Foxpenny blog · Affiliate fraud
How brands detect affiliate fraud: click fraud, cookie stuffing, and inflated conversions.
Networks report their own numbers. Brand-side instrumentation is the only ground truth that survives a dispute packet. Here is what to look for and what to log before the next payout statement lands.
Why it hides
Networks report their own numbers.
Every affiliate dashboard is a curated feed: the network sets the click count, the conversion count, and the reversal window. Without raw logs on your side, you are comparing your best guess against theirs — and the dispute resolution process almost always sides with the side holding the data. The honest defense starts with instrumenting every redirect server-side, keeping a copy of every click, and comparing what reaches your servers against what the network reports.
Ground truth principle
Anything a network can revise after the fact — click counts, conversion IDs, reversal windows — should be reduplicated on your side before the payout statement settles. If you cannot reconstruct it from your own logs, you cannot dispute it.
Detection signals
Three families of affiliate fraud, and how each one shows up in your logs.
The patterns we see most often split into three families. Each one leaves a different fingerprint in your click stream — and each one gets a different response from a network's quality team.
Pattern 1 of 3
Click fraudBot traffic, incent clicks, and farms running the same playbook against every program in your category.- Sub-second inter-click cadence from the same device fingerprint
- Headless-browser user agents and missing referrer headers
- Datacentre ASN ranges instead of consumer ISPs
- IP clusters that resolve to a single household or VPN exit
Pattern 2 of 3
Cookie stuffingForced `document.cookie` writes, hidden iframes, and chains engineered to claim credit for a conversion the user never intended to send your way.- Server-side cookie-set events uncorrelated with server-received clicks
- Overlapping affiliate cookies set within the attribution window
- Iframe stuffer pages and 1x1 pixel drops on browsers that never clicked
- Redirect chains that terminate in a 3rd-party cookie without a real referrer
Pattern 3 of 3
Inflated conversionsChargeback rate vs partner, conversion clusters by device fingerprint, and reversal distribution over the 30 days after a payout.- Self-referrals: the operator device fingerprint appears on a "new" conversion
- Test-card rings: small-charge / refund cycles designed to trigger payout
- Attribution theft: credit-stealing redirects after a real conversion
- Duplicate conversion IDs reused across subIDs
The obstacle course
How networks make it hard to argue.
The detection signals above do not dispute themselves. Networks use a handful of predictable levers to push back, and you should walk in already knowing about each one.
Silent reversal windows
A conversion attributed on day one can disappear from your next statement with no audit trail. Capture your own click-conversion join before the next statement closes.
Last-click attribution
The default model absorbs organic traffic and hands it to whichever partner last touched the user — a long-term tail of unattributed conversions quietly rolls into a network's payout column.
Slow dispute SLAs
Reversal windows and dispute timelines vary by network. Knowing the window for each partner lets you push evidence packets before they expire.
Network-side bot filtering
Networks routinely discard bot clicks from their own totals — but quietly count the human clicks they delivered to you on their tab. Reconcile the two surfaces.
Playbook
A defense playbook for brand-side affiliate programs.
Four habits cover most of the surface area. They are unglamorous, they are cheap, and they are the difference between a dispute packet and a shrug.
Step 1
Instrument on your side
Run every redirect through a server you control. Log click IDs, IP, UA, device fingerprint, and the full redirect chain.
Step 2
Keep raw logs
Treat raw logs as the asset. Roll them into cold storage so a dispute packet six months from now still has the evidence needed to overrule the network.
Step 3
Compare weekly
Run a payer-vs-receiver week-over-week comparison. Drift in either direction is where the leak starts. For a broader view of where commissions leak, see our commission leakage guide.
Step 4
Push disputes with evidence
Build the packet before the support ticket — click IDs, conversion timestamps, raw redirect chains, and a statement delta. Networks reverse on evidence, not on narrative.
This guide is part of the broader commission-leakage story. Pick a network and run the four steps against a single partner before scaling the playbook across the whole roster.
Next step
Put the playbook on autopilot.
Foxpenny runs the four steps above continuously — raw logs, weekly drift reports, conversion fingerprinting, and dispute packets assembled from the moment a click lands. Drop your email and tell us how you run your program; we'll reach out when the next cohort opens.