Partner Fraud: Seven Patterns to Watch For

Fraud in a partner program is rarely clever. It is usually someone noticing that a payout rule has a gap and using it a few hundred times. If you know the seven common shapes, you can read most suspicious data in a few minutes and, better, write rules that close the gaps before anyone finds them.

The patterns below are ordered roughly by how often a small program meets them. For each one: what it looks like in your data, why it works, and what to do.

Self-referral, and how it shows up

A partner signs up for your product through their own link, takes the commission, and cancels or keeps the account at a discount. It works because attribution cannot tell who is holding the mouse.

The traces are mundane. The customer's email domain matches the partner's. The address is a plus-sign variant of the partner's own. The click and the signup come from one IP address within a minute of each other. The customer never invites a teammate, never logs in again, and cancels the week the commission clears.

Say a partner is paid a flat $100 per signup and refers 12 customers in a month, 9 of them on free-mail addresses created that same month, all with the same card billing ZIP. Any one of those facts is innocent. Together they are a case to review.

Prevention starts with the terms, not the software. A line that says partners may not refer themselves, their employers or their own entities gives you a clear basis for declining the commission and ending the relationship. Detection after that is mostly matching: email domains, names, payment fingerprints and IP addresses, compared between partner and customer.

Are junk leads and fake signups a real problem?

They are the main problem in any program that pays per lead or per free signup, because the cost of producing a fake one is close to zero. A flat fee of $25 per lead turns a form into a cash register for anyone with a script.

Junk shows up as clusters: dozens of leads in an hour from one partner, disposable email domains, phone numbers that fail basic validation, identical company names with slightly different spellings, and a lead-to-opportunity rate near zero. Honest partners also send some bad leads, so look at the ratio, not the individual record. A partner whose leads convert to sales calls at a fraction of the others is worth a conversation either way.

Structural fixes work better than detection. Pay on a later event, such as a booked meeting, a paid first invoice or a completed trial, instead of on the form submission. Pay a smaller amount on the early event and a larger one on the later event. And review before approving: every commission sits as pending until a person or a rule releases it.

Cookie stuffing and forced clicks: how do they hide?

Cookie stuffing means setting a partner's tracking cookie on someone who never chose to click, through a hidden iframe, a redirect with no user action, a pop-under, or a browser extension that rewrites links. The visitor later buys for unrelated reasons, and the partner collects.

The click data gives it away. You see a high volume of clicks with no referrer or an unrelated referrer, near-zero time on the landing page, and a conversion rate that is oddly low for the volume and oddly steady for the hour. Real audiences are lumpy. A newsletter send produces a spike and a tail. A stuffed cookie produces a flat line.

A partner can also stuff by accident. A coupon browser extension that fires an affiliate link when a shopper reaches checkout looks the same on your side, and the partner behind it may not control how the extension behaves. Whether the cause is deliberate or not, the remedy is the same: you decide in your terms which traffic types you pay for, and you prohibit forced or hidden clicks by name.

Last-click versus first-click rules matter here. Under last-click credit, a late stuffed cookie steals from the partner who did the work. How credit is decided between competing partners is a separate question; what happens when a customer clicks two partner links covers the tradeoffs.

Brand-term hijacking

A partner buys search ads on your company name, product name or obvious misspellings. Someone who was already looking for you clicks the ad, lands through the partner's link, and the partner is paid for a customer you would have gotten anyway. Variations include registering domains that contain your brand and building thin review pages that rank for "your brand discount."

Whether this is fraud or just aggressive marketing depends on what your terms say. Some programs allow it, some allow it with approval, and most prohibit it. The pattern in the data: clicks that arrive with an ad-click identifier and a landing page tied to your brand, and a conversion rate far above the rest of the partner's traffic, because those visitors already wanted you.

This one deserves its own treatment, including what to write in the terms and how monitoring works. See how to stop partners from bidding on your brand terms. Trademark questions are a matter for your counsel.

How do coupon codes leak?

You give a partner a code for their audience. A deal site lists it for everyone. Now a shopper who was already at checkout opens a new tab, searches for a discount, finds the code and pastes it. The partner is credited with the sale, and you have also given away a discount you did not need to.

The trace is a code redeemed far more often than the partner's audience could explain, with no clicks on that partner's link in the same window, and redemptions concentrated at the moment of checkout. A partner with a 3,000-person newsletter whose code is suddenly used 400 times in a week is probably not the source.

Per-partnership codes help, because you can see which code is circulating, and you can expire or replace it. Limits help too: one redemption per customer, a usage cap, an end date. Coupon attribution has real strengths as well as this weakness; when coupon code attribution beats links goes through both.

Can refund timing be gamed?

Yes, and it is the quietest of the seven. A partner, or a partner and a customer who know each other, arranges signups that are refunded or canceled just after the commission is released. The partner keeps the money. The company ends up with a clawback it must try to recover.

Look at refund rate by partner. A company-wide refund rate of 4% and a partner at 30% is not subtle, though it needs enough volume to mean anything: 3 refunds out of 10 is a small sample. Also look at when the refunds happen. A cluster that lands right after the review window closes is more suspicious than refunds spread across the month.

The fix is timing. A refund before invoicing voids the commission, so the longer commissions stay pending, the fewer clawbacks you chase. Auto-approving only after a set number of days with no refund does the same job automatically. The mechanics of the after-payment case are covered in how refunds and clawbacks should work.

Why do duplicate partner accounts matter?

A partner who was removed returns under a new name. Or one operator runs five partner accounts so that each looks small, each stays under a review threshold, and each claims a different slice of the same traffic. Or an account exists under a name that should never have been approved at all, such as a person or entity on a government sanctions list.

The traces are shared keys: the same payout details, tax identifier, website, phone number, domain or similar email addresses across supposedly separate partners. Typed names are the weakest signal because they are easy to vary. Matching on the underlying keys is much stronger.

The sanctions case has its own legal weight, and it is not something to improvise. Sanctions screening for global partner programs explains what the issue is. Confirm your obligations with counsel.

Does the payout model change which fraud you get?

Heavily. Each commission structure attracts its own abuse, so match your checks to your model. Flat fees per lead or free signup draw junk volume. Percentage-of-payment commissions draw refund games and stolen cards, because the partner wants a real charge to go through. Recurring commissions draw patient abuse: a fake customer who stays on the cheapest plan for a year costs less than the commission it earns. Coupon-based attribution draws leakage.

That is not an argument against any model. It is a reason to ask, before you launch, how you would exploit your own rules if you were the partner, and to write the answer into the terms.

Which checks should the program build in?

Most of the cure is design, and it does not need to be elaborate.

• Pay on events that are expensive to fake: a paid invoice, a booked call, a completed trial.
• Keep commissions pending long enough for refunds to appear, then approve in a batch.
• Write the prohibited behaviors into signed terms, by name, so a decline has a basis.
• Look at ratios per partner, not just totals: refund rate, lead-to-sale rate, clicks per conversion.
• Give a person the final call on anything flagged. A rule can say "look here"; it should not say "this person is a fraudster."

Be honest about the cost side too. Fraud checks create false positives, and a good partner who is wrongly held loses trust faster than a bad one costs you money. For a young program with 20 partners and a handful of commissions a month, reading the review queue yourself every week is enough. Automated matching starts to pay for itself when the queue is too big to read.

In Affiliate Tabs, commissions move from pending to approved through a review queue with bulk approve and decline, with optional auto-approval after a number of days with no refund. The fraud suite adds duplicate matching on keys, sanctions screening of partner names, brand-term monitoring and a complaint queue. It surfaces candidates; a person on your team still decides what happens to the commission and the partner.

When someone is flagged, what do you actually do?

Start by deciding what you can prove. A match on a shared bank detail is evidence. A feeling that a partner's growth is too fast is not. Write down what you saw, with dates and record ids, before you contact the partner.

Then use the least drastic step that fits. For a first, ambiguous case, ask for an explanation and hold the specific commissions in question. For a clear terms violation, decline the affected commissions, say which clause applies, and either end the relationship or give a written warning with a deadline. If a partner disputes it, a short written exchange that cites your terms usually settles the matter faster than a call.

Keep a record of every decision. If a partner or a payment provider ever asks why a commission was declined, you want dates, evidence and the clause, not a recollection. What a partner program audit trail should record lists what to keep.