Indie developer finds 60% of paid installs from a $220 Google Ads campaign were bots

A small budget, a suspicious number

The developer behind Dayzle, a small Android puzzle game, has published a detailed account of apparent ad fraud at miniature scale. Over two weeks of Google Ads campaigns optimized for installs, he says roughly 60% of the installs he was billed for were automated — a conclusion he reached by auditing his own analytics rather than trusting Google's dashboard. The post reached the front page of Hacker News.

According to the write-up, the campaign ran at CA$40 per day with the objective set to installs. For the first few days it barely spent anything; with a target cost per install of $1.50, Google couldn't deliver at that price. The developer removed the target as an experiment, and spending immediately doubled the daily budget to CA$80 while Google reported 21 installs. His own admin panel showed one.

How the fake installs were spotted

The dashboard gap had a mundane explanation — older builds of the app don't report an install date — so the developer went to the raw device analytics. There he found 21 new Android devices that day, 20 of them running a version of the app that the Play Store had stopped serving days earlier. Since Play doesn't distribute outdated builds, those devices had to have obtained the app elsewhere, even though every one of them listed Google Play as the installer.

Their sessions looked mass-produced: each launched the app once, recorded no time on any screen, and never returned. Across the campaign, the suspicious devices spanned 28 phone models in 19 states — considerable variety for hardware that all behaved identically.

The two-week totals: 56 installs billed by Google, 33 matching the bot pattern, seven more originating in countries the campaign never targeted, and 13 genuine people. Those 13 finished 92 games between them, which the developer took as evidence that real users enjoy the product.

Why the fraud fed itself

The suspected mechanics describe a feedback loop rather than a one-off theft. The farm would watch the shortest video in the ad group without clicking it, then install the app from a saved copy of the package file rather than from the store — faster, and less likely to attract Play's attention. Because Google counts a view followed by an install as a conversion, every fake install improved the campaign's measured performance, which pushed more of the ad delivery toward the farm, which produced more fake installs. The optimizer, working exactly as designed, kept steering money into the fraud.

What changed since

The developer has filed Google's invalid-traffic form and is waiting for a reply; he plans to report back on whether a refund materializes. He has also switched the campaign's conversion goal from opening the app to winning a puzzle. The reasoning is economic: it is trivial to script an app launch and some taps, and considerably harder to script something that actually solves a puzzle. The aim is to make his app more expensive to fake than the next one.

He considers that adequate protection for an app of his size, and suspects larger apps — worth more effort to farm — see far more of this traffic than their owners realize.

Why it matters

Ad fraud is usually discussed through industry-wide estimates. This is the opposite extreme: one developer, a $220 budget and a complete audit trail, and a few lessons that generalize.

Google's install count is a real number, but it is not the number advertisers assume it is — here the billed total and the human total diverged by roughly a factor of four, with nothing in the dashboard flagging it. The feedback loop also matters beyond this case: any campaign optimized for a conversion event that is cheap to fake will mechanically reward whoever fakes it best. And the proposed mitigation — choosing conversion events that are expensive to simulate — costs a small developer nothing to adopt.

The account is one developer's analysis, and Google's response to the invalid-traffic claim is still pending, so the bot-farm attribution is not independently confirmed. But the practical warning stands: platform-reported conversions deserve a check against raw analytics, because bot farms evidently do not need a large budget to find a target.