- In an affiliate program the loss is realized at settlement, not at the click. Prevention therefore belongs at approval time, not in a real-time traffic filter.
- The most expensive patterns — cookie stuffing, brand-term interception, attribution hijacking — sit behind conversions that are genuinely real, so they never look anomalous in aggregate reporting. What they take is the attribution, not the order.
- Five controls: written partner terms, a tracking record independent of the network, a validation window of thirty to sixty days, cross-channel deduplication, and an enforceable clawback clause. Each one weakens if the others are missing.
- What is worth watching daily is not click volume but the distribution of a few ratios: sub-sources with implausible conversion rates, refund rates, time from visit to order, and the number of hops in the inbound path.
- The right first response to a signal is manual review, not termination. More often than not the problem is one sub-source under a partner rather than the partner itself.
Affiliate click fraud is a different problem from the paid-media kind
The name is shared; the economics are not. On paid media an invalid click has already consumed budget by the time anyone identifies it, and whether the money comes back depends on the platform issuing a credit — the advertiser is in the position of seeking redress after the fact. In an affiliate program the click itself usually costs nothing. What the advertiser pays for is the conversion, and between the conversion and the payment run sit an approval step and a settlement cycle. That means the advertiser holds a period of time by default, and most programs simply do not use it. For the general definitions and vocabulary see what click fraud is and the click fraud glossary; this article stays on the partner-channel side.
One more distinction is worth stating up front, because it shapes everything downstream: the most expensive affiliate fraud produces real orders. Cookie stuffing, brand-term interception and attribution hijacking do not fabricate transactions. They take transactions that were going to happen anyway, or that another channel earned, and place them under a partner's name. The result is financially unremarkable: the order is real, the revenue is real, the refund rate is normal — the commission is simply not owed. Anomaly detection tends to miss this entirely, because what is anomalous is not the transaction but the attribution.
The patterns that recur
The following recur in nearly every program that reaches scale. Telling them apart matters because the remedies differ completely, and treating everything as a bot-traffic problem leaves the expensive patterns untouched.
| Pattern | What actually happens | What surfaces it |
|---|---|---|
| Cookie stuffing | A tracking cookie is dropped on a user who never saw the offer, via a 1×1 pixel, an iframe or a hidden asset on an unrelated page. The user later converts organically and the sale lands under that partner. | An implausibly high click-to-conversion rate, near-zero time on the landing page, and click volume concentrated on sites unrelated to the category. |
| Forced and hidden clicks | An invisible element or overlay fires the tracking request when the user clicks something else entirely, so no deliberate click on the offer ever occurred. | Click counts that do not reconcile with landing-page loads, and an extreme bounce profile on the clicks that do land. |
| Brand-term interception | A partner bids on the brand's own terms, or close misspellings, capturing buyers who were already searching for the brand and settling them as affiliate-sourced. | A drop in brand organic volume that tracks one partner's growth, inbound sources concentrated in search, and an order mix indistinguishable from direct. |
| Bot-driven clicks and sign-ups | Automation generates clicks at volume and, in programs paying per sign-up or per lead, shallow conversions to match. | Highly uniform device and network characteristics, an implausibly even hourly distribution, and zero post-signup depth. |
| Attribution hijacking | A redirect chain inserts the partner's tracking parameters into the final hop, rewriting a conversion another channel earned. | An unusual number of hops in the inbound path, a referrer that disagrees with the declared source, and a very short interval between the final click and the order. |
The redirect-chain family deserves separate treatment, because it is the one class that statistics alone will not reveal: the inbound path has to be recorded hop by hop before it becomes visible at all. The method is covered in affiliate redirect chain analysis. For the bot-driven family, the underlying signals are in detecting bot traffic and the distinction between general and sophisticated invalid traffic.
The five controls that belong before the payout
These work in sequence, and each one reduces the load on the next. Few programs run all five, but even the first three narrow the exposure substantially.
1. Put the rules in the partner terms rather than in the relationship
Most disputes trace back to terms that were never specific enough to enforce. At minimum the following need to be written down at an operational level of detail: permitted and prohibited traffic sources, whether brand terms and near-misspellings may be bid on, whether incentivized traffic is allowed, cookie duration and the attribution rule, the length of the validation window, and the conditions under which a clawback applies and how it is executed. This is not a legal-template exercise. Vague terms mean every withheld payment turns into a fresh negotiation.
2. Keep a tracking record independent of the network
The network's numbers are also the basis for the invoice. Reconciling an invoice using only that source is auditing the biller with the biller's own records. The remedy is not to replace the network but to keep a parallel first-party record: entry URL, referrer, region, device, timestamp and the complete redirect path. With that record a disputed conversion can be examined on its facts, and in practice most disagreements with a partner end at the point where the sequence of the visit can simply be shown.
3. Run a validation window
This is the control most programs lack and the one with the most direct effect. An approved conversion does not immediately become payable; it is held for thirty to sixty days so that refunds, chargebacks, duplicate orders and cancelled sign-ups have time to surface. A partner running low-quality volume looks profitable in week one and generally stops looking profitable once a full window has closed over that cohort. The window does not need to be long to work, but it does need to be applied uniformly and published in the terms — introduced retroactively during a dispute, it is worth very little.
4. Deduplicate across channels
A single order counted by both the affiliate channel and another channel is a more common source of leakage than fraud is. The deduplication rule needs to be settled explicitly: when the affiliate channel wins, when it yields to organic or direct, and how an affiliate click that follows a brand search is treated. Several rules are defensible; what matters is that the rule is stated, stable and applied identically to every partner. An inconsistent rule becomes something to arbitrage in its own right.
5. Make the clawback enforceable
A clawback clause written as a statement of principle is difficult to use. Enforceable means the invalid-conversion conditions are defined, the mechanism for offsetting against future commissions is specified, and both the form of evidence the advertiser provides and the window in which the partner may respond are agreed in advance. At that level of specificity, withholding a payment stops having to escalate into a commercial conflict every time.
The signals worth monitoring
Click volume is a weak signal; on its own it neither proves nor disproves anything. What discriminates is how a handful of ratios are distributed across partners, because what is anomalous is the relative position rather than the absolute number.
| Signal | Why it discriminates |
|---|---|
| Conversion rate by sub-source | Partner-level numbers are averages that hide the problem. It is nearly always concentrated in one or two sub-sources, and only visible once the data is split by sub-id. |
| Refund and chargeback rate by partner | This is where the validation window pays for itself: orders sourced from low-quality traffic carry a refund rate visibly above the program mean. |
| Time from first visit to order | A distribution that is too narrow, or a very short median, usually indicates that the attribution happened after the purchase decision rather than before it. |
| Hop count on the inbound path | A legitimate partner's path is stable. A change in hop count usually corresponds to traffic being resold or a new hop being inserted into the path. |
| Brand organic volume against one partner's growth | This is the one reliable external signal for brand-term interception: total demand is unchanged, it has simply moved from one pocket to another. |
How these are collected and where thresholds sit is covered in detecting affiliate click fraud. Whether the partner's own pages stay compliant, and whether their content changes quietly after approval, is a separate monitoring surface — see monitoring partner page compliance.
When a partner trips a signal
Termination should not be the first move. A single signal is more often explained by one sub-source under a partner than by the partner itself, and a partner willing to cut a bad sub-source is worth keeping. A workable order: switch that partner off automatic approval and into manual review; request the sub-source breakdown for the affected period; then compare that cohort's refund rate and retention against the program mean. If the pattern survives the partner's own explanation, then discuss termination and clawback.
Whichever way it ends, keep the process in writing. Clawbacks usually fail to stick not because the clause was missing but because the contemporaneous evidence cannot be produced. That is the practical value of the second control: it turns an argument about good faith into a comparison of records. Competitor-driven click attacks are a different problem with a different response — see identifying competitor click fraud — and the weighting of these risks varies by vertical, covered in click fraud protection by industry.
A checklist to work from
- Partner terms state, explicitly: permitted traffic sources, the brand-term policy, the incentivized-traffic policy, cookie duration, the attribution rule, the validation window, and the clawback conditions.
- A first-party visit record exists alongside the network's, carrying at least entry URL, referrer, region, device, timestamp and redirect path.
- A validation window is live and applied uniformly, with no exemption for high-volume partners.
- The deduplication rule is published and answers the boundary case of an affiliate click that follows a brand search.
- Reporting splits to sub-id level, not only to partner level.
- Refund rate, time-to-order and hop count are tracked per partner, with a threshold that triggers manual review.
- Brand organic volume is periodically compared against affiliate growth.
- Withheld payments and terminations are documented with the evidence retained.
Frequently asked questions
How is affiliate click fraud different from click fraud on paid media?
On paid media the loss happens at the click, and recovery depends on the platform issuing a credit. In an affiliate program the click costs almost nothing; the loss is realized once a conversion is attributed and a commission is approved. The interval in between is a control window the advertiser holds by default, and using it is far more effective than trying to filter partner traffic in real time.
What are the most common fraud patterns in affiliate programs?
Five. Cookie stuffing drops tracking cookies on users who never saw the offer. Forced or hidden clicks fire the tracking request from an invisible element. Brand-term interception captures buyers already searching for the brand. Bot-driven activity produces clicks and shallow sign-ups at volume. Attribution hijacking inserts a partner into the last hop of a redirect chain. The first, third and fifth are the expensive ones, because the orders behind them are real and look entirely normal in aggregate.
Does a validation window actually reduce fraud losses?
It is the control most programs are missing and the one with the most direct effect. Holding an approved conversion for thirty to sixty days before it becomes payable gives refunds, chargebacks, duplicate orders and cancellations time to surface. A partner running low-quality volume looks profitable in week one and usually stops looking profitable once a full window has closed over that cohort. The window need not be long, but it must be uniform and written into the terms.
Should a program run its own tracking rather than relying on the network?
An independent record is worth having, though it need not replace the network. The network's numbers are also the basis for the invoice, so reconciling with them alone is auditing the biller with the biller's records. A first-party record — entry URL, referrer, region, device, timestamp, full redirect path — lets a disputed conversion be examined on its facts, and most disagreements end once the sequence of the visit can be shown.
What is a proportionate response when a partner trips a signal?
Move them to manual review rather than terminating. A single signal more often points at one sub-source than at deliberate abuse, and a partner willing to cut a bad sub-source is worth keeping. Pause automatic approval, request the sub-source breakdown, and compare that cohort's refund rate against the program mean. If the pattern survives the partner's explanation, then discuss termination and clawback. Document either outcome — whether a clawback is enforceable depends on the evidence recorded at the time.
Make every visit accountable
The ROAS365 console breaks visit data down by source, region and device, and exports the underlying decision logs — so a partner reconciliation is settled with records rather than assertions.