What is affiliate fraud, and how do you catch it?

Affiliate fraud is a partner collecting commission for a sale they did not earn: their own purchase, or a visitor whose browser carried the partner's cookie without a click.

You catch it by comparing each partner with their buyers, timing the gap between click and sale, and holding commission until refunds and disputes arrive, which can take 120 days.

The best-documented case is eBay's. From May 2006 to June 2007, eBay paid one affiliate company about $5.2 million in commissions, and the parties stipulated that $200,000 to $400,000 of it came from cookie stuffing, which is 3.8% to 7.7%.

The company's co-owner was sentenced to 15 months in prison (U.S. Attorney's Office, Northern District of California).

Who are the affiliate fraudsters, and why does fraud pay?

Affiliate fraudsters are partners, or operators posing as partners, who collect commission they did not earn.

Rewardful's help center, in an article dated February 17, 2022, sorts self-referrals into legitimate agency resales, accidental use of one's own link and fraud by someone who joins only to discount their own plan (Dealing with self-referrals).

On a $100 a month plan with a 30% commission, a partner who refers themselves earns $30 a renewal, so 12 renewals return $360 of the $1,200 they pay.

See the self-referral guide, and decide how coupon codes are credited before a partner posts one.

Deliberate fraud comes from operators who build cookie-setting code, extensions, scripts and batches of accounts. Peter Snyder and Chris Kanich, who studied 2014 web logs, note that each extra redirected visitor costs such an operator almost nothing.

Fraud pays because commission is cash while a fake visit costs close to $0. A program that pays per sale rewards cookies and self-purchases, and a program that pays per lead rewards scripts that fill in forms.

Sources: help.rewardful.com/en

Which patterns of affiliate program fraud exist, and what signal exposes each?

The 7 common patterns of affiliate program fraud are self-referral, cookie stuffing, checkout hijacking, fake signups and bot clicks, paid ads on a brand, refund and chargeback abuse, and duplicate partner accounts. The table pairs each pattern with its signal.

Each pattern leaves one signal in click or billing data. Trackdesk, FirstPromoter and PartnerStack publish rules for several of the 7, and Trackdesk defaults to 30 seconds between click and sale and 4 clicks from one IP in 24 hours.

Per Rewardful, self-referral also has legitimate forms, so a flag starts a review and does not prove fraud.

What does cookie stuffing look like in practice?

What happened in the eBay cookie stuffing case?

Cookie stuffing is the practice of setting an affiliate cookie on a visitor who never clicked an affiliate link.

Brian Dunning was indicted on 5 counts of wire fraud on June 24, 2010 and pleaded guilty on April 15, 2013 to a superseding charge.

He and his brother formed Kessler's Flying Circus in about April 2005, and the company took part in eBay's affiliate program.

He wrote 2 free applications, ProfileMaps.info and WhoLinked.com, that site owners installed, and the code gave visitors to those sites a cookie with the company's ID although they had not clicked an eBay ad.

He was sentenced on August 4, 2014 to 15 months in prison and 3 years of supervised release after an investigation by the Federal Bureau of Investigation. The conviction makes the eBay case the best-documented example of the scheme.

What did a 2014 study of affiliate fraud measure?

The 2014 study by Snyder and Kanich, of the University of Illinois at Chicago, measured cookie stuffing in real web traffic.

The authors analyzed 2.3 billion HTTP requests from a large East Coast university: 895,722,435 in January 2014 and 1,440,677,533 in February.

Across 166 programs, Amazon accounted for over 98% of affiliate conversion events, and the authors found no sale where a stuffer displaced an honest partner's credit inside a 24-hour window.

For Amazon, a conversion event is an add-to-cart page visit, which overcounts purchases. Of 3,664 Amazon publishers seen, 1,396 behaved like cookie stuffers (38.1%), yet stuffers received 174 of 955 credited conversion events (18.2%).

Treat the counts as a 2014 illustration (No Please, After You: Detecting Fraud in Affiliate Marketing Networks).

How does the same trick work through a browser extension?

Checkout hijacking is the allegation that a browser extension swaps in its own referral code at checkout.

On July 10, 2026, TechCrunch reported, citing a Bloomberg investigation, that Phia, a shopping app founded in 2025, was accused of overwriting other affiliates' referral codes with its own at checkout.

Impact.com suspended Phia, and a spokesperson said the necessary changes had been made (TechCrunch). When the last click wins, a click just before checkout can claim a journey another channel started.

The signal is a short gap between the last click and the purchase, and Trackdesk flags a sale under 30 seconds after the click by default.

What does affiliate marketing fraud cost?

The cost of affiliate marketing fraud is the commission paid on unearned sales plus the fees on each reversal. I could not verify an audited loss rate for SaaS affiliate programs, so measure your own.

The 2 data points above differ: the eBay figure is a share of commission dollars, and the Amazon figure is a share of credited conversion events. On a $10,000 monthly commission bill they look like this.

A single bad sale costs more than its commission. On a $149 a month plan at 20%, the commission is $29.80.

If it was paid and the cardholder then wins a dispute, you lose the $149, the $15.00 dispute fee on Stripe's pricing page and the $29.80: $193.80. Contesting and losing adds a $15.00 countered fee, for $208.80.

Stripe says card networks typically allow disputes within 120 days, and a bank can take up to 3 months to decide one.

How should you monitor for affiliate fraud?

Affiliate fraud monitoring is a set of rules that flag suspicious clicks, conversions and partners. Trackdesk lists 13 rules, 6 for clicks, 5 for conversions and 2 for affiliates, and only 2 take custom settings.

PartnerStack lists no numeric triggers: if you take no action on a flag, it holds the partner's rewards and removes the partner 30 days later.

A 4-click rule flags an office that shares one address, so a flag should start a review before anyone loses an account.

For example, 4 colleagues clicking one partner link from a shared office network within 24 hours trip the rule without any fraud.

Run these checks before approval, on a partner's first sale, weekly and before every payout, and filter bot clicks first (bot traffic filtering for links). The tracking explainer shows where each signal is recorded.

Which settings limit the damage?

A hold is the delay between a sale and the payout of its commission. Set the hold to your refund guarantee plus a margin and net later reversals against the next payout (refund clawback guide).

In our product, the hold runs 0 to 180 days from the end of the payout period and defaults to 0, so a new program pays as soon as a period closes until you change it.

Its cookie window pre-fills 60 days and accepts 1 to 3,650. A 7-day window leaves a stuffed cookie 7 days to claim a sale instead of 60, though it drops honest partners whose readers take longer.

One credit rule, last click, first click or shared, applies to every program in a workspace, and first click or shared credit shrinks what a late click earns. FirstPromoter's paid-ad rule has 4 settings per promoter.

TrackRev can hold each application for review. Name the banned behaviors and the penalty in the partner terms (affiliate agreement clauses), and plan payouts with how to pay affiliates.

What does TrackRev cover and what does it leave to you?

TrackRev, the SaaS affiliate software we built for indie hackers and small SaaS teams, filters bot clicks at the redirect: known-crawler and empty user agents and prefetch requests such as Apple Mail's are stored with an is_bot flag and left out of link, attribution and partner reports.

On referral campaigns, a signup that matches the inviter's browser, device fingerprint or IP on a different device is written as revoked, with the reason shown.

A refund reverses the matching commission, and the commissions API accepts a void or fraud status before payout.

TrackRev does not score click to purchase time or clicks per IP for each partner, and cash commissions have no automatic partner-versus-buyer comparison, so those checks are yours.

If screening is the priority, Trackdesk publishes 13 fraud rules and PartnerStack's fraud monitoring documentation cites Sift.

The affiliate program is on every paid plan: In our pricing, Indie is $29 a month and Growth is $299 a year, with no cap on the commission tracked (pricing).

The free plan has 50 links and 1,000 tracked events a month and no affiliate program. See the affiliate program page we built.