This is an area where deception is possible. For example, if the metric is background API calls, you can fake that too. What matters is how you define 'active users.' In fact, this is a common technique used in well known scam apps in Korea, often called 'vanity metrics.' Generating abusive users and background traffic that create no real business value, then packaging it as user growth. There are even people who specialize in this.