Affiliate fraud detection: how to spot ad hijacking and bots

Affiliate fraud detection comes down to one question: did the affiliate actually create this sale? This guide gives you the eight most common types of affiliate fraud with the signals you can see yourself, a 10-point checklist for a suspicious sale, and what to do within the approval period.

To assess an affiliate before they join, see the guide to choosing affiliates; if you are new to the subject, start with the guide to affiliate marketing.

You will see dramatic figures for how much affiliate traffic is fake. Many come from vendors that sell tools against it, and none of them tell you anything about your program. Your own numbers do.

1. 01

   Filtered out at the click

   Known bots and crawlers, clicks from the large cloud providers and an affiliate's own clicks while logged in do not count, and repeat clicks within a short time from the same visitor on the same affiliate's link count only once. You see the number of filtered clicks under Results → Summary in your store dashboard.

2. 02

   Visible in the sale's trail

   Every sale shows the affiliate's page, the measured referrer, the landing page, device, country and the time from click to sale. Under Results → Clicks & sales you can follow each click to the sale. Affiliate tracking explains how a click is measured.

3. 03

   Decided by you

   The sale stays pending for the program's approval period. This is where you reject with a reason, and where you block the affiliate if you see a pattern. When the period is over, the sale is approved automatically.

The first layer asks nothing of you. The other two do, and they are what the rest of this guide is about. Remember that a signal is not proof: a click without a referrer can come from a Safari user, and a quick purchase can come from a customer who had already made up their mind. Fraud shows up as a pattern across several sales.

The table brings together eight types of affiliate fraud. For each one you get the signal you can see in your own dashboard, what Affilyflow does at the click, and what you do within the approval period. The sections below cover the most important ones in the same order.

A fraudulent sale costs you the total price you have set per sale: the affiliate's commission plus the network fee, which is 20 % of the price. With ad hijacking and coupon sites the sale is real – you simply pay for a customer you would have had anyway. With fraudulent orders paid with stolen cards you lose the goods as well.

An example with the calculator's starting values: an order of DKK 500 excluding VAT and a total price of 20 % costs DKK 100 per sale – DKK 80 to the affiliate and DKK 20 in network fee. If an affiliate hijacks 20 sales a month from your brand searches, that is DKK 2,000 a month excluding VAT for sales you should not have paid for.

Stores in Denmark also have DKK 25 in VAT per sale deducted from their balance, but a VAT-registered store can normally reclaim it as input VAT. The maths behind the price is on the payments page, and what a sale costs in other channels is covered in the guide to ecommerce marketing channels.

Ad hijacking is when an affiliate copies your own search ad: your headline, your offers and your domain as the displayed URL. The affiliate bids on your brand name, so the ad appears above yours or instead of it. The click runs through the affiliate's link and lands on your site, so the customer notices nothing – but the sale triggers commission, even though the customer was already searching for you.

It is hard to spot because the ad is often hidden from you in particular. It can be set to show only outside your city, outside office hours or only on mobile, so you do not come across it when you search yourself. And if you run brand ads yourself, you are now bidding against the hijacker for your own name, which can push up what you pay per click.

What is affiliate hijacking?

The term covers the same thing and a bit more: any way of capturing traffic that was already yours, for example through a misspelled domain or a browser extension that swaps the link. Brand bidding is the milder version: the affiliate bids on your name, but with their own ad and their own page. You can allow or forbid that. With ad hijacking, the affiliate impersonates you, and that has no place in any program.

Search for your brand name yourself – and keep the evidence

1. Search in a private window on both computer and phone – for your brand name, your domain and combinations such as “discount code”, “offer” and “free shipping”.
2. Search at different times, including evenings and weekends. If you have a Google Ads account, the Ad Preview and Diagnosis tool shows the ads for a search term in another city without your search counting as an impression.
3. Look up the advertiser in Google's Ads Transparency Center. It shows who is behind an ad and which other ads the same advertiser runs.
4. Take a screenshot showing the search term, time and place before you click.
5. Click the ad from a phone. If ?afid= is in the address when you land in your store, the click went through an Affilyflow affiliate link – and under Results → Clicks & sales you find the click with time, source and affiliate.

The click in step 5 is your best evidence, because it ties the ad to a specific affiliate. Save it together with the screenshot before you reject sales or block the affiliate.

What an ad click ID tells you

When someone clicks a Google Ads ad, Google normally appends a click ID to the URL – gclid, gbraid or wbraid – and Microsoft Ads appends msclkid. Some advertisers also tag the click themselves with utm_medium=cpc. Affilyflow's rule watch records those markers on every click and also checks whether the click came from a known coupon or cashback site.

A marker tells you the click came from an ad – not which keyword the affiliate bid on. We cannot see the search term. If your program forbids paid search entirely, an ad click is a clear breach. If it only forbids your brand name, the ad may be allowed.

Today the rule watch runs in monitoring mode: it records breaches but rejects nothing, so you reject the sale yourself with a reason. Once it enforces the rules, a clear breach earns no commission, and Affilyflow decides an ad click in a program that only forbids the brand name – the sale is then marked “Affilyflow reviewing”, and you do not need to do anything.

Ad hijacking solutions: monitoring tools and trademark complaints

If you have many brand searches, it can pay to let a tool handle ad hijacking detection for you. Brand protection tools search for your brand name and its variants from many locations around the clock and typically save screenshots and the chain of redirects an ad runs through. They are not free, so work out how much brand traffic you have to protect before you buy one.

If you have a registered trademark, you can file a trademark complaint with Google and Microsoft about ads that use it in the ad text or impersonate you. With Google, a complaint typically only stops use in the ad text – not the use of your name as a keyword – and a complaint does not remove the commission on sales that have already happened. That is why the rule also has to be in your program.

Brand bidding: write the rule into your program

Under the program terms you choose the paid search rule: allowed, not on your brand name, or not at all. New programs default to “not on your brand name”. If you allow paid search on other terms, write in the guidelines that your brand name must be added as a negative keyword, that the ad may not show your domain as its display URL, and that affiliates may not copy your ad text.

If you tighten a rule, clicks only count as breaches 14 days after you save it, so affiliates have time to adjust. A relaxation applies at once. That is fair to those already promoting you – and it means you should write the rule before the problem appears. Every click is judged by the rules that applied when it happened.

Cookie stuffing is when an affiliate's link is loaded in the browser of a visitor who never clicked it – in a hidden image, an invisible frame, a pop-under window or a browser extension. The click is now stored in the visitor's browser, and when the customer later buys within the cookie window, it looks as though the affiliate brought in the sale. How long a click counts is explained in the guide to affiliate cookie length.

Ad hijacking and cookie stuffing share a goal: both take the credit for a customer who was already yours. The difference is that with ad hijacking the customer actually clicks – on an ad that looks like yours. With cookie stuffing nobody clicks. Cookie stuffing is explicitly forbidden in section 7 of our terms, and so is misleading marketing.

Look for these signals in the sale's trail:

• The time from click to sale is a few seconds – the customer was already in the checkout when the click arrived.
• The landing page is the cart or the checkout rather than a product or an article.
• The affiliate has many clicks and few sales compared with the other affiliates in your program.
• The referrer does not belong to any of the affiliate's sites, or it changes from click to click.

A single sale without a referrer proves nothing. Safari and some apps only send the domain, and a missing referrer is not the same as direct traffic. It is the pattern over many clicks that counts.

Click fraud is clicks without a real buyer behind them – from bots, scripts or click farms. If you pay per sale, a fake click does not cost you commission by itself, but it distorts your numbers: the conversion rate drops, and you can no longer see which affiliates actually sell.

Known bots and crawlers are not registered as clicks and get no attribution – that is the bot filter. Clicks from cloud servers at AWS, Google Cloud, Azure, Oracle, DigitalOcean and Linode do not count either, nor do excessive clicks from the same visitor on the same affiliate's links. Repeat clicks within a short time count only once, and clicks by a logged-in affiliate on their own links do not count. The customer is always sent on to the store, so a real visitor never notices.

The hardest to catch are SEO tools' crawlers, which fetch affiliate links to map the web, and traffic disguised as mobile users. Two patterns keep coming back:

• A crawler fetches a link, and shortly afterwards “direct” clicks without a referrer arrive from changing countries.
• A bot switches its disguise between different phones and browsers from click to click.

That is why a direct click without a referrer does not count when an SEO crawler fetched the same link shortly before or after – nor when the browser's own details contradict each other. A link preview in a chat app is not treated as a crawler, so a click on a link shared in a message still counts.

No list catches every bot. Residential proxies, VPNs and click farms with real phones can get through, and so can bots that imitate people well enough. That is why you only pay for sales, and why every sale starts as pending.

Fake sales and stolen cards

A sale proves a human, but not that the payment is genuine. Fake sales are harder to catch, because they look like real ones. A purchase with a stolen card usually ends in a dispute, also called a chargeback, and if a Stripe payment is disputed, the commission is rejected automatically.

If you pay per lead, fake sign-ups are the biggest risk. Look for these signals:

• Many leads in a short time from the same affiliate.
• Leads that never reply, open an email or buy.
• Repeated patterns in the email addresses, such as the same domain or names with consecutive numbers.

Check that the sign-ups are genuine, and reject the fake ones before the approval period ends.

The pattern is familiar: a customer has the items in the cart, sees the discount code field, searches for your brand name plus “discount code” and lands on a coupon site. The “Show code” button opens the affiliate's link, and the customer buys. You pay commission for a customer who was already in the checkout. A cashback site gives the customer money back for buying through it. Working with cashback sites can be a deliberate choice – or bring traffic that only comes for the reward.

The rule for coupon and cashback sites is “Not allowed” by default, and Affilyflow keeps a list of sites of that kind and measures referrals from them at the click. The list cannot be complete: new sites, and codes shared in closed groups, are invisible to us. So search for your brand name with “discount code” yourself once a month.

The difference between the two kinds of code matters, because they behave differently:

Personal codes are not available in the Shopify app yet.

Typosquatting

Typosquatting is registering a misspelled version of your domain and sending the mistyped traffic through an affiliate link. The customer would have found you anyway. If the redirect happens on the server, the click has no referrer, so the signal is many clicks without a referrer from an affiliate whose channels do not explain them.

The check is simple: type the most obvious misspellings of your domain into the browser. If you land in your own store with ?afid= in the address, the traffic runs through an affiliate link, and the click is under Results → Clicks & sales. A .dk domain that infringes your name can be taken to the Danish Complaints Board for Domain Names, and for .com and most other generic domains the route is a UDRP complaint.

Incentivised traffic

Incentivised traffic means visitors who are rewarded for clicking or buying – with points, money or prize draws. It is not forbidden in itself, but the customer comes for the reward, not for you. The signals are high conversion and many returns, or customers who only buy the cheapest item to get the reward. If you do not want it, ban it in your guidelines and set coupon and cashback sites to “Not allowed”.

Self-referral is when an affiliate buys through their own link and so gives themselves a discount you never offered. It is forbidden in section 7 of the terms. If an affiliate buys through their own link – the same email for buyer and affiliate, measured in Stripe and the WooCommerce plugin – the sale is rejected automatically as self-referral, visibly with a reason and with no commission or fee.

Sales that look like fraud without it being proven, for example a click shortly after the affiliate account was created, are flagged for review and never approved automatically. In the sales list they are marked “Needs review”, and you or Affilyflow decide them. The affiliate cannot see the flag.

With the Shopify app and on platforms that track with the script, you have to check this yourself. The affiliate's profile shows their display name, sites and when they joined. If the buyer has an email on the same domain as the affiliate's site, or the first sale comes from a brand-new account with no traffic, it is worth asking the affiliate. A purchase with the affiliate's own personal discount code is self-referral too.

A new sale is marked “Pending”. You choose the approval period – 30, 45, 60 or 90 days – on the program, and it is locked on the sale. Under Results → Sales you see how many days are left. Make the period at least as long as your return window, especially if you track sales with the Shopify app or the script, where refunds are not reported automatically. The full process is described on the sale approval page.

1. 01

   Collect the evidence

   Save the sale detail, the click's trail from Clicks & sales and any screenshots of ads with search term, time and place. That way you have it to hand if the affiliate disagrees.

2. 02

   Ask the affiliate

   Message the affiliate under Messages – the conversation stays inside Affilyflow, and no contact details are shared. There may be a good explanation: a site that does not send a referrer, or a campaign you have forgotten.

3. 03

   Reject with a reason

   Choose “Fraud / spam”, “Returned / cancelled”, “Duplicate”, “Test order” or “Other”. The affiliate is told about the rejection and the reason, and a rejected sale costs you nothing.

4. 04

   Block if there is a pattern

   Block the affiliate under Affiliates: choose a reason, for example “Bids on our brand in ads”, and confirm. New sales from the affiliate are then not registered, however they come in. You reject sales that are already registered one at a time.

5. 05

   Tighten the rules

   Adjust the rules for paid search, coupon and cashback sites and channels under Program. New links for a channel you have switched off cannot be created from the moment you save. Clicks on existing links only count as breaches 14 days after a tightening; a relaxation applies straight away.

Only reject with good reason. Your approval rate is shown on the program once you have decided at least 10 sales, so affiliates can see it before they join. If you discover fraud after the period is over, contact us: as the network's arbiter, Affilyflow can decide a sale in a dispute or in a case of fraud – even after the deadline.

How to prevent affiliate fraud

• Choose the paid search rule before the program opens – not after the problem has appeared.
• Leave coupon and cashback sites on “Not allowed” unless you deliberately want to work with them.
• Make the approval period at least as long as your return window.
• Give the affiliates who need a code a personal discount code instead of a general code for everyone.
• Search for your brand name yourself once a month – also with “discount code” and from your phone.

A network that promises to catch everything promises too much. Here is where we draw the line at Affilyflow:

What we cannot see is why no sale is approved the moment it is registered: everything starts as pending, you only pay for approved sales, and the same order never counts twice. The manifesto on numbers you can verify explains why the rules work this way, and the full journey is covered in From click to payout.

Written by

Loui Wagner

Co-founder, product and technology

Builds Affilyflow – the affiliate network from Denmark where businesses and affiliates can see exactly what their partnership delivers.

Found a number that no longer holds? Write to us – we will correct the article.