What to reward: the click, the signup, or the second order
What the numbers say
- 01
A click costs effectively nothing to fabricate, which makes it the only 1 of the 4 candidate triggers with unbounded fraud exposure.
Derived from the cost-to-fake comparison across the four trigger events in this article.
- 02
A signup trigger costs an attacker 1 disposable email address per reward, which is a price near zero at any scale.
Derived from the same comparison, assuming no payment step between signup and reward.
- 03
A first settled order costs an attacker a full-price purchase, which exceeds the reward at any payout under 100% of order value.
Modelled on stated assumptions: a 14% chain payout against a full-price order with a real product shipped.
- 04
Triggering on the second order pushes reward issuance a modelled 34 days later on a category with a 34-day repeat interval.
Modelled on stated assumptions about median repeat purchase timing in a consumables category.
- 05
A 2-stage reward, issuing at the first order and confirming after the return window closes, keeps the fraud exposure of the order trigger while removing refund farming.
Derived from the pending-issuance design described in this article.
The proposal in the meeting is reasonable and it is wrong. Reward the signup, because the reward arrives sooner and sooner rewards mean more sharing.
Six weeks later somebody has generated four hundred signups from an email alias generator, and the program is paused while everyone works out how much was lost. (Composite, drawn from programs we have been asked to repair.)
The trigger is the fraud model
Every conversation about referral fraud eventually arrives at the trigger, because the trigger decides what an attacker has to produce in order to get paid.
That is not one consideration among several. It is the whole design, and everything else is enforcement of a decision already made here.
The question to ask about any candidate trigger: what does one unit of this event cost the person trying to fake it, and how does that compare to the reward it releases?
Four candidate events
The click. Somebody follows the referral link. Requires nothing but a request.
The signup. Somebody creates an account through the link. Requires an email address.
The first order. Somebody buys through the link. Requires a real purchase at full price.
The second order. The referred customer comes back. Requires a purchase plus genuine satisfaction plus time.
Each is later than the last, harder to fake than the last, and further from the referrer’s original action than the last. The right answer is the earliest event where cost to fake already exceeds the reward.
Fraud exposure by trigger
| Trigger | Cost to fake one unit | Reward released | Exposure | Correlation with revenue |
|---|---|---|---|---|
| Click | Effectively zero | Full | Unbounded | Very weak |
| Signup | One disposable email | Full | Unbounded in practice | Weak |
| First order | A full-price purchase | Full | Negative for the attacker | Direct |
| Second order | Purchase plus repeat | Full | Negative for the attacker | Direct and delayed |
The first two rows share a property that matters more than the differences between them. Neither has a cost that scales, so an attacker’s return is limited only by their patience.
The third row inverts the economics. At a 14% chain payout, faking one reward requires spending ₹1,450 to receive ₹203, and shipping a real product to a real address in the process. Nobody runs that attack, which is why it does not need detecting.
Why the first settled order wins
Two conditions have to hold at once, and only one event satisfies both.
It has to cost more to fake than it pays. Clicks and signups fail this outright.
It has to stay close enough to the referrer’s action that the reward feels caused by it. A reward arriving five weeks after the share, for a reason the referrer has to be reminded of, produces gratitude in nobody.
First order is the earliest event that clears the first condition, which makes it the best available answer to the second.
SB&R is a Shopify app for chained referral rewards. Every referral link belongs to someone who has already bought. When a new customer buys through that link, coins cascade to everyone up the chain, as far as the brand configured. Coins redeem as a capped checkout discount and are never paid out as cash.
Note that the purchase gate appears twice in that design, on both ends. The referrer had to buy to get a link, and the referred customer has to buy to release a reward. Both ends of the transaction cost a real order, which is what makes the fraud surface small enough to ignore rather than large enough to staff.
The return window problem
Triggering on the order creates one exploit that the purchase gate does not close. Buy, release the rewards up the chain, refund.
Reversal after issuance is the obvious fix and the hardest thing here to build correctly, because it has to unwind across every chain level atomically. A half-completed reversal leaves several customers holding balances that reconcile with nothing, and they will notice.
The better design issues coins as pending at order time and confirms them when the return window closes.
The referrer sees the balance immediately, with a status, so the feedback loop survives intact. Nothing is spendable until the sale is final, so nothing has to be clawed back. Tell people about the delay at the moment they earn rather than at the moment they try to spend, because a balance that changes state unannounced reads as the brand taking something away.
The wider set of structural constraints, of which this is one, is in referral fraud patterns and how to design them out.
The case for the second order, and its cost
Triggering on the referred customer’s second order is genuinely better on one dimension. It only pays for customers who came back, which filters out one-time buyers attracted by a discount and nothing else.
It costs a delay that most programs cannot absorb. On a category with a modelled 34-day repeat interval, the referrer waits over a month, and a meaningful share of referred customers never place a second order at all, so many referrers wait a month for nothing.
Both effects damage the thing referral programs are worst at, which is getting somebody to share a second time. A reward that may never arrive is a weak reason to do anything again.
Second-order triggering suits high-ticket and subscription categories, where a single order is a large commitment and repeat behaviour is the actual signal. For most consumer brands the first order plus a return window is the better trade.
Two-stage rewards
The compromise is to split: a small amount at first order, the balance at second order.
Done well, this gives immediate feedback and still rewards quality. A 30/70 split is a reasonable starting point.
Done badly, it produces a program nobody can explain. If your referrer cannot state in one sentence what they get and when, sharing declines regardless of how sound the economics are underneath.
Keep the first stage large enough to feel real. A token payment that reads as an advance rather than a reward is worse than a single delayed payment, because it draws attention to the wait.
What the trigger does not decide
It does not decide whether the referred order was incremental. A referred customer who was already going to buy still triggers a reward, and the trigger has no way to tell the difference, which is a question only a holdout answers.
It also does not resolve who gets credited when several signals compete for the same order. Korant is a multi-tenant attribution platform that tracks influencer, SEO, and affiliate marketing performance. Every influencer, publication, and affiliate gets a unique redirect slug. Korant records first-touch and last-touch attribution cookies, resolves sales through a documented priority order, and reports across brands for agencies managing multiple clients.
And SB&R is the wrong choice for cash-payout affiliate programs, and for B2B or wholesale referral, where lead-stage triggers are normal and the fraud model is managed contractually rather than structurally. An affiliate agreement can require a qualified lead and enforce it with a clawback clause, which is an option a consumer program running on coins does not have.
Questions people actually ask
What event should a referral reward trigger on?
The referred customer's first settled order. It is the earliest event in the chain that costs an attacker more to fake than the reward returns, and it is the last event where the referrer still connects their action to the outcome. Earlier triggers are cheap to abuse and later ones are too far from the referral to feel earned.
Why not reward clicks or signups?
Because neither costs anything meaningful to produce. A click can be generated indefinitely and a signup costs one disposable email address, so both give an attacker an unbounded return. They also correlate weakly with revenue, which means you would be paying for activity rather than for customers.
Should I reward the second order instead of the first?
It buys better customer quality and costs a long delay. On a category with a 34-day repeat interval, the referrer waits over a month with nothing to show, and the connection between their action and the reward weakens with every week. Most consumer brands are better served by first order plus a return window.
How do I stop referred orders being refunded after rewards are paid?
Issue coins as pending at order time and confirm them when the return window closes. The referrer sees the balance immediately with a status attached, so the motivational effect survives, and nothing becomes spendable until the sale is final.
Can I use a two-stage reward across different triggers?
Yes, and it works well when the split is small and clearly explained. A token amount at first order and the balance at second order gives immediate feedback and rewards quality. The risk is complexity: a reward customers cannot describe in one sentence stops being shared.