Affiliate fraud is any way of earning commission without genuinely causing a sale. Most programs see some of it. The good news is that a few settings stop the majority of it before you pay out a cent.
The core defence: only pay on real, server-tracked sales, and only after the refund window has passed.
1. Self-referrals
What it is. A partner buys through their own link to earn commission on their own purchase.
Warning signs. The buyer's email, name, or payment details match the partner.
How to stop it. Block commission when the customer is the partner, and state in your terms that self-purchases do not earn.
2. Refund and chargeback fraud
What it is. Orders placed to trigger commission, then refunded or charged back after the commission is paid.
Warning signs. One partner with a refund rate far above your average.
How to stop it. Set a hold period at least as long as your refund window, and reverse commission automatically when an order is refunded. Fraud that relies on refunds stops working.
3. Coupon poaching
What it is. A partner's discount code leaks to public coupon sites or browser extensions. Shoppers who were already buying find the code at checkout, and the partner gets credit for sales they did not cause.
Warning signs. A spike in code usage with no matching clicks, or traffic arriving from coupon sites.
How to stop it. Give partners unique codes, check where codes are being published, and make your terms say codes may not be posted on coupon sites.
4. Cookie stuffing
What it is. A tracking cookie is forced onto visitors who never clicked a partner link, using hidden images, pop-unders, or redirects. Later purchases get credited to the fraudster.
Warning signs. Huge click counts with almost no time on site, or clicks that do not come from the partner's stated channels.
How to stop it. Require a real click on a tracked link, record click IDs on your own domain, and investigate partners whose click volume does not match their audience.
5. Bot and fake clicks
What it is. Automated traffic inflating clicks, usually where you pay per click or per lead.
Warning signs. Clicks from data-centre IP ranges, identical devices, odd hours, or near-zero conversion.
How to stop it. Pay on sales, not clicks, and filter known bots and link-preview crawlers from click counts.
6. Fake leads
What it is. Junk signups in pay-per-lead programs.
Warning signs. Leads that never activate, disposable email addresses, many signups from one source in minutes.
How to stop it. Define a qualified lead precisely, such as a verified email plus a completed action, and pay only for that.
7. Brand bidding
What it is. A partner bids on your brand name in search ads, catching customers who were already searching for you, and takes commission on sales you would have made anyway.
Warning signs. Partner traffic coming from paid search for your own brand terms.
How to stop it. Prohibit brand-term bidding in your terms and check search results for your brand regularly.
The settings that stop most fraud
| Setting | What it stops |
|---|---|
| Server-side sale tracking from Stripe or Shopify | Fake conversion pixels, inflated sales |
| Hold period at least as long as refunds | Refund and chargeback fraud |
| Automatic refund clawback | Paying commission on returned money |
| Self-referral blocking | Partners buying through their own link |
| Unique codes per partner | Coupon poaching, shared codes |
| Pay on sales, not clicks | Bot traffic and click farms |
How Bridgly helps
Bridgly credits partners only from tracked sales reported by Stripe, your app, or your server, holds commission for your chosen period, and claws it back automatically on refunds. Link-preview bots and crawlers are not counted as clicks. Each partner's clicks, sales, revenue, and commission sit on one page, so outliers are easy to spot.
The short version
- Pay on real, server-tracked sales, not clicks or pixels.
- Hold commission until refunds clear, and reverse it on refunds.
- Block self-referrals and keep partner codes off coupon sites.
- Ban brand bidding and watch for click patterns that do not match a partner's audience.
See how Bridgly protects partner programs → · How affiliate tracking works
Frequently asked questions
- What is affiliate fraud?
- Affiliate fraud is any attempt to earn commission without genuinely driving a sale: fake or bot clicks, buying through your own link, forcing tracking cookies onto visitors, hijacking discount codes, or placing orders that are later refunded or charged back.
- How do I prevent affiliate fraud?
- Track sales server-side from your payment system, hold commission until your refund window passes, reverse commission automatically on refunds, block self-referrals, keep partner discount codes off public coupon sites, and review partners whose clicks or conversion rates look abnormal.
- What is cookie stuffing?
- Cookie stuffing is when a fraudster forces an affiliate tracking cookie onto a visitor's browser without them clicking a real link, for example with hidden images or pop-unders. If that visitor later buys, the fraudster gets credit for a sale they did not drive.
- What is a commission hold period?
- A hold period is the time commission waits after a sale before it becomes payable. Setting it to at least your refund window means refunded and fraudulent orders are reversed before any money is paid out.
Read more
Troubleshooting · 2 min read
Why links break inside Instagram, TikTok and other in-app browsers
A link that works fine in Safari can fail inside a social app's built-in browser. Here is what those environments do differently, which failures you can fix, and which you have to design around.
Troubleshooting · 2 min read
Firebase Dynamic Links is gone: what to migrate to
Firebase Dynamic Links shut down on 25 August 2025 and existing links now return 404. Here is what actually replaced it, what you lose with each option, and how to migrate without breaking links already in the wild.
Troubleshooting · 4 min read
In-app browsers are where install links break
Instagram, TikTok, and LinkedIn open links in their own embedded browsers, which handle redirects and URL schemes inconsistently. Here's what breaks, how to detect it, and how to build a link that survives.