- An affiliate program pays for an event. Anything that can produce that event more cheaply than a genuine customer can will eventually be tried, so the event chosen as the payout trigger defines the attack surface before any detection exists.
- The useful comparison is distance: how far the payout event sits from value the program can confirm. CPC is furthest, CPL next, CPA closer, revenue share on settled revenue closest.
- Shortening the distance does not remove fraud; it relocates it. Moving from paying on leads to paying on sales shifts attention to cancelled orders and last-step interception of genuine sales.
- Most of the protection comes from parameters inside a model: how the qualified event is defined, how long payment waits for verification, how much volume a new partner can generate, and how duplicates are resolved.
- Whatever the model, write the parameters into the program terms. A rule that exists only in the relationship cannot be enforced when it matters.
Why the payout event sets the exposure
A commission is a price attached to an event. If the price of producing that event artificially is lower than the commission, the difference is a margin, and a margin attracts effort regardless of how the program feels about it. This is why two programs in the same category, recruiting from the same partner pool, can see very different fraud profiles: one pays for something that is cheap to fabricate, the other for something that is expensive to fabricate.
The same logic explains why detection alone tends to plateau. Detection raises the cost of producing a fake event, but it raises it by a bounded amount. When the commission is large relative to the effort needed to produce a qualifying event, a determined partner simply spends more on making the event look real. Changing what the event is changes the arithmetic at the root rather than at the margin.
The four common models, by distance from value
Each model below is described by what it pays for, what patterns that event attracts, and what the program can check before paying. None is wrong in itself; each moves the risk to a different place.
Cost per click (CPC)
The payout event is a visit. It is the cheapest event to produce artificially, and the program learns almost nothing about intent from it. Automated traffic, incentivised clicks and click injection and click flooding all find the model attractive, because every one of them generates the paid event directly. Verification before payment is limited to visit-level quality: whether the traffic behaves like people, originates where it claims to, and arrives at a plausible rate.
Cost per lead (CPL)
The payout event is a submitted form or registration. That adds friction compared with a click, but a form can be completed by a script, by a paid crowd, or with details copied from elsewhere, and the commission is released before anyone knows whether the lead was contactable. Programs on CPL typically see fabricated or recycled identities, duplicate submissions across partners, and leads that are technically valid but were never interested.
Cost per acquisition (CPA)
The payout event is a sale, first order or funded account. Fabricating it is expensive, because it requires money to move, so the patterns that remain are different in kind: orders placed and then cancelled after the commission clears, sales that would have happened anyway being credited at the last step, and promotional abuse where the partner's incentive outweighs the customer's value. Verification is much stronger here, but only if the program waits for the refund or cancellation window to pass before paying.
Revenue share
The payout is a percentage of revenue the program has actually collected, often over a period. Manufacturing the event costs as much as the revenue itself, which removes most of the margin. What remains is almost entirely an attribution question: whose click gets the credit for a customer who would have bought anyway. That makes reading the redirect chain more important than click-level filtering, and it makes the tie-break rules in the program terms the main control.
| Model | Paid event | Patterns it attracts | What can be verified before paying |
|---|---|---|---|
| CPC | A visit | Automated traffic, incentivised clicks, click flooding | Visit-level quality only |
| CPL | A form or registration | Fabricated or recycled identities, duplicates, uninterested leads | Format, duplication, and contactability if payment waits |
| CPA | A sale or funded account | Post-payout cancellation, last-step interception, promotion abuse | Whether it held after the refund window; the click path |
| Revenue share | A share of collected revenue | Mostly attribution interception | Collected revenue and the full click path |
Treating a move to a closer model as the end of the problem. Shortening the distance removes the cheapest patterns and leaves the more expensive ones, which are also harder to see. A program that moves from CPL to CPA and then stops measuring will usually find its losses have become smaller in count and larger in size per case.
Levers inside a model
Changing the commission model is disruptive: partners built their economics around the old one, and some will leave. In practice most of the protection comes from parameters that can be tuned without a model change. These are the ones that carry the most weight.
- Define the qualified event precisely. A lead that counts only when it is unique across all partners, reachable, and inside the target region is a different product from any submitted form. The tighter definition closes most of the cheap patterns under CPL without changing the price.
- Tie payment to verification, not to recording. A validation delay that matches the period in which value is still uncertain — the refund window, the first billing cycle — converts a recorded event into a verified one before money leaves.
- Cap volume for partners without history. A new partner on a generous rate with no volume limit can extract a great deal before any pattern is visible. A cap that rises with observed quality limits the damage while screening partners at admission does its work.
- Resolve duplicates by a written rule. When two partners, or a partner and a paid channel, claim the same conversion, the terms should say which wins and why. Without that rule, the last-step claimant wins by default, which is exactly the behaviour interception relies on.
- Tier the rate by downstream quality. Paying a higher rate for conversions that retain, or a bonus on the second order, shifts partner effort toward the customers the program actually wants and makes low-quality volume less rewarding without banning it.
Each of these is a variant of the same idea: moving the effective payout event closer to verifiable value without renaming the model. They complement the controls that belong before the payout, which assume a model is already in place and focus on enforcing it.
What to expect after changing the model
When a program does change its model, three things tend to follow. First, some volume disappears, and a meaningful part of it was never incremental; the drop in recorded conversions overstates the drop in real sales. Second, a smaller number of legitimate partners leave because their economics no longer work, and it is worth identifying them in advance and discussing terms rather than learning about it from the volume report. Third, the fraud that remains changes shape and moves to the new payout event.
The third point is why a model change should be followed by a fresh measurement rather than assumed to have worked. Re-running the same classification on a settled window a few months later, as described in sizing what the leak costs, shows whether the loss shrank or only changed composition. The signals that expose these patterns also shift: under CPA the useful signals are cancellation timing and click path, not visit-level anomalies.
Visit-level quality still matters under every model, even when it no longer triggers payment. Automated traffic that never converts inflates click counts, distorts the conversion rates used to evaluate partners, and can mask a partner whose real audience is small. Separating general and sophisticated invalid traffic keeps those denominators honest.
Frequently asked questions
Which affiliate commission model is least exposed to click fraud?
Revenue share on settled, non-refunded revenue has the shortest distance between the payout event and value the program can verify, so it gives the fewest patterns a reason to exist. It is not immune: last-step interception still shifts credit between partners, and it is the least attractive model for partners with small audiences, which limits recruitment. Least exposed does not mean best for every program; it means the remaining risk is concentrated in attribution rather than in manufactured events.
Is CPC ever a sensible model for an affiliate program?
It can be, in narrow cases: short-term tests with a small number of known publishers, placements where the click itself is the product being bought, or programs that already run strong visit-level filtering. As a default for open recruitment it concentrates the most exposure in the place with the least verification, because a click is cheap to produce and says nothing about intent. Programs that use it usually pair it with hard caps per partner and a rate that is only paid on clicks passing a stated quality standard.
Does switching from CPL to CPA remove lead fraud?
It removes the incentive to manufacture leads, but the behaviour usually relocates rather than disappearing. Expect more attention on the step that now pays, such as trial sign-ups or first orders that are cancelled after the payout clears, and more last-step interception of genuine sales. That is why a model change should be accompanied by a fresh classification of the first few months under the new terms, compared by composition rather than by total.
How long should a validation delay be under CPA or revenue share?
Long enough to cover the period in which the underlying value is still uncertain: the refund window for physical goods, the first billing cycle for subscriptions, the first deposit or first repeat order where that is the real signal of value. A delay shorter than that window pays out before the program knows whether the conversion held. A much longer delay protects the program but raises the cost of participating for honest partners, so the number should be derived from observed cancellation timing rather than picked by convention.
Should new partners start on a different commission model?
Many programs do this in effect by putting new partners on the same model with tighter parameters: a lower volume cap, a longer validation delay and a qualified event definition that is stricter than the one used for established partners. It keeps the terms consistent, which matters when disputes arise, while limiting how much a partner with no history can extract before its traffic has been observed. The parameters then relax on a published schedule tied to observed quality rather than to tenure alone.
ROAS365 keeps a visit-level record of traffic and routing, so the quality of the visits behind each partner's conversions can be read alongside payout data under whichever commission model a program uses. To see how that fits your program, contact sales.