AppsFlyer flags fraud shift to organic traffic in Asia

AppsFlyer has published its State of Fraud for Marketers 2026 report, which tracks changes in mobile ad fraud between Q1 2025 and Q1 2026.

Fraud rates fell in Vietnam and Singapore over the period, but the report argues those declines were driven by the shutdown of a specific fraud operation rather than by a broader improvement in market conditions.

In Vietnam, the fraud rate fell 31% year on year, from 29% in Q1 2025 to 20% in Q1 2026. Singapore showed a similar pattern, with elevated organic fraud persisting for three consecutive quarters before dropping sharply in Q4.

That spike-and-drop pattern suggests action against a single operation rather than a lasting reduction in exposure. The underlying weakness remains, with fraud activity appearing to have paused rather than disappeared.

Elsewhere in Southeast Asia, Indonesia recorded what the report describes as a more durable improvement. Its fraud rate fell 26% year on year, from 17% to 13%, making it one of the stronger recoveries among markets with elevated fraud levels.

India stood out for a different reason. The country recorded the highest affiliate fraud concentration among major markets in the dataset at 65% and accounted for nearly 28% of all global Android fraud.

That made India a major driver of the study's global figures. When fraud levels shift in India, global averages move with them because of the market's scale in Android app activity.

Organic shift

A central finding of the report is the rising role of organic traffic in fraud. Globally, organic traffic accounted for 52% of all fraudulent installs, making it the largest single fraud channel in the dataset.

The report is based on anonymised, aggregated data from 246,000 apps with at least 1,000 installs during the period under review. In total, it covered 106.4 billion installs, including 55.3 billion paid installs, across iOS and Android.

According to AppsFlyer, the shift towards organic traffic reflects changes in how fraud moves when scrutiny increases elsewhere. In the Finance category, for example, the share of fraud attributed to organic traffic rose from 35% to 46% after advertisers tightened measurement around affiliate activity.

Across the report, affiliates and organic traffic together accounted for nine in 10 fraudulent installs. Affiliates alone represented nearly 40% of all fraud, while the gap between affiliate fraud rates and those of self-reporting networks reached 36 times in Q1 2026 and stayed above 30 times in every quarter covered.

Platform divide

The study also found a sharp divergence between mobile operating systems. iOS fraud fell 33% year on year, from 17.5% in Q1 2025 to 11.7% in Q1 2026, putting it below Android for the first time in the report's tracking.

Android remained the bigger concern in several areas, particularly in sectors with heavy spending on user acquisition. Gambling on Android was the only vertical still showing a rising fraud rate, climbing from 49% to 59% year on year and reaching 64% in Q4 2025.

AppsFlyer said Real Users Lift in Android Gambling hit 175% in Q4, which it defined as advertisers paying for nearly two fake users for every real one acquired. In Android Finance, the report found no improvement over five consecutive quarters, with Real Users Lift staying between 50% and 53% since Q1 2025.

Fraud migration

The report also highlighted growth in channels that may receive less attention from advertisers. Owned media fraud rose 221% year on year, while fraud linked to demand-side platforms rose 59%.

Those increases fit a broader pattern in which fraud shifts into channels where detection is weaker once checks become tighter in more visible parts of the advertising market.

Ronen Mense, President and Managing Director, APAC, at AppsFlyer, addressed the role of organic traffic in the findings.

"There's a question worth asking: why would a fraudster attack organic traffic when there's no direct payout for doing so? The answer is that organic is the benchmark. It's the number every marketer uses to judge whether a paid campaign is performing. If you can inflate that number, you shift what 'normal' looks like, and suddenly, fraudulent paid installs no longer look fraudulent. They look like they're just keeping pace. Whether that's intentional or not, it's the effect. And right now, a lot of marketers are optimizing against a benchmark that's been moved," said Mense.