Postback Tracking and Real-Time Lead Scoring Explained

Two moments when you can catch a bad lead

There are only two points at which an advertiser can act on a fraudulent lead: before paying for it, or after. Most CPA and pay-per-lead programs end up on "after" without ever choosing it. A conversion export gets pulled at the end of the week or month, someone glances at it or runs a scoring pass, and by then the payout cycle has often moved on.

Postback scoring moves that moment earlier, to the instant the lead converts. That sounds strictly better, and for some checks it is. But it takes more setup than a CSV review, it changes which checks you can run well, and it has failure modes worth understanding before you build anything.

What a postback actually is

A postback, also called a server-to-server or S2S postback, is a notification your tracker sends automatically the moment a conversion is recorded. Instead of a person exporting a file later, the tracker itself calls a URL you have configured and passes along details of the conversion: which offer, which affiliate, when it happened, and whatever other fields you include.

Almost every tracker supports this, including Everflow, CAKE, HasOffers and Affise, and most advertisers already use postbacks for something. They send conversions to an ad platform so it can optimize, or to analytics, or to a CRM. Adding a second postback that points at a scoring endpoint uses the same mechanism and does not interfere with the ones already in place.

What real-time scoring needs

Three things have to be true.

A tracker that can fire more than one postback per conversion. Most can. Check that adding a destination will not disturb the ones you already rely on.

The right fields in the postback. A score can only be as good as the data it is given. To judge how fast a form was completed, the scoring side needs both the click time and the conversion time. To check for shared IP addresses, it needs the IP. To compare a lead against your history, it needs something to match on, such as an email or phone number. Work out which fields each check needs before you configure anything, and use your tracker's own tokens or macros to pass them. A useful test: take one recent lead and ask whether a stranger, looking only at what the postback passes, could tell if it looked fake. If they could not, the postback is missing something.

An endpoint that can answer quickly using your history. Scoring one lead in milliseconds is a different problem from scoring a file of five thousand. Checks like duplicate detection and repeat-offender matching need your account history available instantly, not rebuilt from scratch on every call.

What you do with a score

A score is only useful if it triggers a decision, so decide the decisions first.

The policy above is an example. A common shape is three bands: pay low-risk leads on the normal cycle, send medium-risk leads to a person for review, and hold high-risk leads while you gather evidence. The thresholds and the actions are yours to set, and they should reflect how much a wrongly rejected genuine lead costs you compared with how much a paid fake one does. In a high-CPL vertical that balance looks very different from a low-CPL one.

One habit is worth adopting early: run in observe-only mode first. For the first couple of weeks, record the scores without acting on them, then compare them with your own judgment on a sample of leads. It tells you whether the bands make sense for your traffic before a score is allowed to touch a payout, and it protects the affiliates who are doing everything right.

Communication matters too. If a score will sometimes delay an affiliate's payout, tell your affiliates that leads are reviewed for quality before payment, and describe the kinds of things you look for without publishing exact thresholds. Affiliates who know what is being measured often clean up their own traffic sources before anything is flagged, and how an affiliate reacts to a reasonable review policy tells you something as well.

Why most advertisers still start with a CSV

Real-time scoring answers the question "is this lead suspicious?" A batch export lets you answer a different one: "is this affiliate suspicious?" Some of the strongest signals only show up across many leads. An affiliate whose conversion rate has crept up over three weeks, a source whose submissions arrive at suspiciously even intervals, a payout mix that looks nothing like other affiliates on the same offer: none of these can be judged from one lead in isolation. They need the whole picture.

For that reason the two approaches complement each other rather than compete. The practical sequence for many advertisers is to run a real export through a scoring pass first, learn what fabricated leads look like in their own traffic, and then add a postback pipe once the batch process has proven itself.

What can go wrong

Real-time systems fail in more interesting ways than batch ones.

• The endpoint is slow or unreachable. Decide in advance what happens. Treating a missing score as "approved" defeats the purpose, and treating it as "rejected" blocks genuine leads over a technical hiccup. The safer default is to mark the lead unscored and let batch review catch it.
• The integration fails silently. A mistyped parameter or a blocked request can leave you believing you are protected when nothing is being scored. Send a handful of test conversions through and confirm that responses arrive and reflect the leads.
• Fields go missing. If the tracker passes an empty IP or timestamp, the checks that depend on it quietly stop working. Monitor for blanks.
• Personal data moves to another system. A postback typically carries emails, phone numbers and IP addresses. Review what you are passing, why, and whether your privacy policy and agreements cover it. Your counsel is the right person to confirm that.

Getting started

A sensible order: confirm your tracker supports multiple postbacks, run a batch export through a scoring pass, list the fields each check needs, add the second postback in observe-only mode, test it, compare the scores with your own review, and only then attach actions to score bands.

The simplest first step needs nothing technical at all. Send us a recent lead export and we will run it through and send back what it flags, at no cost. If real-time scoring is where you want to end up, we can talk through what that would involve for your tracker.

Frequently asked questions

Do all trackers support several postback URLs for one conversion? Most modern platforms do, which is what makes adding a scoring postback alongside your existing ad-platform or analytics postbacks straightforward. Check your tracker's documentation for how additional destinations are configured.

Is real-time scoring more accurate than batch scoring? Not by itself. The same rules can run either way. The difference is timing: real-time lets you act before payout. Rules that compare a lead with the rest of your traffic, like benchmarking an affiliate against its peers, are often easier to run well on a batch where the full picture is already available.

Should a high score automatically reject the lead? Most programs are better served by treating a score as a signal that routes the lead to hold or review, especially at first. Automatic rejection makes sense only once you have seen how the scores behave on your own traffic.

What happens if the scoring service is down? Decide in advance. The most common safe approach is to mark the lead as unscored and include it in your next batch review, rather than approving or rejecting it blindly.

Whether you start with a file or a postback, the goal is the same: a decision about each lead that rests on evidence rather than on totals that happen to add up.