Affiliate fraud patterns in 2026 and how to detect them

The common affiliate fraud patterns are self-referral, click bursts, cookie stuffing, coupon leaking, brand-term bidding and refund abuse. Each leaves a signal you can check in your own data: matching buyer and partner identities, click volume far above a partner's normal, clicks with no engagement, coupon sales with no clicks, paid-search clicks on your brand name, and refund rates several times the program average. Cookie stuffing is not theoretical: eBay's top affiliate pleaded guilty to wire fraud in a cookie-stuffing scheme, and court documents showed $28 million in commissions [1]. Two structural choices limit the damage of everything else: pay commission only on paid invoices, and hold it for at least as long as your refund window, 30 days by default in RelayWonder.

Why affiliate fraud looks different in a subscription program

In a pay-per-click or pay-per-lead program, fraud pays the moment a fake click or form fill is recorded. In a subscription program that pays commission on paid invoices, a click is worth nothing on its own. Fraud only pays when a real payment succeeds and the commission survives the hold. That changes which patterns matter. Pure click fraud becomes a nuisance that distorts your reports. The expensive patterns are the ones that attach a partner to a real paying customer: either a customer the partner created (self-referral, refund abuse) or a customer who would have bought anyway (cookie stuffing, coupon leaking, brand bidding).

The second category is the one most programs underestimate. Nobody is stealing money in the obvious sense; the customer paid, the product was delivered. But you paid commission for a customer the partner did not bring, which means your real cost of partner acquisition is higher than your dashboard says, and honest partners lose attribution they earned. The table below lists each pattern with the signal to check and a response.

How do you detect self-referral?

Self-referral is a partner buying through their own link or coupon to collect commission on their own subscription. It is the most common pattern in small programs because it is the easiest. Check three things for every new attributed customer: does the buyer's email match the partner's after normalization, does the card fingerprint match a card the partner has used, and does the signup IP match the partner's recent login IPs.

Normalization matters. For personal Gmail accounts, dots in the address do not change where mail is delivered, so jane.doe@gmail.com and janedoe@gmail.com reach the same inbox [6]. Compare addresses with dots removed for Gmail. A match on any of the three signals is enough to reverse the commission. Many partners self-refer once by mistake, buying the product they plan to review; a polite note and a reversal is usually the right first response, and removal is for repeat cases. RelayWonder flags self-referral automatically; whatever tool you use, write the rule in your terms so the reversal is not a surprise.

How do you spot click bursts?

A click burst is a sudden jump in a partner's clicks that does not come with a matching jump in signups. Sometimes it is innocent: a video goes viral, a newsletter lands in a big inbox. Sometimes it is bots, a click exchange, or cheap paid traffic bought to look busy. The signal is the ratio between today and the partner's own normal, not an absolute number, because a large creator's ordinary day is a small partner's burst.

A reasonable starting rule: flag any day where a partner's clicks exceed ten times their trailing 14-day median and exceed 200, and where signups stay near zero. A genuine viral moment produces signups in proportion; a bot burst does not. Because commission is paid on invoices, a burst costs you nothing directly. The harm is indirect: it distorts conversion rates and EPC in your reports, and a partner who games clicks may also try something that does cost money. RelayWonder flags click bursts; exclude flagged days from your partner metrics until you have looked.

What is cookie stuffing and how do you detect it?

Cookie stuffing sets a partner's referral cookie in a visitor's browser without the visitor clicking a partner link, usually by loading the tracking URL invisibly from an unrelated page. When that visitor later buys for their own reasons, the partner gets the commission. The eBay case is the best-known example: MarTech reported in May 2014 that Shawn Hogan, eBay's top-earning affiliate, received credit for sales from computers that had cookies placed on them by widgets he created rather than from users who clicked his links, earned $28 million in affiliate commissions according to court documents, pleaded guilty to one count of wire fraud, and was sentenced to five months in federal prison and a $25,000 fine [1].

The cost to you is commission on customers you would have had anyway. A worked example shows how fast it adds up. Suppose a stuffer forces your tracking URL on 50,000 visitors a month across unrelated pages, and 0.2% of them happen to subscribe within your 60-day window for reasons that have nothing to do with the partner. That is 50,000 × 0.002 = 100 customers a month. At about $90 of commission per customer (20% of roughly $450 in first-year revenue), the stuffer collects about $9,000 a month for nothing.

The signals come from the shape of the traffic. Stuffed clicks have no engagement: the page is never viewed because the request was made invisibly, so a first-party tracking script on your site sees a referral cookie arrive with no page view, scroll or second page. Click volume is very high but the click-to-signup rate is far below the program average, while the partner still collects a normal number of conversions, often from customers who arrived by typing your URL or searching your brand weeks later. Ask the partner where their traffic comes from; a real publisher can show you the pages. A first-party cookie written by your own script on your own domain, as RelayWonder's rw_ref cookie is, also makes it harder to stuff from a third-party page, because the cookie is set when the visitor actually lands on your site rather than by loading an image or iframe elsewhere.

How do coupon codes leak, and what limits the damage?

Personal coupon codes are a good attribution tool: they credit a partner even when the buyer never clicks, which catches sales from podcasts, videos watched on a TV and word of mouth. They also leak. A partner, or a visitor who saw the code, posts it on a coupon site. Buyers who were already at your checkout search "brand coupon", find the code and use it. The partner is credited for a customer who was not theirs, and you pay both the discount and the commission.

The signal is the share of a partner's sales that come from the coupon with no click. For a podcaster, a high coupon-only share is normal, because listeners cannot click. For a blog that links every mention, 70% or more coupon-only sales, especially in bursts that do not follow the partner's publishing dates, suggests the code is circulating elsewhere. Search for the code itself; leaked codes are usually easy to find.

Stripe gives you several controls on promotion codes. A code can be restricted to first-time transactions, given a minimum order value, an expiration date, and a maximum number of redemptions; it can be archived by setting it inactive, and a new code can then be created with the same string if needed [2]. In practice the most useful response to a leak is to archive the leaked code, issue the partner a new one, and remind them that posting codes on coupon sites is not allowed under your terms. A first-time-only restriction also stops existing customers from using a partner code on a plan change.

Is brand-term bidding by affiliates fraud?

Brand-term bidding is a partner buying search ads on your brand name and sending the clicks through their affiliate link. The people searching your brand were already looking for you; the partner inserts themselves between the search and your site and collects commission on customers you would have received through your own organic or paid result. Whether it is fraud depends entirely on your terms. Some programs allow it; most SaaS programs prohibit it, because it raises your own ad costs and pays commission on demand you created.

The search platform will not enforce this for you. Google Ads' trademark policy lists using trademarks as keywords among the uses Google does not restrict; a trademark owner can file a complaint about trademarks used in ad text, and restrictions apply to the ad itself, not only the landing page [3]. So if you want to prohibit brand bidding, say so explicitly in your program terms: "Partners may not bid on our brand name, misspellings of it, or our domain in any search ad platform, and may not use our brand name in ad text." Then check. Search your brand name from a few regions; look at partner clicks that carry a paid-search click identifier; and look for partners whose clicks convert almost instantly, which is typical of someone who was already searching for you.

How does refund abuse work, and why do hold periods stop it?

Refund abuse is a partner sending customers who pay, generate commission, and then refund or dispute. Sometimes the partner is buying subscriptions with their own or stolen cards and reversing them; sometimes they are pushing low-intent buyers with misleading claims who then ask for their money back. Stripe supports full and partial refunds [5], and a dispute reverses the payment through the card network and debits your balance for the amount and the dispute fee [4]. In both cases, invoice-level attribution writes a negative ledger row that cancels the commission. The question is only whether the commission was already paid out when the reversal arrived.

That is what the hold period decides. Take a partner who self-refers 20 annual plans at $490, for $98 of commission each, $1,960 in total, and then refunds them. The table shows what you lose under three hold periods depending on when the refunds arrive. A refund that lands during the hold produces a negative row before anything becomes payable, so nothing is lost. A refund that lands after payout produces a negative balance that RelayWonder carries into the next batch; if the partner has no future earnings, that balance is not recovered.

Two practical rules follow. Set the hold to at least your refund window; if your annual plan has a 30-day money-back guarantee, 30 days covers it, and a 60-day guarantee needs a 60-day hold. And watch each partner's refund and dispute rate against the program average. A partner whose customers refund at three times the average deserves a conversation and, if it continues, a longer hold or removal. The minimum payout, $50 by default in RelayWonder, also helps a little: a fraudster with a handful of small commissions never reaches a payout at all.

Why invoice-level attribution limits damage

Most of what makes affiliate fraud expensive in other models is absent when commission is calculated from paid invoices. A fake click pays nothing. A fake signup pays nothing. A trial that never converts pays nothing. A customer who churns after one month stops generating commission rows. A refund or a dispute writes a negative row automatically. What remains are the attribution-theft patterns, stuffing, leaking and brand bidding, where a real customer is credited to the wrong partner, and the identity patterns, self-referral and refund abuse, where the partner is the customer.

The append-only ledger matters here too. Because nothing is edited or deleted, every reversal is a visible row with a reason. When you remove a partner for fraud, you can show them, and yourself, exactly which invoices were reversed and why. That record is what makes a fraud decision defensible when a partner disputes it.

A weekly fraud review in five steps

1. Review every self-referral flag: compare normalized emails, card fingerprints and IPs. Reverse matches and send a short note.
2. Review click-burst flags: compare each flagged day with signups. Exclude bot bursts from reports; leave genuine viral days in.
3. Sort partners by coupon-only share of sales. For any partner far above their content type's norm, search the code and rotate it if it has leaked.
4. Search your brand name and common misspellings from two or three regions and note any ads that route through a partner link.
5. Sort partners by refund and dispute rate. For any partner above three times the program average, look at the customers and decide whether to extend their hold.

This takes under an hour a week for most programs, and the thresholds should change as you learn. Start with the illustrative numbers above, record each flag and what you found, and tighten or loosen a threshold when it produces too many false alarms or misses something you later discover.