Home / Knowledge hub / Referral fraud
Knowledge hub
Referral fraud
Gaming a refer-a-friend reward with fake or self-made accounts.
What it means
Referral fraud is when someone claims a refer-a-friend reward without bringing a genuine new customer. They invite themselves from a second account, create a batch of fake sign-ups, or share one link with a script that completes the qualifying step over and over.
The programme rewards an event, such as a sign-up or a first order, and the event is cheap to fake. The more generous the reward, the more it pays to build the fake accounts needed to collect it. The flaw sits in the rules of the programme as much as in the code.
Why it matters
The money leaves directly: credits, cash-out, discounts or free months handed to people who brought no one. It also distorts the numbers you use to judge the channel, so a programme that looks like your best acquisition source may be paying mostly to itself.
Rewards can be stacked with other offers, as in coupon abuse, and credits that can be converted to cash attract organised abusers. Once a reward is paid, taking it back is awkward, so the checks matter before payout rather than after.
How it shows up
You meet it wherever a code, link or invite earns a reward. The repeated weaknesses are rewards released on sign-up instead of on a real purchase, no check that referrer and new user are different people, no limit on rewards per referrer, and referral codes that can be guessed or changed in the request.
Sound programmes qualify the event (a paid first order, a verified account), hold rewards for a period, compare device, network and payment details between referrer and invitee, and cap the total. Test by referring yourself from a second account, and by changing the referrer value in the request.
Questions people ask
Referral fraud, answered
Is referral fraud the same as affiliate fraud?
They are close. Referral programmes reward existing customers for inviting friends, while affiliate programmes pay outside partners for traffic or sales. The tricks overlap, such as fake sign-ups and self-referral, but the people and the payout rules differ.
How do we stop self-referral?
Compare the referrer and the new account on device, network, payment method and delivery details, and flag matches for review. Qualify the reward on a real paid event rather than a sign-up. No single signal is conclusive, so use several together.
Should rewards be paid at sign-up or after purchase?
After a real purchase, ideally after any refund window has passed. A sign-up is free to fake. A paid first order costs the abuser money, which changes the economics of the fraud.
Can referral codes be guessed?
They can be if they are short, sequential or built from a name. A code should be long enough and random enough that guessing is impractical, and the server should check that the referrer is a real, eligible account.
How do we test our referral programme?
Create two accounts and refer one from the other. Repeat with a script-like burst. Change the referrer identifier in the request, replay the reward event, and try to claim twice. Check each outcome against what the programme rules say should happen.
Sources
Where this comes from
Related
Terms that sit next to this one
Fake account creation
Mass sign-ups by bots to abuse offers, spam users or farm rewards.
Affiliate fraud
Faking sales or clicks to earn commission you did not earn.
Coupon abuse
Using a discount code more times, or in more ways, than you intended.
Trial abuse
Signing up again and again to keep free access without ever paying.
Loyalty points abuse
Earning, moving or redeeming points in ways your programme was never meant to allow.
Can an account refer itself?
Reward rules are business logic that no pattern-matching tool understands. We test whether a reward can be claimed twice or by the wrong account, and report only what we proved. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.