Guia antifraude Protect360

How is the Estimated savings widget calculated?

For networks that support sharing cost data you get an accurate estimation of the savings.

Para redes que não oferecem suporte a isso, a AppsFlyer usa o eCPI médio proveniente de todo o grupo de instalações verificadas de todas as fontes que possuem dados de custo. Caso seu aplicativo ainda não tenha uma fonte com dados de custo, você será solicitado a inserir manualmente um eCPI estimado ao acessar o painel.

As fontes de mídia às quais o anunciante concedeu acesso ao Protect360 não conseguem ver os dados de economias estimadas.

O Protect360 funciona contra fraudes provenientes de links de atribuição personalizados?

Definitely! Protect360 detects and blocks fraud coming from custom attribution links, in addition to ad networks. That means you are also protected if you have campaigns of owned media, such as with influencers, email and SMS campaigns, web site banners and landing pages, viral posts on social media, Push notifications or even QR codes.

O que há de novo no Protect360 V2 em comparação com o V1?

1. There are 3 main changes in the P360 V2.0:
   Post-Attribution fraud - wherever we present blocked installs, we also show Post-Attribution fraud installs. Post-Attribution is also available as a raw data report.
2. Insights de anomalias - adicionamos uma nova seção chamada "Insights de anomalias", onde os anunciantes podem analisar anomalias através de ferramentas de visualização. Ela está substituindo os 2 gráficos na antiga guia "Detecção avançada".
3. Centralização de todos os dados relacionados a fraudes - removemos a guia "Detecção avançada" e, em vez disso, apresentamos todas as informações em 1 guia.

Why isn't the post-attribution raw data available in the Export Data page?

Post-attribution reports are on the account level per media source, In order to make the reconciliation process easier. The Export Data page is on the single app level, and still contains the Blocked fraud data on the app level, for backwards compatibility.

Os dados pós-atribuição são atualizados retroativamente?

• Installs - install data on the overview page and all other reports outside Protect360 dashboard, does not update retroactively.
• In-app events - once the post-attribution protection layer identifies an install as fake, following in-app events coming from this install are being blocked. Previous in-app events do not update retroactively.

When selecting specific networks in Anomaly insights, the data looks different?

I looked at the CTIT anomalies and selected AF_Baseline as benchmark. It showed me one network's anomalies (first screenshot below). Then I selected the same network as benchmark, expecting to see no anomalies, but now there are other ones (second screenshot). Why?

This outcome is actually what you should expect. When the trusted baseline is used, the network shows abnormal rate of CTIT in the 24-39 seconds range. These installs are "subtracted" from the normal distribution, which means that regular traffic should have some "abnormal" spikes compared with the problematic traffic of the specific network.

O tráfego orgânico anormal é realmente fraudulento?

É possível que picos anormais no tráfego orgânico sejam realmente fraudulentos. Em geral, se você vir tráfego orgânico na AppsFlyer que você tem motivos para acreditar que seja realmente fraudulento, pode ser um dos três casos a seguir:

• Failed attribution fraud: fraudster's clicks failed to receive attribution, e.g., click flooding with the last click taking place beyond the click lookback window.
• Non-attribution fraud: user performs fraud, that is not related to attribution, e.g. using fraud to collect items in strategy games.
• SDK integration issues: check that your in-app events are sent correctly, i.e. at the right time in the flow and with correct event parameter values.

Detectar fraudes em novos dispositivos

Fraudsters may mask their devices by frequently resetting the main IDs of their devices, i.e. IDFA for iOS and GAID for Android.

Fortunately, AppsFlyer identifies over 98% of mobile devices globally.

Therefore, a high percentage of unknown new devices is a strong indication of fraud by click farms, unless intentionally targeting new devices.

Detectar novos dispositivos:

1. In Protect360 go to the Identified fraud breakdown table.
2. Scroll right to the Device farm indicators - new devices columns.
3. Click on the Installs % column name to sort the table in descending order of new device ratio.
4. Comparativos de fraudes em novos dispositivos:

• • Suspect sources with 100+ installs, which have over 60% new devices ratio.
  • Fontes com relativamente mais instalações também são suspeitas, com uma proporção menor de novos dispositivos, por exemplo, uma fonte com 1.000 instalações é suspeita como fraude com uma taxa de 40%.
  • For borderline sources, compare the loyal users ratio with the general loyal users ratio, found in the Aggregated performance report table in the dashboard overview page. A relative low percentage is a strong indication of fraud.

Detectar fraude no LAT

LAT (Limited Ad Tracking) users select to opt out of exposing their device ID, IDFA or GAID, to advertisers. Approximately 15% of iOS users and 10% of Android users take this choice.

Do mesmo modo que a nova classificação de dispositivos, os usuários do LAT podem ser legítimos. No entanto, uma alta porcentagem deles pode indicar atividade fraudulenta.

Detectar o LAT:

1. In Protect360 go to the Identified fraud breakdown table.
2. Scroll right to the Device farm indicators - LAT devices columns.
3. Click on the Installs % column name to sort the table in descending order of LAT device ratio.
4. Comparativos de fraudes em dispositivos LAT:

• Suspect sources with 100+ installs, which have over 60% new devices ratio.
• Fontes com relativamente mais instalações também são suspeitas, com uma proporção menor de novos dispositivos, por exemplo, uma fonte com 1.000 instalações é suspeita como fraude com uma taxa de 40%.
• For borderline sources, compare the loyal users ratio with the general loyal users ratio, found in the Aggregated performance report table in the dashboard overview page. A relative low percentage is a strong indication of fraud.

Detectar fraude de flooding de cliques

1. Using click flooding, fraudsters send millions of clicks with real device IDs, hoping to register as the last click for real users. Sources with this type of fraud have very low conversion rates, but high-quality users, since these are real users.

   Como detectar flooding de cliques:

   1. In Protect360 go to the Identified fraud breakdown table.
   2. Scroll right to the Click flooding indicators columns.
   3. Click on the Conversion rate column name to sort the table in ascending order of conversion rate.
   4. Comparativos de flooding de cliques:
   • Normal Conversion Rates are between 0.5% to 35%.
     Suspect sources whose conversion rate are abnormally low, or that have 25% or less of the average conversion rate of the app. You can find this KPI in the Aggregated performance report table in the dashboard overview page. 
   • For borderline sources, compare the Assists % with the average assists ratio. You can see the normal assists ratio in the assists widget, in the dashboard overview page.
     Sources whose assists ratio is 50% higher than the average assists ratio of the app are considered suspicious.
     Note that the more sources are used by an app, the higher are its Contribution rates.

Detectar flooding de cliques com indicadores CTIT

Another indication of click flooding, is even distribution of CTIT.
Usually, around 70% of normal installs take place within 1 hour from the ad engagement.
With click flooding, there's no connection between the fake engagement and the actual install. This leads to much more than 30% of fraud installs, which have longer than 1 hour CTIT. 

Como detectar indicações CTIT de flooding de cliques:

1. In Protect360 go to the Identified fraud breakdown table.
2. Scroll right to the Click flooding indicators - CTIT columns.
3. Comparativos de CTIT de flooding de cliques:

• Normally, Over 60 minutes values should be around 30%. Suspect sources who have more than 50% with this metric.
• Normally, Over 5 hours values should be around 20%. Suspect sources who have more than 40% with this metric.

Use the Anomaly insights page to investigate sources with suspicious CTIT.

Number of installs

Filtering by the number of installs per checked source is important for detecting the biggest fraud sources. Additionally, lower number of installs may not be mathematically significant. Note:

Note: Sources with less than 30 installs, or even 50, are not significant enough to draw conclusions from. Expand the date range or other search criteria to get more significant results.

Change loyal user definition

The default definition for Loyal users is 3 or more launches of the app. It is an important KPI for user engagement, but unfortunately many fraudsters know it and use it to fake high rates of loyal users, thus avoiding suspicion. Avoid being conned by creating and selecting a better, more elaborate loyal user definition.

Analyze your app user quality KPIs such as register, tutorial completion, purchase, multiple sessions. Within the app code send a new loyal user in-app event if a user performs ALL the list of KPIs.

After the first non-organic loyal user event is sent, go to App Settings and select it to indicate loyal users for your app. Expect general loyal user rates to slightly drop and then drastically drop for fraudulent sources.