RefficksBlog

Affiliate fraud prevention: the patterns worth reviewing, without accusing honest partners

By The Refficks team · · 11 min read

"Will I get cheated?" is a fair question to ask about any program that pays people a share of sales. Some people would rather take the share than earn it.

But plenty of what looks like fraud in a partner program is something duller: a refund that arrived after the commission was paid, a discount code that ended up on a deals site, a partner buying through their own link because nobody told them not to. Each of those has a fix that is a rule, not an accusation, and the rules are cheaper to set up before launch than after the first argument.

This guide covers the structure that prevents most problems, six patterns worth watching, how to tell a signal from a coincidence, and how to raise a concern with a partner without ending the relationship. There is a review email and a checklist at the end.

Prevention is mostly structure

Five decisions remove most of the reward for gaming a program. Make them before you invite anyone:

  1. Pay on sales, not clicks. A program that pays only when money arrives pays nothing for a click on its own. Faked clicks can still be used to claim sales (see click floods below), which is why the rest of this list matters. If you pay for leads, or reward referrals for signups, pay for ones you have checked, not for form fills.
  2. Hold commission longer than your refund window. A sale refunded inside the hold never becomes money a partner was paid. See affiliate commission structures for how long.
  3. Reverse refunds and chargebacks automatically, including after payout, by netting them against the partner's next earnings.
  4. Review applications by hand at first. Ask where a partner will promote you, and look at it. A partner with no site, no audience and no answer is a question worth asking before approval rather than after.
  5. Write the promotion rules into your terms: your own purchases, coupon and deals sites, bidding on your brand name, and claims about your product you have not approved. (This is step 6 of how to start an affiliate program.)

With those in place, most of the patterns below become something to review rather than money already gone.

Six patterns worth watching

Each one has an honest explanation as well as a dishonest one. Check which it is before you decide anything.

What it looks like. A partner's first sales come from the partner: the buyer's email is theirs, the order ships to their address, or several of their "customers" turn out to be one household.

The honest explanations. They are a genuine customer who also promotes you, or nobody told them the rule.

The fix. Decide the rule and write it down. You can pay nothing on a partner's own purchases, pay a lower rate, or allow it openly (a partner who uses the product can be its best advocate). In a referral program, where the reward is for introducing someone new, the friend should have to be a new customer.

2. Discount codes that leak

What it looks like. A partner's code sales jump with no matching jump in their clicks, and the orders come from deals and coupon sites rather than from the partner's own content.

The honest explanations. Their audience shared the code, or a coupon site copied it without anybody's permission. A leaked code is not proof that the partner posted it.

The fix.

  • Give every partner their own code, so a leak is traceable to one code.
  • Use the limits your checkout offers. Shopify lets a discount code be limited to one use per customer and a total number of uses, with a minimum purchase. Stripe lets a promotion code be limited to first-time customers, a minimum order, a number of redemptions and an expiry date. A leaked code with limits like these costs far less.
  • Retire a code that has leaked and give the partner a new one. Tell them why.
  • Decide whether a code beats a click. With "a click beats a code", a shopper who clicked a content partner's link and then found another partner's code on a deals site is credited to the content partner. See affiliate attribution explained.
  • Put "no posting codes to coupon or deals sites" in your terms if that is your rule.

3. Click floods

What it looks like. A partner's clicks jump far above their normal, often from one source or one machine, and sales do not follow.

The honest explanations. A post spread further than expected, a bot crawled the link, or the partner tested their own link a few hundred times.

The fix. If you pay only on sales, a click flood costs you a distorted dashboard and nothing else. It is worth a look for one reason: cookie stuffing. That is forcing a partner's referral onto visitors who never chose to click (through a hidden frame, an image or a pop-under) so that purchases they would have made anyway are credited to the partner. The sign is a lot of traffic, very few customers of the partner's own, and sales that look like the ones you already get without partners. It is fraud in the plain sense: in 2014 a US federal court sentenced a former eBay affiliate to fifteen months in prison for it, after a guilty plea to wire fraud.

4. Refunds and chargebacks well above everyone else's

What it looks like. One partner's customers refund or dispute far more often than the rest of the program's.

The honest explanations. The partner promises something the product does not do, or sends an audience it does not suit. That is a message problem, not fraud, and it is fixed with a conversation about claims.

The dishonest one. Stolen cards used to buy through a partner's link, paid out as commission before the card's owner disputes the charge. Stripe names a cardholder saying they did not authorize a payment as the most common reason for a dispute.

The fix. The hold and the automatic reversal from the first section. Card networks typically allow disputes within 120 days of a payment, so a reversal after payout matters more than any hold you could make partners wait out. Treat a dispute like a refund when it opens, not when it is decided.

5. One person, several partner accounts

What it looks like. Two partner accounts paid into the same bank account or PayPal address. Often paired with a recruiter commission: a partner "recruits" a second account of their own and earns a share of their own sales.

The honest explanations. A couple or a small agency sharing an account, which is worth knowing about and may be fine.

The fix. Pay recruiter commission only on the sales recruits go on to make, never on signups, and keep it to two levels. A second account with no sales then earns nothing. One that does sell still earns its owner a share of their own sales, so say in your terms that nobody can recruit themselves, and check whether a recruit is paid into the same place as their recruiter.

6. Bidding on your brand name

What it looks like. A partner's ad appears when people search for your brand, the sale is credited to them, and the customer was already looking for you.

The honest explanation. The partner did not know it was against your rules, because it is not against the search engine's. Google's advertising policy says it will not restrict trademarks used as keywords; a trademark owner's complaint can restrict how a brand name is used in an ad's text. Microsoft Advertising makes advertisers responsible for their own keywords and says it is not a mediator in trademark disputes.

The fix. This is a terms question, not a tracking one. Write it down: no bidding on your brand name, its misspellings or your product names, and no ads that link straight to your site. Then check by searching for your brand yourself, now and then, from a private window.

Unusual is not the same as guilty

A pattern is a reason to look, not a verdict. Two pieces of arithmetic keep that honest:

  • Small numbers are noisy. Suppose 4% of your sales are refunded. A partner with 3 refunds out of 10 sales looks alarming, and for one partner it is unlikely by chance: about 1 in 160. Across 200 partners with 10 sales each, though, you would expect about one partner to look exactly like that with nobody doing anything wrong.
  • A rule that flags the top 5% of anything flags 10 partners out of 200, every time, whether or not any of them did anything.

So rank what you look at by how much money is involved, whether the pattern holds over more than one period, and whether there is an honest explanation you have not ruled out. It is the same arithmetic as a partner with clicks and no sales, in affiliate onboarding.

Raising a review with a partner

When something does need a conversation:

  1. Look first. Check the orders, dates and sources yourself before you write anything.
  2. Hold, don't take back. Leave the commissions in question pending. Do not reverse or cancel money already earned until you have asked.
  3. Ask, don't accuse. Say what you saw in plain words, and ask one question.
  4. Decide, and write the decision down. It will be one of three: no problem (approve them), a rule they did not understand (explain it, and decide what happens to the past commissions), or a deliberate breach (reverse what your terms say, and end the partnership if they say so).
  5. Tell them the outcome, in writing, with the reason.

A template for step 3:

Subject: A question about some recent orders

Hi {first_name},

While checking this month's commissions, we noticed {what you saw, in plain words: "four orders placed with the same email address as your partner account"}.

There may well be a simple explanation, so before anything is decided we'd like to ask: {one question, such as "were these purchases for you, or for clients?"}

Until we hear back, the {n} commissions on those orders stay pending. Nothing has been reversed, and the rest of your earnings are not affected.

{sender_name}

Fraud review checklist

Before launch

  • Commission paid on sales, or on leads you have checked
  • Holding period longer than your refund window
  • Refunds and chargebacks reversed automatically, including after payout
  • Terms cover own purchases, recruiting yourself, coupon sites, brand bidding and claims
  • One code per partner, with the limits your checkout supports
  • Applications reviewed by hand
  • Recruiter commission on recruits' sales only, two levels at most

Every week

  • Refund and dispute rate by partner
  • Code sales without matching clicks, and where those orders came from
  • Click spikes against each partner's normal
  • Partner accounts sharing payout details
  • A search for your own brand name

Every review

  • Evidence checked before anyone is contacted
  • Commissions held, not reversed, while you ask
  • A question, not an accusation
  • The outcome and the reason, in writing

How Refficks handles it

Refficks is a new partner program platform. Its part here is to show you what is unusual, with the evidence, and leave the decision with you.

  • "Review recommended", never "fraud". When a partner's activity is unusual enough to look at, Refficks says so plainly: "Some activity here is unusual enough to be worth your eyes. It is not evidence of anything." There is no button that acts on it. You look at the partner, then decide.
  • The patterns above, watched for you. A possible self-referral (the buyer's email is the partner's own), customers sharing one connection, two partners paid into the same place, refunds well above the rest of the program, clicks well above a partner's normal, a lot of traffic with very few customers, and traffic suddenly coming from somewhere new. Some of these are context only and never raise a review on their own.
  • A review pauses the timer, nothing more. While a review is recommended, that partner's commissions do not approve themselves: "A review was recommended, so it waits for someone to look at it first." You can still approve them by hand, and nothing is taken back.
  • Where coupon sales came from. For sales made with a partner's code and no click, the partner's page lists the sites those shoppers arrived from. Refficks keeps no list of "bad" sites: "A partner who works with a deals site on purpose looks the same from here."
  • Codes with limits. Codes synced to your store can carry a minimum order, and limits such as once per customer on Shopify or first-time customers only on Stripe.
  • Unverified sales wait for a person. "Only a shopper's browser reported this sale, so it waits for someone to approve it." And a click reported by a browser is dated when Refficks receives it, so a planted click can never reach back to a sale that has already happened.
  • A warning when the tracker floods. If your site suddenly reports far more new people than usual in an hour, Refficks emails you, naming the partners their purchases would be credited to, before you approve anything.
  • Refunds and disputes reverse themselves, as a new entry beside the original, including after payout. A dispute is reversed when it opens.
  • Suspicion stays with managers. Risk findings are shown to managers and above, so a support teammate never sees what the product suspects about a partner.
  • No automation or AI can act on suspicion. Neither can suspend a partner, reject or reverse a commission, or approve a payout. In the product's own words about its AI: "Those are not things it is trusted not to do, they are things it has no way of doing."

Your rules on brand bidding and coupon sites go in each program's partner agreement, which partners accept in their portal, and every approval, rejection and suspension is recorded with who made it and when.

Start free. No card needed.

Sources

All read on October 16, 2026.