Affiliate fraud detection is the practice of spotting partners who earn commissions for clicks or conversions they didn't legitimately generate, through cookie stuffing, bots, fake leads, brand bidding or hijacked attribution. It works by scoring every click and conversion against signals such as IP type, click velocity, conversion-rate anomalies and time-to-convert, then holding commissions until they are validated.
This guide breaks down nine fraud patterns, the signals that expose each one, and the operational and contractual controls that stop you paying for them. It's written for affiliate managers and operators running programs in-house; if you're evaluating tooling, MassPartner for brands includes the fraud controls described here.
What affiliate fraud costs
There is no widely cited, affiliate-only loss estimate with a transparent methodology, so treat broad figures with care. The closest benchmark is digital ad fraud overall: a Juniper Research study reported by MediaPost estimated losses of $84.2 billion in 2023, 22% of global digital ad spend, rising to a projected $172.3 billion by 2028.
Affiliate programs carry specific costs on top of wasted media:
- Commissions paid for sales you would have had anyway, through brand bidding, cookie stuffing or last-second click injection.
- Chargebacks and refunds on stolen-card orders, plus the commission already paid on them.
- Polluted data. Fraudulent partners look like top performers, so budget, bonuses and better rates flow to them.
- Compliance exposure. The FTC's Endorsement Guides FAQ says advertisers need reasonable programs to train and monitor members of their network.
Measure your own exposure instead of relying on industry averages: track the share of commissions later reversed, the share of clicks flagged as invalid, and chargeback rates by affiliate.
The 9 affiliate fraud patterns
1. Cookie stuffing
Cookie stuffing drops an affiliate cookie without a real click, using hidden iframes, invisible images, pop-unders or browser extensions. When that visitor later buys, the stuffer collects the commission. It's not a theoretical risk: eBay's top affiliate was sentenced to five months in federal prison in 2014 after pleading guilty to wire fraud over a cookie-stuffing scheme.
- Signals: very high click counts with a very low conversion rate but a large share of total sales; clicks with no referrer or from unrelated pages; no on-page interaction; conversions from customers who were already deep in your funnel.
- Countermeasures: log referrers and fingerprint data per click, flag clicks with zero interaction, and ban forced clicks, iframes and adware in your agreement.
2. Click spam and bots
Automated clicks inflate CPC payouts and seed cookies at scale. Simple bots announce themselves; better ones use headless browsers with realistic user agents. This is the core of click fraud in affiliate programs.
- Signals: user agents containing bot or automation tool names; missing
AcceptorAccept-Languageheaders; awebdriverflag in the browser; zero plugins or no WebGL; clicks at machine-regular intervals. - Countermeasures: user-agent and header checks on every click, a client-side fingerprint, per-IP velocity limits, and no CPC payouts on unscored or flagged clicks.
3. Datacenter and proxy traffic
Real shoppers browse from residential and mobile ISPs, not cloud servers. Cloud providers publish their ranges; AWS, for example, publishes its IP address ranges as JSON so traffic from its network can be identified.
- Signals: IPs inside hosting provider ranges; long
X-Forwarded-Forchains; IP location that conflicts with browser language or time zone. - Countermeasures: look up every click against datacenter ranges, score it rather than silently dropping it, and build IP reputation over time to catch residential proxies that range lists miss.
4. Incentivized and misrepresented traffic
Incentivized traffic pays users (cash, points, game currency) to click or sign up. Some programs allow it with disclosure; it becomes fraud when it's hidden from you. Misrepresentation is the related problem: promising bonuses, prices or outcomes the brand doesn't offer.
- Signals: high registration volume with almost no purchases or deposits; sign-ups in tight time bursts; customer complaints quoting promises you never made.
- Countermeasures: pay CPL only on qualified leads, require creative approval, and monitor partner pages. In iGaming and fintech, misleading claims ("guaranteed wins", "risk-free returns") create regulatory risk on top of wasted commissions, and responsible-gambling messaging rules still apply to affiliates.
5. Brand bidding
Affiliates bid on your brand name in search ads, catch people already looking for you, and claim commissions on customers you'd have won for free. Google's trademark policy does not restrict trademarks as keywords, so enforcement depends on your contract, not the ad platform.
- Signals: paid-search referrers on conversions from a content or coupon affiliate; very short click-to-conversion times; affiliate ads appearing on your brand searches in target countries.
- Countermeasures: define brand bidding in the agreement, including misspellings, close variants and trademarks in domains; monitor brand searches by country; reverse commissions on violations.
6. Self-referrals and fake leads
A self-referral is an affiliate buying or signing up through their own link to collect the commission or a new-customer bonus. Fake leads are fabricated form fills sent to CPL offers.
- Signals: the same IP or device fingerprint on the click and on the affiliate's own logins; customer name, address or payment details matching the affiliate's; sequential or disposable email addresses; leads that can't be reached.
- Countermeasures: prohibit self-referrals explicitly, compare affiliate account data with customer data, verify email and phone before a lead qualifies, and pay CPL only after qualification.
7. Stolen-card and chargeback fraud
Fraudsters place orders with stolen cards through an affiliate link. The CPA or CPS commission pays out before the cardholder disputes the charge, and you lose the goods, the chargeback fee and the commission.
- Signals: high-value first orders; billing country different from the click IP country; order clusters from one affiliate or sub-ID; rising refund and chargeback rates per affiliate.
- Countermeasures: set a hold period that covers your payment processor's typical dispute window, reverse commissions on chargebacks and refunds, and share chargeback data with affiliates so legitimate partners can fix their traffic.
8. Attribution hijacking and click injection
Last-click attribution pays whoever fires the final click, so fraudsters fire one just before the conversion. On the web, that's extensions or toolbars that insert affiliate links at checkout. On Android, click injection apps detect an app install starting and fire a click in that moment.
- Signals: a cluster of conversions within seconds of the click; clicks referred from your own checkout or cart pages; mobile installs where the reported click came after the install began. Google Play's Install Referrer library returns both the referrer click timestamp and the install begin timestamp, so you can compare them.
- Countermeasures: review conversions with implausibly short time-to-convert, restrict coupon and extension partners to approved placements, and reject install clicks that arrive after the install began.
9. Geo masking
Affiliates route traffic from low-value countries through VPNs or proxies so it looks like high-payout geos, or simply ignore your country restrictions. For regulated offers such as iGaming, traffic from unlicensed markets is a licensing problem, not just a margin problem.
- Signals: IP country that doesn't match browser language or time zone; datacenter or VPN IPs; billing country different from click country; deposit or purchase behavior unlike genuine users from that market.
- Countermeasures: allowed and blocked countries per campaign, datacenter detection, billing-country checks at conversion, and payouts only on qualifying actions.
Detection signals and thresholds
No single signal proves fraud. Combine them into a fraud score per click and review affiliates whose traffic scores high in aggregate. The triggers below are illustrative starting points; calibrate them against your own baseline.
| Signal | What to measure | Example review trigger |
|---|---|---|
| IP / ASN type | Share of an affiliate's clicks from hosting and datacenter ranges | Datacenter share well above your program average |
| Click velocity | Clicks per IP per minute; clicks per sub-ID per hour | Repeated bursts from one IP or sudden spikes on one sub-ID |
| Conversion-rate anomalies | Affiliate CR vs the program median for the same offer | CR several times the median, or high clicks with near-zero CR |
| Time-to-convert | Distribution of click-to-conversion time per affiliate | Many conversions within seconds of the click |
| Device fingerprint | Repeat fingerprints, automation flags, missing plugins or WebGL, no interaction | The same fingerprint behind several "new" customers |
| Downstream quality | Refunds, chargebacks, deposit or purchase rates vs baseline | Quality far below other affiliates on the same offer |
On MassPartner, every click is scored in real time: datacenter and hosting IP detection, per-IP click-velocity limits, user-agent and HTTP-header checks, an IP blacklist that automatically adds IPs with repeated fraud-flagged clicks, IP reputation based on each address's history, and a client-side fingerprint that looks for automation and missing interaction. Click reports can be filtered by score and by suspicious or fraud flags, conversions on high-scoring clicks are kept out of automatic approval, and each campaign can approve conversions automatically, manually or after a set delay.
Score, don't auto-ban. Corporate VPNs, privacy browsers and shared mobile IPs produce false positives, so use the score to prioritize review and hold payouts, and keep the evidence for the conversation with the affiliate.
Investigating a flagged affiliate
- Pull the affiliate's clicks for the period, sorted by fraud score, and note which reasons dominate: datacenter IPs, velocity, automation flags or missing interaction.
- Break results down by sub-ID. Bad traffic usually concentrates in a few sources, so you can cut those instead of the whole partner.
- Compare conversion rate, time-to-convert and downstream quality with other affiliates on the same offer.
- Check customer-side data on converted orders: billing country, repeat devices, and overlaps with the affiliate's own details.
- Hold open conversions, send the affiliate the evidence, and give them a fixed window to respond before you reverse anything.
Example: an affiliate sends 10,000 clicks in a week, 18% of them from hosting ranges, and 25 of its 40 sales converted within ten seconds of the click. Neither number is conclusive alone. Together they justify holding all 40 commissions and asking for the traffic sources behind the top sub-IDs.
Holds, validation periods and reversals
Detection only saves money if the commission hasn't been paid yet. Every program needs three controls:
- A hold period. Conversions stay pending long enough for refunds, chargebacks and qualification events to surface. Match it to the offer: a subscription trial, a physical goods return window and an iGaming first deposit all need different lengths.
- Validation. Approve conversions manually for new or high-risk affiliates, and automatically after the hold for established partners with clean history. For lead and registration offers, validate the lead itself (reachable email or phone, no duplicates) before it qualifies.
- Reversals. Your terms must let you reverse commissions for fraud, refunds and chargebacks, including after payout for the most serious cases. Without that, a fraud discovered in month two is a write-off.
For RevShare deals, reversals interact with negative carryover rules, so define both in the same section of the agreement.
Country blocking
Country rules do two jobs: they keep traffic within the markets an offer is licensed or priced for, and they cut off geos that consistently produce bad traffic. Use an allow-list for regulated offers (only the countries you're licensed in) and a block-list for everything else.
IP geolocation alone is beaten by VPNs, which is why country rules work best alongside datacenter detection and a billing-country check at conversion. Log blocked clicks instead of discarding them: a rising count of blocked clicks from one affiliate is evidence of geo masking or ignored terms. In MassPartner, each campaign has allowed and blocked country lists, and blocked clicks are recorded with their status in click reports and CSV exports.
Contract clauses that make enforcement possible
Detection tells you what happened; the contract decides what you can do about it. Clauses worth including (our affiliate agreement template covers them in full):
- Prohibited methods: cookie stuffing, forced or hidden clicks, adware and extensions, unsolicited email, incentivized traffic without written approval, and sub-affiliates without approval.
- Search restrictions: brand bidding including misspellings and close variants, trademarks in domains, and any channels you don't allow, named individually (for example Google Ads or Microsoft Ads).
- Tracking data governs: the brand's tracking records are the basis for commission decisions.
- Holds, withholding and clawback: the hold period, the right to withhold commissions under investigation, and the right to reverse or recover commissions on fraud, refunds and chargebacks.
- Transparency: disclosure of traffic sources and sub-ID meaning on request, and creative pre-approval for regulated verticals.
- Compliance: advertising disclosures, local marketing rules and responsible-gambling requirements where relevant.
- Process and termination: written notice, a response window, and termination with forfeiture of unpaid commissions for material breaches.
Have counsel review the final wording for your jurisdictions; this list is a checklist, not legal advice.
Run your program with fraud controls built in
MassPartner scores every click, applies country rules per campaign, holds conversions for approval, and generates affiliate contracts with prohibited-actions clauses and e-signatures. See how it works for brands or compare plans on the pricing page.
FAQ
What's the difference between click fraud and cookie stuffing?
Click fraud generates fake clicks, usually with bots, to inflate click-based payouts or traffic stats. Cookie stuffing plants an affiliate cookie without a genuine click so that a later, real purchase is credited to the fraudster.
How long should a commission hold period be?
Long enough to cover the refund window, your processor's typical chargeback window and any qualification event for the offer. Many programs use a longer hold for new affiliates and shorten it once a partner has a clean history.
Is brand bidding always fraud?
No. Google's trademark policy allows trademarks as keywords, so brand bidding is only a violation when your affiliate agreement prohibits it. That's why the clause needs to define brand terms, misspellings and close variants explicitly.
Can fraud detection block legitimate customers?
Yes, which is why scores should trigger review and holds rather than automatic bans. VPN users, corporate networks and privacy browsers can all look suspicious on a single signal.
Do I need server-to-server tracking to detect affiliate fraud?
It helps a lot. A postback URL ties each conversion to a specific scored click server-side, so time-to-convert, IP and fingerprint checks apply to every sale, including those that browser-based tracking misses.