emulator_detected');\n score -= 50;\n }\n\n \/\/ Check 4: App store receipt\n if (!event.storeReceipt) {\n flags.push('no_store_receipt');\n score -= 30;\n }\n\n \/\/ Check 5: IP reputation\n if (isDataCenterIP(event.deviceInfo.ip)) {\n flags.push('datacenter_ip');\n score -= 40;\n }\n\n \/\/ Check 6: Duplicate device ID\n if (isDuplicateDevice(event.deviceInfo.deviceId)) {\n flags.push('duplicate_device');\n score -= 30;\n }\n\n return {\n valid: score >= 50,\n score: Math.max(0, score),\n flags\n };\n}\n<\/code><\/pre>\n\n\n\nFraud Signals<\/h2>\n\n\n\n
Device-Level Signals<\/h3>\n\n\n\n