> ## Documentation Index
> Fetch the complete documentation index at: https://help.airbridge.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Lag Time

Suspicious touchpoints can be detected by identifying unusual lag time or Touchpoint-To-Install-Time. Touchpoint-To-Install-Time is the time interval between a touchpoint and the following app install.

## Rule Setup

1. Navigate to **\[Settings]>\[Fraud Validation Rules]**.
2. Select the **\[Lag Time]** tab and click **Add a rule**.
3. Select **Click** or **Impression** as **\[Touchpoint]**.
4. Select **Less than** or **Greater than** as **\[Condition]**.
5. Enter the time interval. It can be set in seconds, minutes, hours, and days.
6. Select **\[Prevention Level]** and click **Save**.
7. Click **Add a rule** to add more rules. When you have added multiple rules, any touchpoint that matches at least 1 of the configured rules will be considered suspicious.

<Danger>
  **Attention**

  It is advised to start from "Prevention Level 1" and switch to higher levels after consulting with your media partner, as the prevention level setting may have a direct impact on the ad performance.
</Danger>

### Prevention Level

Events attributed to the suspicious touchpoints detected by the lag time rules are processed according to the set prevention levels.

| <span style={{ display: 'inline-block', minWidth: '100px' }}>Prevention Level</span> | <span style={{ display: 'inline-block', minWidth: '200px' }}>Description</span>                                                                                                                                                                                                                            |
| ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Level 1: Tag as fraud                                                                | - Events attributed to the suspicious touchpoints will be tagged as fraud in the Airbridge reports and raw data export files.                                                                                                                                                                              |
| Level 2: Don't send postbacks                                                        | - Events attributed to the suspicious touchpoints will be tagged as fraud in the Airbridge reports and raw data export files.<br />- Events attributed to the suspicious touchpoints won't be sent as postbacks.                                                                                           |
| Level 3: Don't attribute                                                             | - Events attributed to the suspicious touchpoints will be tagged as fraud in the Airbridge reports and raw data export files.<br />- Events attributed to the suspicious touchpoints won't be sent as postbacks.<br />- Events attributed to the suspicious touchpoints won't be attributed or aggregated. |

<Accordion title="Postbacks for suspicious events">
  When the Prevention Level is set to 2 or higher, [suspected fraud events](/en/guides/fraud-validation-rules) are excluded from postbacks. However, you can send them with limitations by completing the [Postback settings](#postback-settings) below.

  ###### Data included in postbacks

  * Sends [Target events](/en/guides/airbridge-attribution-model#target-events) only: Installs (App), Deeplink Opens (App), and Deeplink Pageviews (App).
  * Sends events as unattributed.
  * Sends the identified fraud type.

  ###### Eligible channels

  * Postbacks are sent to channels that would have received attribution if not suspected as fraud. These are channels that met all other [Airbridge attribution model](/en/guides/airbridge-attribution-model) rules, including touchpoint priority and last-touch attribution (LTA).
  * Postbacks are sent only to channels with the [Postback settings](#postback-settings) below configured.

  ###### Postback settings

  * In the postback delivery rule, set **\[Attribution]** to **All Events**
  * Edit the postback URL as follows. If using the POST method, contact your CSM or reach out through the [Airbridge Help Center](https://app.airbridge.io/supports).
    * Add a postback parameter. Enter the parameter name specified by the channel and select `{unattributedTouchpointFraudReason}` as the parameter value.
    * Some channels require `{unattributedTouchpointClickID}` as the Click ID parameter value. Confirm with the channel.
</Accordion>

## Reporting

The events attributed to suspicious touchpoints detected by the set rules can be viewed in your Airbridge reports and raw data export files.

In the Actuals Report, select "Touchpoint Fraud Tag" as a GroupBy to visualize the suspicious events tagged as fraud.

In the **\[App Raw Data Export]**, select "Touchpoint Fraud Tag" and "Fraud Tags" in the **\[Select Property]** step to export suspicious events as a CSV file.

<Accordion title="Touchpoint Fraud Tags for events attributed to suspicious touchpoints detected by lag time rules">
  * Fraud\_Touchpoint\_ClickShortLagTime: Suspicious events with the Click-To-Install-Time shorter than the set time interval
  * Fraud\_Touchpoint\_ClickLongLagTime: Suspicious events with the Click-To-Install-Time longer than the set time interval
  * Fraud\_Touchpoint\_ImpressionShortLagTime: Suspicious events with the Impression-To-Install-Time shorter than the set time interval
  * Fraud\_Touchpoint\_ImpressionLongLagTime: Suspicious events with the Impression-To-Install-Time longer than the set time interval
</Accordion>

<link rel="alternate" hrefLang="en" href="https://help.airbridge.io/en/guides/lag-time" />

<link rel="alternate" hrefLang="ko" href="https://help.airbridge.io/ko/guides/lag-time" />