- In an affiliate program the money leaves through the commission line, not the media line. Ad platforms filter part of the invalid activity and credit it back; there is no equivalent filter sitting between an affiliate program and its payouts, and a commission looks identical on the ledger whether the sale underneath it was real or manufactured.
- The word loss is covering three different things: commission paid on activity that was never a genuine sale, attribution shifted away from the partner that actually created the demand, and budget decisions made on the resulting numbers. They differ in size and in what can be done about them, and discussing them as one figure guarantees no conclusion.
- Size it on a historical window that has already cleared its validation period, and classify conversions rather than clicks. The first layer is countable from payout records, the second requires reading the click path instead of the last touch, and the third can only honestly be expressed as a range.
- Present gross exposure and recoverable amount as two separate lines. Commission that cleared months ago to a partner who has since gone quiet is rarely recovered in practice, and the case for spending on prevention rests on the portion that repeats every month rather than on a one-off clawback.
- The other side of the ledger is over-blocking. Every rule rejects some genuine activity, and a productive partner whose conversions are reversed without explanation moves its traffic elsewhere. The question is never whether fraud can be driven to zero, but what a wrong rejection and a missed one are each worth.
Why nobody answers the question
An affiliate manager usually knows which partners look wrong. Asked what the problem costs per year, the answer is typically a shrug or a percentage borrowed from an industry article. That is not laziness: the question is structurally harder than it sounds. A paid commission sits in the books as a completed expense. It does not arrive with an anomaly flag the way an invalid click credited back by an ad platform does, and no report field says this one should not have been paid.
Meanwhile, without a number, the discussion about controls runs on mood: tighten when suspicion is high and drive away good partners along with bad, loosen again after a few quiet months. Half the value of sizing the loss is knowing what to spend; the other half is giving the strictness setting something reviewable to stand on.
Three different losses hiding under one word
Before computing anything, separate the layers. They differ in cause, in visibility and in what can be done about them, and a blended figure convinces neither the finance team nor the person who has to act on it.
Layer one: commission actually paid on invalid activity
This is the most direct layer and the only one that can be counted exactly. It covers conversions with no genuine purchase intent underneath: registrations generated by scripts, orders systematically cancelled after the payout cleared, clicks originating from data centres rather than people. The amount equals the commission on those records, with no conversion factor needed. The signals that expose these patterns are reasonably well understood; the work is joining the flagged records to the payout records, not the detection itself.
Layer two: attribution shifted between partners
Here the sale is real and the payout is real, but it went to the wrong party. Demand created by a content partner is intercepted at the last step and credited elsewhere. Financially the program has not overpaid — total commission is unchanged — yet the damage is real in channel terms: the partner that generated incremental demand is under-rewarded, gradually invests less or leaves, while the intercepting party posts steadily better numbers and is given more room. This layer cannot be expressed as an overpayment. It is expressed as the share of commission flowing to non-incremental steps, and reading it requires following the redirect chain rather than the last touch.
Layer three: decisions made on contaminated data
The first two layers change where money goes; this one changes judgement. When a source has its conversion count inflated, it looks efficient in every report, and so receives more budget, better placement and a longer contract, while a real but slower-growing source is cut. This is often larger than the first two layers combined, and no method computes it precisely. It exists as a range and must be labelled as an estimate — an honest range is more useful than a precise-looking figure that is wrong.
Classifying clicks instead of conversions. An affiliate program pays on conversions, so the unit of loss is a conversion and the commission attached to it. An invalid rate measured at click level is a useful leading indicator, but multiplying it by total commission produces a meaningless number: the two are not computed over the same denominator.
Sizing it with data the program already holds
The exercise needs no new system, only a fixed historical window and one disciplined pass of classification. The shape of it:
- Pick the window. Take a historical period that has fully cleared both the validation period and the refund window — typically the month before last, not the trailing thirty days. Data still inside its window has unsettled cancellations, and anything computed on it keeps moving.
- Classify conversions. Tag every settled conversion in that window as clearly invalid, questionable, or normal, using the objective criteria already written into the program terms rather than judgement improvised for the occasion.
- Join the tags to the money. Multiply each class by the commission actually paid to obtain layer one. This step is where the exercise usually stalls, because the risk data and the settlement data live in separate systems with no shared record identifier. If that is the case, fixing the join is worth more than this quarter's estimate.
- Sample the paths. Layer two does not require full coverage. Draw a sample of conversions from the partners taking the largest share of commission, read the full click path to see where demand was actually created, weight the result by commission and extrapolate — labelled explicitly as an estimate.
- Give layer three a range. State the assumption in one sentence — if inflated conversion counts moved somewhere between X and Y of budget toward that source — and give bounds rather than a point estimate.
- Report on two lines. Gross exposure on one, recoverable on the other. Merging them into a single headline number is the most common way these reports lose credibility.
Why recoverable is much smaller than gross
Gross exposure answers how much money should not have left during the period. Recoverable answers how much of it can still be retrieved, and three practical conditions sit in between: whether the commission is still inside the validation period and unsettled; whether the program terms define a reversal right and an evidence standard; and whether the partner is still active with a balance to net against. Miss any one and recovery turns from a process into a negotiation, and the odds of a negotiation do not belong in a forecast.
This is also why building the case for controls on recovery is fragile. Historical clawback is one-off and usually discounted, while the figure that supports sustained investment is the portion that recurs every month and scales with the channel. Presenting the result per month rather than per year makes that obvious without argument.
The other side of the ledger: what over-blocking costs
Any rule set rejects some genuine activity along with the invalid kind. That is not an implementation defect but the nature of the decision. Errors run in both directions, and in an affiliate context the two costs are asymmetric: missing one costs that commission, while wrongly rejecting one can cost a productive partner's entire future volume, because that partner has placements in competing programs and after a few unexplained reversals moving is cheaper than appealing.
The practical response is not a looser threshold but making errors visible, appealable and reversible. A rejection that carries a stated reason and a review path lets the same strictness be held safely, because the mistakes it produces get found and corrected instead of quietly costing partners. It is also why screening at admission is cheaper than rejecting after the fact: refusing before a relationship exists carries almost no relationship cost.
Turning the number into a decision
The exercise ends not in a report but in three answerable questions. First, is the recurring monthly loss materially larger than the cost of owning a set of controls — if not, the correct conclusion is to do nothing, and reaching that conclusion is itself worth the exercise. Second, which layer dominates: concentration in layer one means controls before the payout are the main battleground, while concentration in layer two means attribution rules and program terms need to change and no amount of additional detection will help. Third, is the current strictness setting a deliberate choice that someone can explain, or an inherited default.
One point worth repeating: composition matters more than the total. After a control ships, the total may barely move while the mix underneath it turns over completely. That can mean the control worked and the behaviour relocated, or that the loss simply moved. The total alone cannot distinguish those two, and re-running the same classification and comparing composition is what does.
Frequently asked questions
How does click fraud affect affiliate marketing differently from paid media?
In paid media the advertiser pays a platform for a click, invalid activity shows up as cost without outcome, and the platform filters part of it and credits it back. In an affiliate program the advertiser pays a partner for a recorded conversion, the money moves along the commission line, and no equivalent filter sits in between. The loss is therefore easier to attribute to a specific counterparty and harder to see in aggregate reporting, because a payout looks identical whether or not the sale was incremental. The remedy is also contractual rather than technical: program terms, validation period and reversal process decide how much is recoverable, while detection only decides how much is noticed. The invalid click and credit mechanism on the paid-media side follows different rules, and the two definitions should not be mixed.
Can an industry average invalid rate be used instead?
It is usable for a rough order-of-magnitude check but not for a decision. Published rates come from incompatible definitions: some are computed over clicks and some over impressions, some count only known bots while others include the sophisticated kind that presents as human — see the distinction between GIVT and SIVT. More importantly, a program's actual exposure depends on its commission structure, its category and how it recruits, and those three determine which methods find it attractive — exactly the information an average erases. A rough calculation on your own data beats a borrowed percentage.
What if the risk data and the settlement data cannot be joined?
Fix that first, because it is worth more than this quarter's estimate. Without a shared record identifier, no judgement of the form this traffic is bad can ever be attached to an amount: the loss cannot be computed, reversals cannot be executed, and the discussion stays qualitative. What is required is usually modest — retain an identifier on the conversion record that traces back to the originating visit so the two sides reconcile. Once that exists, the sizing falls out as a by-product rather than being a project.
How often should this be re-run?
Often enough to notice a change in composition, which for most programs means quarterly rather than continuously. The total moves slowly while the mix beneath it moves faster: the pattern that dominated one quarter is frequently displaced once a control ships, and a program watching only the pattern it fixed will conclude the problem is solved while the total stays flat. Re-running the same classification on a fresh window and comparing composition, not just totals, is what separates a loss removed from a loss relocated.
ROAS365 provides visit-level traffic records and routing so that every visit carries a traceable record and risk judgements can be reconciled against settlement data. To see how that fits your program structure, contact sales.