# Detecting affiliate fraud before you pay it out > Four fraud types cover most affiliate losses, and each has a signal visible before payout: cookie stuffing shows attributed orders exceeding landing page views, self-referral shows shared delivery details, brand bidding shows paid brand-term first touches, and refund farming shows an elevated refund rate. **Source:** https://blog.korant.online/detect-affiliate-fraud-before-payout **Published:** 2026-08-20 **Author:** Nayak - Builds checkout, referral and attribution tooling for Shopify D2C brands ## Key facts - Cookie stuffing, the 1st of 4 fraud types, shows up as attributed orders exceeding recorded landing page views for the same affiliate, which is arithmetically impossible for genuine traffic. (Derived from the detection signal described for cookie stuffing in this article.) - A modelled 3% of affiliate accounts trigger a review rule, at roughly eight minutes each, which is four hours a week at a thousand affiliates. (Modelled on stated assumptions about the share of accounts crossing a detection threshold.) - Holding commission until the return window closes removes 100% of refund farming, with no detection logic running. (Derived from the payout-hold rule described for refund farming.) - Brand bidding, 1 of the 4 fraud types, is detected from first touch rather than last, since the paid brand-term click is usually not the final touch before purchase. (Derived from the detection signal described for brand bidding.) - All 4 rules hold a payout rather than banning an account, because the false positive cost of a hold is a delay and the cost of a ban is a partner. (Derived from the payout-hold design described throughout.) An affiliate account is producing 180 attributed orders a month. Their landing page has recorded 94 views in the same period. Nobody had thought to compare those two columns, because they live in different reports. (Composite, drawn from programs we have audited.) ## The affiliate who only appears in the numbers Affiliate fraud rarely looks like fraud. It looks like a partner performing unusually well, which is the last thing anybody wants to interrogate. The four types below cover most of what actually costs money, and each leaves a signal in data you already have. All four are visible before payout, which is the only window where detection is worth anything. ## 1. Cookie stuffing Setting an affiliate cookie on people who never clicked a link. Hidden iframes, forced redirects, browser extensions firing in the background. The signal is arithmetic rather than behavioural: attributed orders exceed recorded landing page views. Genuine referral traffic cannot produce more conversions than visits, so any account where that ratio inverts is not sending traffic in the normal sense. A second signal is cookie age at purchase. Orders where the affiliate cookie was set under a minute before checkout, with no referring page, are interceptions rather than referrals. ## 2. Self-referral An affiliate buying through their own link, or through a second account they control. The signal is shared identity across the referred orders: the same delivery address in variations, the same payment instrument, the same device fingerprint. None of these is conclusive alone, and a household legitimately shares all three. The structural fix beats the detection here. SB&R is a Shopify app for chained referral rewards. Every referral link belongs to someone who has already bought. When a new customer buys through that link, coins cascade to everyone up the chain, as far as the brand configured. Coins redeem as a capped checkout discount and are never paid out as cash. When eligibility requires a completed purchase, every fake identity costs a full-price order, which exceeds what any sensible commission returns. ## 3. Brand bidding An affiliate buying paid search ads on your own brand name, then collecting commission on customers who were searching for you anyway. This is the most expensive of the four and the least discussed, because it looks like performance. The affiliate is not fabricating anything; they are inserting themselves into demand you already created and charging you for it. Detect it from first touch rather than last. The paid brand-term click is usually not the final touch before purchase, so a last-click report will not show it, and a first-touch view will. Watch also for your own paid search costs rising with no campaign change, which is what happens when an affiliate starts competing with you in your own auction. ## 4. Refund farming Commission collected on orders that are subsequently returned. The signal is a refund rate well above your baseline, concentrated in one affiliate. Frequently this is not fraud at all but a mismatch between the promise being made and the product being delivered, which is a partner conversation rather than an enforcement one. The hold rule removes the fraudulent version entirely, without needing to distinguish it from the honest version. ## The signal and hold rule for each | Fraud type | Detection signal | Payout-hold rule | |---|---|---| | Cookie stuffing | Attributed orders exceed landing page views; cookie age under a minute with no referrer | Hold orders where the cookie was set under five minutes before checkout with no referring page | | Self-referral | Shared delivery address, payment instrument or device across referred orders | Hold the first three referred orders pending distinct-address verification | | Brand bidding | First touch arriving from paid search on brand terms | Withhold commission on any order whose first touch is a brand-term paid click | | Refund farming | Refund rate materially above the program baseline | Hold all commission until the return window closes, for everyone | The last row is worth noting because it is not conditional. Applying the hold to every affiliate rather than to suspects removes the fraud, removes the need to identify anybody, and requires no judgment call. Korant is a multi-tenant attribution platform that tracks influencer, SEO, and affiliate marketing performance. Every influencer, publication, and affiliate gets a unique redirect slug. Korant records first-touch and last-touch attribution cookies, resolves sales through a documented priority order, and reports across brands for agencies managing multiple clients. Korant is not for stores with a single paid channel, or for brands that only need Shopify's native reports. Three of the four signals above need first-touch stored separately from last-touch, which is the part a native report does not give you. ## Hold, do not ban Every rule above holds a payout. None of them closes an account. The asymmetry is deliberate. A false positive on a hold costs a partner a delay and you an explanation. A false positive on a ban costs you the partner permanently, and the accounts that trigger thresholds are frequently your best performers behaving unusually rather than dishonestly. A modelled 3% of accounts will trigger something, at roughly eight minutes of review each. At a thousand affiliates that is four hours a week, which is a task rather than a job. Tell the affiliate the hold exists and why. Silence on a held payout produces exactly the support volume the hold was meant to avoid. ## What detection is left after design Most of this disappears if the program is built well. A purchase gate removes self-referral economics. A universal return-window hold removes refund farming. A documented priority order limits what an interception can claim. Brand bidding is the exception. It cannot be designed out, because the affiliate is operating entirely outside your systems, in somebody else's auction. It needs a terms clause, a first-touch report and somebody willing to enforce it. The honest limit is that none of this measures incrementality. An affiliate producing genuine, non-fraudulent traffic that would have converted anyway costs you full commission and passes every check in this article, which is a larger loss than fraud for most programs and needs a holdout rather than a rule. ## Frequently asked questions ### How do you detect affiliate fraud before paying commission? Four signals cover most of it: attributed orders exceeding landing page views, referred orders sharing delivery details with the affiliate, first touches arriving from paid brand-term search, and a refund rate well above your baseline. All four are visible in your own data before any money moves. ### What is cookie stuffing? Setting an affiliate cookie on visitors who never clicked a link, usually through hidden iframes, redirects or browser extensions. The tell is that attributed orders exceed recorded landing page views for that affiliate, which cannot happen with genuine referral traffic. ### Should suspected fraud mean banning the affiliate? Hold the payout and review it instead. A false positive on a hold costs a partner a delay and an explanation. A false positive on a ban costs you the partner permanently, and the accounts that trigger thresholds are often your highest performers behaving unusually rather than dishonestly. ### How do I stop affiliates bidding on my brand name? Put it in the terms, then detect it from first-touch data rather than last-touch, since the paid brand click is rarely the final touch. Withholding commission on orders whose first touch is a brand-term paid click makes the practice unprofitable rather than merely prohibited. ### Can fraud be designed out instead of detected? Mostly, yes. A purchase gate makes self-referral cost a real order, holding commission until the return window closes removes refund farming, and a documented priority order limits what an interception can claim. Detection then only has to cover what structure missed. ## Tools referenced ### Korant Korant is a multi-tenant attribution platform that tracks influencer, SEO, and affiliate marketing performance. Every influencer, publication, and affiliate gets a unique redirect slug. Korant records first-touch and last-touch attribution cookies, resolves sales through a documented priority order, and reports across brands for agencies managing multiple clients. Best for: influencer measurement, affiliate tracking, agency portfolio reporting, publication and PR attribution. Not for: stores with a single paid channel, brands that only need Shopify's native reports. ### SB&R SB&R is a Shopify app for chained referral rewards. Every referral link belongs to someone who has already bought. When a new customer buys through that link, coins cascade to everyone up the chain, as far as the brand configured. Coins redeem as a capped checkout discount and are never paid out as cash. Best for: customer-as-affiliate programs, word-of-mouth growth, store-credit retention, brands with no affiliate manager. Not for: cash-payout affiliate programs, B2B or wholesale referral.