Affiliate Fraud Detection for CPA and Lead Gen Programs

What affiliate fraud means when you pay per lead

Affiliate fraud is any way a partner gets paid for results that are not what they appear to be. In a pay-per-sale program that usually means fake orders or stolen credit for a sale. In a CPA or lead gen program, where you pay for a form submission or another qualifying action, it mostly means leads that were never a real, interested person.

Two kinds of fraud get mixed up here. Click-level fraud, such as fake clicks, cookie stuffing and click injection, tries to take credit for a conversion that would have happened anyway. Conversion-level fraud creates the conversion itself: scripted submissions, recycled data, invented people. A program paid per lead is much more exposed to the second kind, and most of the evidence for it sits in the conversion export, not in the click logs.

Why detection after the conversion works

You usually cannot see who is behind a click. You can see every lead that arrives. Each conversion record carries an email address, a timestamp, often an IP address and a phone number, plus the affiliate and the offer it came from.

Fake leads leave marks in those fields, because the fields were not filled in by a person with a real reason to be there. And because an export holds many leads from many partners, you can compare one against another, which is where most of the useful signal comes from.

One caution applies throughout. A signal is a reason to look closer, never proof. Almost every pattern below has an innocent explanation, and the section on dull explanations covers the common ones.

Check three levels, not one

A single check catches a single kind of fraud. Looking at three levels catches much more.

The first level is the individual lead. The second is the behavior of one affiliate over time. The third is how affiliates relate to each other. Fraud that looks clean at one level often shows up at another, so a lead can pass every single-lead check and still belong to a ring that only appears when you look across partners.

Level one: the single lead

These checks need only an email, a timestamp and a few other fields.

• Duplicates and near-duplicates. The same email or phone number converting twice is the obvious case. The less obvious one is variation: jane.doe@gmail.com, janedoe@gmail.com and jane.doe+7@gmail.com all reach the same inbox at Gmail, so a program can look like it has three leads when it has one.
• Disposable and machine-made addresses. Some addresses sit on known disposable-mail domains. Others have a local part that is mostly digits, has no vowels, or is one character repeated, which is what a script produces and a person rarely types.
• Time from click to conversion. A long form completed a few seconds after the click suggests nobody was reading it. This check needs both timestamps, so it cannot run when either is missing.
• Missing fields. If an affiliate normally sends a phone number and IP address with every lead, a batch that arrives without them stands out against that affiliate's own history.

Each has a harmless cause. People submit twice after an error, share a family address, or abandon a form and come back later. Treat these as hints about a lead, then look at whether they cluster.

Level two: one affiliate

Patterns that only exist across a partner's leads are invisible when you read one lead at a time.

• Bursts. Conversions in one hour far above that affiliate's own normal pace. Real traffic arrives in a messy flow, while a script or a bought batch can arrive all at once.
• Even spacing. People convert at irregular intervals. A script often fires on a timer, so conversions that land almost exactly the same gap apart are worth a look.
• Rates against peers. The most useful comparison is with other affiliates running the same offer over the same weeks, not with a fixed global cutoff. A form that takes fifteen fields has a very different normal rate from a one-question quiz.
• Payout that stands out. A payout well above what is typical for the offer deserves a second look, especially when it comes with the signals above.

The chart shows why peer comparison matters. Five affiliates sit in a narrow band, and one is several times higher. Judged against a fixed number, that affiliate might have passed. Judged against the group running the same offer, it cannot be missed.

Level three: across affiliates

Some of the strongest evidence only appears when you stop looking at one partner.

• Shared IP addresses. A household router produces a few different people on one IP address. A datacenter address behind dozens of different emails looks like a ring, not a family. Offices, universities and mobile carriers also share addresses, so the number of distinct people and the type of network both matter.
• The same lead through several partners. In some verticals real shoppers submit through several sites in an afternoon. In others it suggests one operator running several accounts. The offer's rules decide which reading fits.
• Repeat offenders. An email, phone number or IP address that was flagged in an earlier export is a stronger signal when it returns. Fraud rarely stops after one file, and this check needs your upload history, not just the current file.

Stack the signals

One signal is a note. Several signals on the same affiliate are a pattern.

In the example, Affiliate X trips one check, which is worth noting but not acting on. Affiliate Y trips three, enough to sample some leads. Affiliate Z trips five, which is a reason to pause payment while you review. The count matters more than any single entry, because honest explanations rarely stack up together.

Rule out the dull explanations first

Many flags have ordinary causes, and it is worth checking them before you write to a partner.

• A tracking problem. A postback that fires twice can create duplicate conversions that no affiliate caused.
• A promotion or email send. A real campaign produces a real burst.
• A new traffic source. A partner who changes sources can see conversion rates and form-fill times change overnight.
• A form problem. A broken form or confusing error message makes honest people submit twice.
• A shared network. One office or campus can send many real leads from the same IP address.

If the explanation is dull, it will usually be dull for the whole affiliate, not for a slice of their leads. If a flagged group does not fit any of these, the question gets more serious.

What to do when a partner stands out

Hold payment on the flagged leads, not on the whole affiliate. Contact a small sample of the people and ask whether they requested the offer. Ask the partner what traffic source they used, and write down what they say. Check your program terms before you take any action on payouts.

None of this needs an accusation. A flag is a reason to look closer, and the decision stays with you.

Running this on a real export

Doing all three levels by hand on a large export is slow, which is why many programs only check after a problem has already cost them money. If you would like to see what your own traffic looks like, send us a recent lead export and we will run every lead through our checks, covering duplicates, shared IP addresses, form completion speed and email patterns, and email you a report showing which ones look suspicious and why, at no cost. The scoring uses fixed rules, and every flag lists the reasons behind it.

Frequently asked questions

What is affiliate fraud? It is any way an affiliate gets paid for results that are not genuine. In CPA and lead gen programs that usually means leads that were fabricated, scripted or recycled, rather than people who actually wanted the offer.

How do you detect affiliate fraud in a lead gen program? Check three levels in the conversion export: individual leads for duplicates, disposable emails and impossibly fast form fills, each affiliate for bursts and unusual rates against peers, and the whole program for shared IP addresses and repeat offenders.

Is a sudden spike in conversions always fraud? No. Promotions, email sends and new traffic sources all create real spikes. The question is whether quality signals hold up as volume grows, and whether the affiliate is pulling away from others on the same offer.

What data do I need? A CSV export of conversions from your tracker, with at least an email address and a conversion time. IP address, click time, phone number, affiliate and offer IDs allow more checks to run.

Can software prove an affiliate committed fraud? No. It can show which leads and affiliates deserve a closer look and why. The conclusion comes from your own review and your agreement with the partner.

Affiliate fraud rarely announces itself, but it usually leaves a pattern in the data you already have.