Types of Lead Fraud: A Field Guide for Advertisers

What counts as lead fraud

Lead fraud is any way a lead gets counted and paid for without being what it appears to be. Sometimes no real person was involved. Sometimes a real person was, but never wanted the offer, or had already been counted. And sometimes the lead is fine, and someone is claiming credit for it who did nothing to earn it.

It helps to keep two cautions in mind. First, not every bad lead is fraud. Some are honest mistakes and some are simply low-intent, and the checklist for spotting fake leads explains how to tell them apart. Second, a signal in your data is a reason to look closer, not a verdict about a specific person or partner.

With that said, naming the types is useful, because each one leaves different marks and calls for a different response.

Four groups, eight types

A simple way to organize the types is to ask what is wrong with the lead. Either nobody real is behind it, a real person is behind it but did not want it, a real person is behind it but has already been counted, or the lead is real and the credit is not.

No real person

Scripted submissions. Software fills in forms automatically. The marks are timing marks: bursts of leads, conversions that land at regular intervals, and forms completed in seconds. The bot lead article explains why timing is so revealing.

Fabricated identities. A person, or a script, types in made-up details: invented names, throwaway or gibberish emails, numbers that do not work. The disposable email checklist covers the patterns.

A real person with no real intent

Incentivized traffic. Real people complete the form because they are paid or rewarded to. Their details are genuine, and their interest is not. The incentivized traffic guide covers when this is a business choice and when it is a breach.

Co-registration abuse. Offers appear on the way through another signup, sometimes already ticked. People pass through with a click and do not remember the offer. The co-registration article explains what to ask a source for.

A real person counted again

Duplicates and near-duplicates. The same person submits more than once, sometimes by accident and sometimes on purpose, using variations of an email address. The email normalization guide shows how to match them safely.

Recycled data. Old leads, or leads from other sources, are resubmitted as new. They often look perfectly valid on their own and give themselves away only when compared with earlier files.

Real lead, false credit

Credit theft. Tactics such as cookie stuffing or click injection claim a conversion that would have happened anyway. Because the lead is real, this is mostly visible in click data and timing, not in the lead itself. The cookie stuffing article explains why it matters less for a pay-per-lead program than for one paid on sales.

Rings of accounts. One operator runs several affiliate accounts or sub-sources so that the combined volume looks like many independent partners. Many leads behind a shared IP address, or the same data appearing under different partners, are the usual marks.

How each type tends to look in an export

These are tendencies. Honest traffic can also arrive in bursts, use throwaway emails or share an IP address, so a single mark means little. A pattern on one source, repeated across several checks, means more.

Where each type shows up

Different types appear at different levels of analysis, which is why checking only one level misses things.

Some types are visible in a single lead, such as a gibberish email or a form finished in seconds. Others only appear when you look at one affiliate's pattern over time, such as bursts and even spacing. A few, such as recycled data and rings, only appear when you compare across affiliates or across files. The affiliate fraud detection guide walks through the three levels in more detail.

Why the payout model changes the risk

The event you pay for decides which types hurt most. In a program that pays for any valid lead, the types that create a form fill without a real, interested person, such as scripted submissions, fabricated identities, incentivized traffic, co-registration abuse and duplicates, hit directly, because the lead itself is the paid event.

When you pay for a qualified lead, a contact or an appointment, an extra step has to happen first, which filters out many of those. The types that target the paid event itself, such as credit theft and rings of accounts, matter more. The advertiser's guide covers how to choose what to pay for.

When types overlap

Real cases are rarely tidy. A scripted lead may also carry a fabricated identity and arrive as a duplicate. Do not force a single label. Classify by the strongest evidence you have, note the others, and let the combination guide how firmly you act.

Responding to each type

Because the types differ, the responses should too.

• No real person: remove the source, and keep the evidence.
• No real intent: change the offer or form, price the traffic honestly, or ask the partner to declare it.
• Counted again: match on a normalized key, define duplicates in your agreement, and reject repeats with a reason.
• False credit: look at click timing and the source, and reduce or withdraw credit where your terms allow.

Whatever you decide, give each rejection a reason, as the lead scrubbing guide recommends, so the conversation with the partner stays factual.

Seeing which types are in your own leads

If you want to know which of these are present in your own data, a recent export is the quickest place to look. Send us a recent lead export and we will run every lead through our checks and email you a report showing which ones look suspicious and why, at no cost. A flag means a lead deserves a closer look, and the decision stays with you.

Frequently asked questions

What are the main types of lead fraud? Scripted submissions, fabricated identities, incentivized traffic, co-registration abuse, duplicates and near-duplicates, recycled data, credit theft such as cookie stuffing, and rings of accounts that make one operator look like many partners.

Is incentivized traffic a type of lead fraud? Not automatically. It becomes a problem when the agreement forbids it and it is hidden, or when it is sold as intent-driven traffic. Disclosed and priced honestly, it is a business choice.

Which type of lead fraud is the hardest to spot? Recycled data and rings, because each lead can look valid on its own. They show up when you compare across files and across affiliates.

Can one lead belong to more than one type? Yes. A scripted lead can also use a fabricated identity and arrive as a duplicate. That is one reason several signals together are more convincing than any single one.

Does every flagged lead count as fraud? No. A flag means a lead or a source deserves a closer look. Review it, sample the leads and give each rejection a reason before you act.

Knowing the type tells you what to look for and what to do about it.