Evaluate click and ad fraud protection by asking where each fraudulent view, click or install is produced, and whether the product can see that place. Otukan works inside your Android and iOS app, including Unity games. It detects emulator farms, scripted taps, hooks on ad completion code and repackaged copies that swap your ad identifiers, and it attaches a session verdict to each paid or rewarded event your backend records. It does not scan other apps on the device or audit your ad networks. Fraud that happens outside your app stays with your attribution and reconciliation process, which Otukan’s evidence makes sharper.
Game-wide revenue risks are covered on game and revenue protection.
Attack behaviour
Ad fraud has two victims. When you sell ad space, fake views and clicks inflate your reports until networks claw revenue back. When you buy installs, fake installs and conversions spend your budget on nobody. The journeys differ, but the behaviour inside the app is familiar.
| Behaviour | Victim journey | What the fraudster gains | What Otukan observes |
|---|---|---|---|
| Rewarded-view farming | Rewarded ad watched on dozens of emulated devices | In-game currency to resell, or payout from a partner | Emulator and virtual-device signals per session |
| Scripted clicking | Taps generated by a service, not a finger | Paid clicks and completed offers | Input arriving from automation on Android |
| Faked completion | Ad reported as finished without playing | Rewards with no ad shown | Hooks on your ad completion path |
| Clone monetisation | Your app rebuilt with the fraudster’s ad identifiers | Your audience earning for someone else | Rebuilt package and foreign signing identity |
| Install farms | Many installs and first opens from reset devices | Payouts for installs no person made | Emulators, masked networks and device resets |
The underlying patterns are covered on mobile ad fraud prevention.
Detection limits
A security team evaluating this area needs a clear line between what an app can see and what it cannot.
Visible from inside your app
Your app can check its own code and signing identity, how touches reach it, the hardware and system it runs on, and the network conditions of its session. On Android, it can also see accessibility services and overlays that interact with it. On iOS, the sandbox exposes less about the device, so Otukan relies on the app’s own process, loaded libraries and environment signals there. Each platform’s signals are designed and tested on their own devices, and an Android result is never assumed for iOS.
Outside the app’s view
Some fraud never touches your code. Another app can claim credit for an install it did not cause, and fraudsters can send fabricated events straight to an ad or attribution server. Confirming those cases takes your attribution partner’s data, server-side reconciliation and, for a live incident, investigation beyond one device. Otukan does not scan the whole device, and it does not replace those checks. It gives them an independent in-app view to compare against.
Response
Proportionate controls
Ad fraud responses should cost the fraudster money, not cost your users access. Good defaults are to keep serving ads, withhold rewards from flagged sessions, exclude flagged clicks and installs from payouts, and stop only rebuilt clones at launch. Test each response three ways: reproduce the farm or script in an authorised lab and confirm the signal, repeat the same journey on a clean supported phone and confirm nothing changes, then re-run install, update, sign-in and your rewarded-ad flow.
What to measure
Judge the rollout on money, not detections. Track rewards withheld, paid clicks and installs excluded from payouts, network clawbacks over time and support contacts about held rewards. The result to aim for is fewer clawbacks and lower acquisition cost per retained player, with support volume flat.
Support paths for legitimate users
Some flagged sessions will be people: a player on a PC emulator, a user whose assistive tool taps for them, a commuter on a corporate VPN. Tell them plainly why a reward is on hold and give support a way to release it. Otukan’s verdict names the signal behind each hold, so support can explain it rather than guess.
Otukan’s response options are covered on threat response.