Home / Blog

Affiliate Fraud: How to Spot It and Stop It

The six schemes that actually cost advertisers money, the signals that expose each one, and a review process that catches them without accusing honest partners of anything.

By Nora Ellis, Affiliate Marketing & Creator Economy Writer · with Wooly Network, Advertiser Success · 20 September 2026 · 7 min · Tracking & Attribution

Affiliate fraud is any attempt to earn a commission without producing the customer: cookie stuffing, brand bidding, code leakage, bot traffic, self-referral and fake leads. Most of it is caught by three habits rather than by software: a validation period before payout, a look at the time between click and sale, and checking whether referred customers are new.

Four cards showing a ghost click, an impossibly fast conversion, a burst of clicks and an automated crawler

None of these is proof on its own. Each one tells you which row to open first.

An important framing before the list

Nearly every fraud signal has an innocent explanation, and if you forget that you will damage good partnerships. A conversion that happens ninety seconds after a click looks like fabrication and is also exactly what a returning customer with a saved card does. A click your site never saw looks like cookie stuffing and is also what a privacy extension produces.

So the working method is not detection, it is triage. Signals tell you where to look. The thing that settles a case is opening the order in your own system and seeing whether the customer, the payment and the basket look real.

The six schemes, and what exposes each one

Scheme	What happens	The signal
Cookie stuffing	Referral cookies dropped without a real click, often in an iframe or a hidden pixel	Huge click volume, near zero conversion rate, clicks your site never records as arrivals
Brand bidding	Paid search ads on your own brand name, intercepting people already searching for you	Traffic on brand keywords, high conversion rate, mostly returning customers
Code leakage	A partner code posted to coupon aggregators	Volume from one code far exceeding that partner's audience, discovered by searching your brand plus discount code
Bot traffic	Automated clicks, sometimes automated form fills on lead campaigns	Impossibly fast conversions, bursts of clicks from one address, declared automated user agents
Self-referral	A partner buying through their own link, sometimes at scale with different emails	Shipping addresses repeating, payment method matching, orders clustering around payout dates
Fake leads	Invented or recycled form submissions on CPL campaigns	Failed phone and email verification, duplicates, submissions at inhuman regularity

The signals in detail

The click that arrived nowhere

Your link was clicked but your own page never reported anybody landing. Genuine shoppers produce this constantly, because they block scripts, or because the sale was reported by your server, or because your tag is on the checkout page and not on the landing page. It is also exactly what a stuffed cookie looks like from the outside, which is why it is a flag and not a verdict.

What makes it meaningful is the ratio. One partner at 15% is normal. One partner at 95% while everybody else sits at 12% is a question that needs answering.

Wooly Network surfaces this per conversion as a Ghost click label.

The conversion that happened too fast

Less time passed between the click and the sale than it takes to load a page and enter a card. A returning customer with a saved card does this honestly. So does a click fabricated a moment before a purchase that was going to happen anyway, which is what cookie stuffing near the checkout looks like.

Again, look at distribution rather than individual rows. A partner whose conversions all land inside two minutes is not sending you readers.

Wooly labels this Bot speed.

Clicks arriving in bursts

A run of rapid clicks from a single address inside a few seconds is not a human reading anything. The right response is to exclude those clicks from the count rather than to punish the partner, because sometimes the source is a corporate proxy or a security scanner. Wooly removes these from click totals and marks them Burst click, so the click number a partner is judged on stays honest.

Automated software identifying itself

Crawlers, link checkers and the preview generators in chat apps all fetch links. Every time somebody pastes an affiliate link into a group chat, something automated visits it. These should never count as clicks. Wooly excludes them as Crawler click.

Those last two are different in kind from the first two, and the difference is worth holding onto. Ghost click and Bot speed describe something noticed about a sale. Burst click and Crawler click describe something done to a count: a click was excluded so the reporting is more accurate. The sale itself is tracked, attributed and priced exactly like any other.

The attention score

Wooly also puts a number from 1 to 5 on a conversion, weighted from what can be seen about that one sale. It is not a percentage, not a risk rating and not a verdict, and it decides nothing on its own. It sorts your queue, which is genuinely what you want from this category of tooling. Open the row and the reasons behind the number are printed in full. The full explanation is in the commissions guide.

The three habits that prevent more than any tool

1. A validation period

Do not pay on order placement. Hold commissions until the return or refund window closes, typically 14 to 45 days depending on your category. Almost all fraud reveals itself in that window, because fake orders get refunded, chargebacks land, and fake leads fail verification. This single policy removes most of the exposure and costs you nothing but a calendar. Terms are set per campaign, see commission payment terms.

2. Rules specific enough to enforce

Most "fraud" in affiliate programmes is actually ambiguity. A partner bidding on your brand name is not stealing if you never said they could not. Write the four rules that matter, in the language of permission and prohibition, in your program brief: paid search, coupon posting, email, and claims.

3. Approve partners like you mean it

Instant approval is right for a low risk ecommerce offer and wrong for a CPL campaign paying $40 a lead. Ask for the specific channel, the specific audience, and a link to existing work. Twenty minutes here prevents most of what you would otherwise be investigating in month three. How to approve the right creators goes through what to look for.

A review process that takes ten minutes a week

Sort by amount, then by flag. Large commissions and flagged rows first. A $9 commission is not worth twenty minutes whatever the flags say.
For each flagged row, open the order in your own store. Real name, deliverable address, plausible basket, payment that cleared. This is the check no platform can do for you and the only one that settles anything.
Check new versus returning for any partner you are unsure about. It answers the interception question faster than anything else.
Once a month, search your brand plus "discount code" and see whose code is on page one.
Once a quarter, run a pause test on your least convincing partner and watch total revenue, not channel revenue. The method is in last click vs first click attribution.

When you deny a commission, say why

This is the part programmes handle worst. A denial with no reason attached turns a recoverable misunderstanding into a lost partner and, often, a public complaint that costs you future recruits.

Write the reason, in one sentence, attached to the row, at the moment you deny it. Refunded order. Failed lead verification. Brand bidding, against clause four. Duplicate submission. Partners accept denials with reasons far more often than programme managers expect, because most partners have had commissions voided silently elsewhere and know exactly how that feels. On Wooly the reason stays attached to the row permanently, so six months later you can both re-read precisely what was said.

Common questions

How common is affiliate fraud?

Common enough to design for, rare enough that assuming bad faith will cost you more than it saves. The practical stance is a validation window and a ten minute weekly review, not a fraud department.

Is brand bidding actually fraud?

Only if your terms prohibit it. Otherwise it is a partner using a channel you left open. It is still usually worth prohibiting, because you end up paying a commission to appear above your own organic result for a search that was already going to find you.

Can I recover commission I have already paid?

Sometimes, by offsetting against future earnings if your terms allow it, which is a good reason for your terms to allow it. Prevention through a validation window is far more reliable than recovery.

What about coupon extensions that inject a referral at checkout?

This is the grey area with the largest financial impact for most retailers. It is usually legal, usually within the letter of the programme terms, and usually not incremental. Handle it with policy: a lower rate for that partner type, or exclusion, stated publicly rather than enforced quietly.