Device farms and click farms, explained: how abuse scales and what you can detect.

Device farm detection looks for many devices that are suspiciously alike, arriving from one network and doing the same thing. A device farm is a stack of real or virtual devices run by scripts, a click farm is a room of paid people doing the same by hand, and both exist to make one operator look like thousands of customers.

This explainer covers how farms work, what shows in your data, what Fingerly reports for each kind, and, honestly, where the evidence runs thin. A single device cannot reveal that it belongs to a farm. The pattern across devices can.

#What is a device farm, and how is a phone farm different?

A device farm is a collection of devices, controlled together, that exist to generate activity. Some are racks of physical phones wired to a controller. Others are emulators or virtual machines running by the dozen on a few servers. Phone farm detection and device farm detection are the same discipline: both look for devices that act as a group.

Operators use them to create accounts, install and open apps, complete offers, watch ads and claim rewards, because each device looks like an independent customer. Some farms use real hardware precisely because it looks authentic. Others favour emulators because they are cheap to multiply.

#What is a click farm?

A click farm uses people instead of scripts. Workers, paid per action, sign up, like, install, review and click on real phones, often by the hundred in one location. Because the devices are genuine and the behaviour is human, click farm detection cannot rely on spotting a fake device. It has to spot the shape of the work instead.

Both kinds feed the same abuse: fake reviews and review fraud, referral fraud and incentive abuse, invalid traffic that wastes advertising budgets, bonus abuse, scalping, and fraud rings that pool accounts to cash out together.

#What does a farm look like in your data?

It looks like repetition. Individually every account passes. Together they are a pattern, and the pattern is the evidence.

• Many near-identical devices behind one network or a small set of networks, in a short window.
• Freshly reset or newly provisioned devices, appearing in a stream rather than at the pace of real customers.
• The same sequence of actions on each account: sign up, claim, withdraw, in the same order and at the same speed.
• Accounts connected by something shared, such as a payout destination, a referral chain or a device you have already seen.
• Emulators, simulators and cloned apps in your mobile traffic, because virtual devices are how farms scale cheaply.
• Bursts of activity from devices far busier than your normal traffic.

#What does Fingerly report about farms?

Device farm detection has two halves, because no single device can see that about itself. A native app can tell when its own device looks provisioned for bulk use rather than owned by a person. The server sees the other half: many near-identical devices behind one network in a short window, compared with your own traffic after a learning period of seven days and at least 1,000 identifications. When both halves fire, confidence rises while the weight is counted once.

• Device farm: a device that looks mass-provisioned or freshly reset, or that shares traits with many devices at once. It exists on web, Android and iOS.
• Emulators and simulators: an Android emulator or virtualised Android, and the iOS Simulator, reported by the native SDKs. On the web, virtual machines are reported.
• Cloned apps: an Android app running inside a cloning framework, next to copies of itself.
• Instrumentation and attached tooling, which often accompany farms that drive apps automatically.
• Network context: datacenter and residential proxies, VPNs, Tor exits and mismatched locations.

On mobile, the SDK recognises an app install by a random install ID, never by the phone’s hardware, so the farm findings are about how a device looks and behaves, not about who owns it. Each finding has a weight you control, and the weights add up to a suspect score and level for each identification.

#What can you not detect?

A well-run click farm of genuine phones owned by different people, in different places, doing believable things at human speed, is hard to tell from real customers in any single session. Detection stays honest about this. Fingerly does not claim to find every farm, and farms that do not look alike, share no network and avoid your volume patterns will pass individual checks.

What you can do is stop the farm from being profitable. Abuse at scale depends on a reward that pays out, so the strongest defences work on the payout, not the person.

#How do you reduce the payoff for farms?

Put friction on rewards, not on browsing, and use the evidence to decide how much. A starting playbook for incentive and promo abuse, to tune on your own traffic:

• Tag each identification with the action it protects, such as signup or claim, and verify the event on your server by request ID with a secret key before granting a benefit.
• Limit claims per visitor ID in your own database, and add a unique index on the promotion and the visitor ID, so two simultaneous redemptions cannot both succeed.
• Hold rewards for a short waiting period, so linked accounts can be reviewed before value leaves.
• Ask for verification, such as a phone number or a payment method, before a payout rather than at signup.
• Send a device farm, emulator or cloned app finding to manual review, and refuse a high level outright.
• Cap rewards per network over a window, tuned so that offices, campuses and mobile carriers are not caught.

Because the visitor ID is stored with every account, the accounts connected to a device are one query away. Use it when you ban someone, when you review linked accounts, and when you look into a fraud ring after the event. Fingerly can also send a webhook when an identification reaches the high level, so you can alert your trust and safety team in real time.

#How do you avoid catching real customers?

Shared networks are normal. Offices, campuses, hotels and mobile carriers put many real people behind one address, so treat network signals as context. A second hand phone, a freshly reset device after a repair, and a family sharing a tablet all resemble parts of a farm. Observe before enforcing, prefer verification and review to outright refusal, tell customers the limit is per device in your promotion terms, and keep an appeal route.