Basically all "spyware" traffic is encrypted, you can however see which IP's users of your network connects to (and some meta-data such as domain name, protocol and hand-shakes) using for example Wireshark or tcpdump. My guess is that the fraud is detected by monitoring the traffic on the ad server, see that a "impression" is registered from their test phone's IP, and by looking at the phone they affirm that no ad was displayed.

It is functionally trivial to rotate IPs from the "test phones". There are shady brokers who will sell you Residential IP-based proxy servers (hacked home machines which will proxy your calls and make them appear to come from homes all around the world).

I mean in an audit, the test person can install the app on a device he/she has physical access to. And conclude that his/her phone was registered on the ad agency logs, yet no ad where shown. The fraudsters could however make it so the phone only sends fake impressions after a certain amount of engagement, so that audit/test person would have to play "my little pony" eg the child game - for one week ...

Quite alot of it is done be measuring the rate of clicks vs views and simple statistics. If people actually click on the ad, its a red flag and likely fraud.