  Google Play's policy forbids the use of incentivized installs, ratings, and
reviews to manipulate the placement of apps. However, there still exist apps
that incentivize installs for other apps on the platform. To understand how
install-incentivizing apps affect users, we examine their ecosystem through a
socio-technical lens and perform a mixed-methods analysis of their reviews and
permissions. Our dataset contains 319K reviews collected daily over five months
from 60 such apps that cumulatively account for over 160.5M installs. We
perform qualitative analysis of reviews to reveal various types of dark
patterns that developers incorporate in install-incentivizing apps,
highlighting their normative concerns at both user and platform levels.
Permissions requested by these apps validate our discovery of dark patterns,
with over 92% apps accessing sensitive user information. We find evidence of
fraudulent reviews on install-incentivizing apps, following which we model them
as an edge stream in a dynamic bipartite graph of apps and reviewers. Our
proposed reconfiguration of a state-of-the-art microcluster anomaly detection
algorithm yields promising preliminary results in detecting this fraud. We
discover highly significant lockstep behaviors exhibited by reviews that aim to
boost the overall rating of an install-incentivizing app. Upon evaluating the
50 most suspicious clusters of boosting reviews detected by the algorithm, we
find (i) near-identical pairs of reviews across 94% (47 clusters), and (ii)
over 35% (1,687 of 4,717 reviews) present in the same form near-identical pairs
within their cluster. Finally, we conclude with a discussion on how fraud is
intertwined with labor and poses a threat to the trust and transparency of
Google Play.
