Most affiliates are honest. A few are not, and because commissions are paid on results, the dishonest ones go where the rules are weakest. The good news: almost every pattern leaves a trace in data you already have. The time to catch it is before the payout, not after.
Self-referrals
What it is: a partner signs up for your product through their own link, or refers their own company, to earn a commission or a discount on their own subscription.
How it shows: the referred customer’s email or billing customer matches the partner’s own, or shares their company’s email domain.
What to do: reject these automatically, or flag them for review. State in your terms that self-referrals never earn.
Brand-term bidding
What it is: a partner buys ads on searches for your own brand name, then sends that traffic through their link. You pay a commission on customers who were already looking for you.
How it shows: clicks arrive with paid-search click identifiers — gclid, gbraid or wbraid from Google Ads, msclkid from Microsoft Ads — and conversion rates are unusually high for a new partner.
What to do: prohibit brand bidding in your terms, and refuse to credit clicks that carry paid-ad identifiers unless you have allowed that partner to advertise. Search your own brand regularly and look at who is advertising.
Paid social and ad hijacking
What it is: the same idea on social networks — ads that send your prospects through an affiliate link without permission.
How it shows: click identifiers such as fbclid, ttclid, li_fat_id, rdt_cid or twclid on referral clicks.
What to do: the same rule — block clicks carrying ad identifiers for partners not approved for paid promotion.
Cookie stuffing
What it is: setting a referral cookie on a visitor’s browser without them clicking anything, for example with a hidden image or frame loading a referral link, so the partner is credited if the visitor ever buys.
How it shows: large numbers of clicks with no engagement, clicks from pages unrelated to your product, and a partner credited for customers who never saw their content.
What to do: look at the referring pages for a partner’s clicks. Remove partners who do this. First-party tracking that needs a real visit to your site, rather than a cookie set from a third-party page, also makes it harder.
Fake signups and duplicate accounts
What it is: a partner creates accounts — or pays people to — to collect signup bonuses, or to reach a tier threshold.
How it shows: many signups for one partner from the same IP address, disposable email domains, signups that never use the product, and a spike just before a tier boundary.
What to do: do not pay for signups without a payment unless you can verify them; flag many signups from one address; review a partner’s signups before paying a signup bonus or tier upgrade.
Refund abuse
What it is: customers referred by a partner pay, the commission is approved, and then the payments are refunded or charged back — sometimes in collusion with the partner.
How it shows: a refund rate for one partner’s customers far above your average, and refunds clustered just after your hold period ends.
What to do: hold commissions for longer than your refund window; net later refunds against the next payout; watch the refund rate per partner.
Misleading promotion
What it is: a partner promises discounts you do not offer, features you do not have, or hides that they are paid.
How it shows: customers mention promises you never made; support tickets spike after a partner’s post.
What to do: prohibit it in your terms, require disclosure of the affiliate relationship, and act on the first report. In the US the FTC expects advertisers to monitor what their affiliates say.
Build a review habit
Automated rules catch the clear cases. Everything else needs a short, regular review:
- a queue of flagged commissions with the signals that flagged them;
- a weekly look at new partners’ first referrals;
- a refund-rate and conversion-rate check per partner before each payout run.
Reject what is clearly fraud, ask questions about what is unclear, and approve the rest. Most programs spend minutes a week on this, and it protects both your budget and the honest partners who would otherwise lose credit to the dishonest ones.
Doing this in Affiligato
Self-referrals — the same email or billing customer as the partner — are flagged, or rejected automatically if you switch that on. If your program blocks paid ads, clicks carrying gclid, gbraid, wbraid, msclkid, fbclid, ttclid, li_fat_id, rdt_cid or twclid are refused. Link names with banned or reserved words are refused when a partner creates them, and many signups for one partner from one address flag their commissions for review.
Flagged commissions wait in a review queue with the signals that flagged them, so you approve or reject each with the evidence in front of you. Commission holds, per-rule hold days and automatic reversal on refunds handle refund abuse, and refund rates per partner stand out in the queue.
