The CPL and CPI deals that drain your budget silently

How a clean dashboard hides a bad source — plausible volume, post-invoice collapse, cohort analysis, contact and retention checks, and the renegotiation

1. 01 · Delivery

   The volume looks valid

   400 leads in 72 hours. 2,000 installs in a week. Both dashboards clean, both invoices approvable on what's visible at the top of the funnel.

   →
2. 02 · Camouflage

   Built to pass basic validation

   No overnight spike — 35 to 50 leads a day at consistent timing, real contact details, enough behavioural variance to clear validation. On installs, generated behavioural sequences mimic onboarding so the tutorial runs and the first action fires.

   →
3. 03 · Collapse

   It shows up after the invoice

   Six weeks on, contact rate from that source is 1.4% against 19 to 22% for legitimate partners, and the clawback window has closed or was never written. Day 7 retention on the installs hits zero the moment the commission locks.

   →
4. 04 · Diagnosis

   Cohort by source, not cost per unit

   Pull lead-to-contact by source, and Day 7 and Day 30 retention by traffic source. As the record's examples: 18 to 35% Day 30 on funded accounts is normal, below 8% points at a device farm or undisclosed incentivised traffic. Check hourly distribution too — real traffic has variance.

   →
5. 05 · Move

   Renegotiate, pause, or cut — with the record

   Document the cohort evidence, then renegotiate, pause or cut the source, and close the contract gap. No lead-quality clawback and no post-install event requirement aren't oversights — the record calls them open invoices. The fraud doesn't beat detection; it waits for your payment terms.

Stated in the record as diagnostic examples — 35 to 50 leads per day drip pattern; 1.4% contact rate from the bad source versus 19 to 22% for legitimate partners; Day 30 retention of 18 to 35% on funded accounts, below 8% flagged.

How a clean-looking dashboard hides a bad traffic source, in five stages as the record describes them. First, the delivery looks valid: 400 leads in 72 hours from a CPL partner, 2,000 installs in a week from a CPI partner, both dashboards clean. Second, the pattern is built to avoid alerts: the record says modern CPL fraud no longer spikes overnight because that triggers alerts. Instead it sends 35 to 50 leads a day at consistent timing matching normal conversion windows, with real names, emails and phone numbers scraped or bought and submitted with enough behavioural variance to pass basic validation. On the install side, the numbers are real but the users are not — SDK spoofing and device-farm installs now use generated behavioural sequences that mimic onboarding, so the app opens, the tutorial runs and the first action fires, passing attribution fraud filters. Third, the collapse shows up after the invoice: six weeks later, contact rate from that source sits at 1.4 percent while legitimate partners run 19 to 22 percent, and the clawback window has closed or was never written into the deal. On installs, Day 7 retention goes to zero — no deposits, no second sessions, no engagement once the attribution window closed and the commission locked. Fourth, cohort and source analysis is what reveals it: pull lead-to-contact rate by source, and Day 7 and Day 30 retention by traffic source. The record's diagnostic examples, not universal rules — legitimate mobile partners in CFD and iGaming run 18 to 35 percent Day 30 retention on funded accounts, and below 8 percent points to a device farm or undisclosed incentivised traffic. It also suggests pulling the hourly distribution: natural affiliate traffic has variance, spiking on weekends and dipping midweek, while consistent daily drips at near-identical intervals are a signal rather than a coincidence. Fifth, the record's move: renegotiate, pause or cut the source with the evidence documented, and close the contract gap — no lead-quality clawback in a CPL deal and no post-install event requirement in a CPI deal are, in its words, open invoices waiting to be collected. Its closing line: the fraud does not beat your detection system, it waits for your payment terms.