Home / Knowledge hub / Affiliate fraud
Knowledge hub
Affiliate fraud
Faking sales or clicks to earn commission you did not earn.
What it means
Affiliate fraud is when a partner paid per click, lead or sale makes those events look real without earning them. Methods include fake sign-ups, purchases made through their own link, stuffing a tracking cookie into a visitor's browser, and bots that generate clicks.
The programme trusts a tracking record to say who sent the customer. Anyone who can forge, replay or inflate that record gets paid. The weakness is therefore less about passwords and more about how your programme decides that a sale belongs to a partner.
Why it matters
Commission is paid for work that was never done, and the money is hard to recover once it leaves. Fraud also corrupts your measurement, so honest partners are compared against inflated ones, and budget moves towards the wrong channels. Partners who play fair may leave.
Some schemes, such as a purchase made and then refunded, cost you twice, as in refund abuse. Fake accounts used to trigger payouts overlap with referral fraud and fake account creation, and they are cheap for an abuser to repeat at scale.
How it shows up
You meet it in tracking links, cookies, postback URLs and payout reports. Repeated weaknesses are payouts triggered by a sign-up instead of a settled sale, tracking parameters the partner can edit, postbacks that accept any caller, and no review of unusual conversion rates.
Pay on confirmed, non-refunded sales after a holding period. Sign or authenticate postbacks, compare traffic quality between partners, look for conversions that arrive too fast or from the same device, and keep the right to claw back commission. Test by forging a conversion yourself.
Questions people ask
Affiliate fraud, answered
What is cookie stuffing?
It is placing an affiliate's tracking cookie in a visitor's browser without the visitor choosing to click, so the affiliate is credited if they later buy. Programmes defend against it by checking how the click arrived.
How is affiliate fraud different from referral fraud?
Referral programmes reward existing customers for inviting friends. Affiliate programmes pay outside partners for traffic or sales. The methods overlap, but the people involved and the payout rules differ, and so does how you recover the money.
Can partners forge conversions?
They can if the conversion record is a simple request that anyone can send. Authenticate the callback, tie it to a real order in your system, and ignore conversions you cannot match to a settled sale.
What controls help most?
Paying after the refund window, matching every conversion to an order, authenticating postbacks, monitoring partners by conversion pattern, and keeping a clawback clause in the partner agreement so paid commission can be reclaimed.
How do we test our programme?
Click your own tracking link, forge a conversion callback, buy then refund, and edit the tracking parameters. Check whether any of them produce a payable commission. Each result you can pay out is a finding.
Sources
Where this comes from
Related
Terms that sit next to this one
Referral fraud
Gaming a refer-a-friend reward with fake or self-made accounts.
Refund abuse
Claiming refunds or credits more often, or for more, than your policy permits.
Fake account creation
Mass sign-ups by bots to abuse offers, spam users or farm rewards.
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Webhook signature
A check that an incoming webhook really came from the service it claims.
Can a conversion be forged?
Tracking callbacks and payout logic are business flows that can be tested. We check whether a conversion can be faked and report what actually got through, with the requests. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.