Skip to content
Back to Monetization & Revenue

Affiliate Fraud

How to detect and prevent affiliate fraud: self-referrals, cookie stuffing, trademark bidding, and fake conversions.

Why

Affiliate fraud is the silent killer of program economics: a single fraudster can drain 20-30% of your payout budget before you notice, and the fraud patterns are subtle enough that manual review misses them. The four main fraud types are: self-referrals (the affiliate buys through their own link to get a commission discount), cookie stuffing (the affiliate drops a cookie on every visitor to a site they control, so they get credited for organic conversions), trademark bidding (the affiliate buys ads on your brand keyword, so they get credited for users who were already searching for you), and fake conversions (the affiliate creates fake signups with stolen credit cards to earn commissions, then charges back). Each has a detection signature: self-referrals have the same email/IP for affiliate and customer, cookie stuffing has a > 50% conversion rate (real affiliates convert at 2-5%), trademark bidding shows the affiliate's traffic source as branded PPC, and fake conversions have a 100% chargeback rate within 30 days. The defense is automated detection (flag the signatures) plus manual review of flagged affiliates before payout.

When

Continuously. Fraud detection must run on every conversion and be reviewed before every payout cycle.

How

1. Block self-referrals at conversion time: if the affiliate's email or IP matches the customer's, reject the conversion and flag the affiliate
2. Detect cookie stuffing: if an affiliate's conversion rate is > 10% (industry average is 2-5%), or if their conversions have no referring URL (direct traffic with a cookie), flag for review
3. Detect trademark bidding: if an affiliate's traffic source is branded PPC (your brand name as the keyword), reject the affiliate — trademark bidding is against most program terms
4. Detect fake conversions: if an affiliate's conversions have a > 30% chargeback rate within 30 days, claw back all their commissions and ban the affiliate
5. Set a 30-day holding period before payout: do not pay commissions until 30 days after the conversion, so chargebacks and refunds are caught first
6. Use the platform's fraud detection: Rewardful and Partnerstack have built-in detection for self-referrals, IP matching, and suspicious patterns — enable it
7. Review flagged affiliates manually before each payout: look at their traffic sources, conversion patterns, and customer quality — if in doubt, do not pay and ask for an explanation
8. Ban fraudsters and claw back commissions: if you confirm fraud, ban the affiliate, claw back all pending and paid commissions, and add them to a blocklist to prevent re-signup

Example

# Fraud detection (run on every conversion)
function detectFraud(conversion: Conversion, affiliate: Affiliate): FraudCheck {
  // 1. Self-referral
  if (conversion.email === affiliate.email) return { fraud: true, type: "self_referral" };
  if (sameIp(conversion.ip, affiliate.ip)) return { fraud: true, type: "self_referral_ip" };

  // 2. Cookie stuffing (suspiciously high conversion rate)
  if (affiliate.conversionRate > 0.10) return { fraud: true, type: "cookie_stuffing" };
  if (conversion.referringUrl === null) return { fraud: true, type: "no_referrer" };

  // 3. Trademark bidding
  if (conversion.trafficSource === "ppc" && conversion.keyword.includes("ez4code")) {
    return { fraud: true, type: "trademark_bidding" };
  }

  // 4. Fake conversions (high chargeback rate)
  if (affiliate.chargebackRate > 0.30) return { fraud: true, type: "fake_conversions" };

  return { fraud: false };
}

# Payout flow with 30-day holding period
// Conversion on Oct 5 → commission held until Nov 4 → paid on Dec 1
// If chargeback on Oct 20 → commission clawed back, not paid

Common Problems

  • ⚠Not blocking self-referrals — affiliates buy through their own link to get a 25% discount, costing you the commission. Block at conversion time by matching email and IP.
  • ⚠Paying immediately on conversion — fake conversions with stolen credit cards earn commission, then charge back 30 days later, and you have already paid. Use a 30-day holding period.
  • ⚠Allowing trademark bidding — affiliates buy ads on your brand keyword, capturing users who were already converting and adding no value. Ban trademark bidding in the program terms.

Best Practices

  • ✓Run automated fraud detection on every conversion (self-referrals, high conversion rates, no referrer, branded PPC) and flag suspicious patterns for manual review before payout.
  • ✓Use a 30-day holding period before payout — this catches chargebacks and refunds, so you never pay commission on reversed revenue. Most fraud surfaces within 30 days.
  • ✓Ban confirmed fraudsters and claw back all commissions — this sends a signal to the affiliate community that fraud is not tolerated and protects your program economics.