How Fraudsters Are Moving Their Tricks In-App

People will always say there’s mobile fraud and then there is desktop fraud. But really you should think about it as mobile web and desktop in one bucket, and then in-app in a completely separate bucket.

When you’re analyzing fraud, you’re thinking about the environment that you’re analyzing—regardless of whether it is on a phone or computer. The device itself is less important than the fact that you’re looking at a webpage vs. in-app in a completely different environment.

Compared to two years ago, there has been a very heavy shift toward fraud being committed in-app specifically. As the money flows to in-app, obviously that is where the fraud is going to go since that’s where they can profit the most.

Over the last year we have seen a shift in how fraudsters work the malware. The old model is infecting someone’s device and then opening invisible windows in the background to load ads and steal ad revenue.

I highly disagree with the notion that SDK-based detection is necessary.

There are a lot of problems around that. Not many folks understand how to integrate SDKs correctly. The other issue is reach. Even if we integrate our SDK, we have to wait for everybody to update the app that they’re using so that they get the newest version of the SDK. It can take up to a year to get an actual good level of reach.