Rewarded advertising pays real money for real actions, which means people will try to manufacture the actions. This is what gets tried and what runs against it.
Multi-accounting
The attempt. One person, twenty accounts, completing the same sign-up offer twenty times.
Why it works elsewhere. Offers usually pay once per user, and "user" is whatever identifier the publisher sends.
What runs. Each end user gets a stable token derived from the placement and their id, so an advertiser can dedupe per person across their whole catalogue. Device, address and behavioural signals are checked at click time, and blocks can be applied per user, per address or per placement. Advertisers do their own deduplication downstream, and anything that gets through both usually comes back as a reversal.
Emulators and farms
The attempt. Automated installs at scale from a data centre, or from a rack of phones.
What runs. Device and environment checks at click time, address-based screening, and rate limiting per user and per placement. The strongest signal is behavioural rather than technical: a farm produces a completion pattern no real user produces, concentrated in one offer, one address range, one window of hours.
Forged postbacks
The attempt. Call the crediting endpoint directly with a made-up conversion. It is the cheapest attack in this list and the most common against publishers specifically.
What runs. Every inbound postback carries a shared secret, and one that fails is refused and logged rather than silently dropped. Every outbound postback we send you is signed with your placement's own secret key, over the user, the transaction and the amount, so you can prove it came from us.
Your part. Verify that signature, and compare it in constant time. An endpoint that credits without checking is the weakest link in the entire chain, and it is entirely inside your own code.
Click stuffing
The attempt. Fire clicks on every offer so that any conversion the user happens to make later attributes to you.
What runs. Clicks are recorded before the redirect with their own identifier, and conversions attribute to a specific click rather than to whoever clicked most recently. Volume per user is capped, and a user producing clicks far beyond what a person can produce is throttled.
Currency manipulation
The attempt. Change the amount in the callback, or replay a legitimate one repeatedly.
What runs. The amount is signed, so an altered one fails verification. A replayed one is caught by deduplication on the transaction id: the second delivery is answered as already recorded and moves nothing.
And the general rule underneath it: money is never taken from a callback. What an advertiser pays comes from their campaign, never from the callback that reports the conversion. Nothing an inbound request says can change what anybody is charged.
What we do not claim
Nothing here catches everything, and a system that claimed to would be lying. Sophisticated fraud gets through every screen in this industry, which is exactly why reversals exist and why every conversion — including the refused ones — is stored with its reason.
The honest description is layered: cheap checks before anything is written, our own screening after that, an advertiser's reconciliation after that, and a reversal path for whatever survives all three.
What it means for each side
Publishers: verify the signature on every postback, use a stable user id, and watch for a reversal rate that changes rather than one that exists. A modest amount of reversal is the system working.
Advertisers: buy at a depth that fraud cannot cheaply fake. An install is easy to manufacture; a level 5 after seven days is not, and pricing at that depth is a better fraud control than any filter.