Fraud detection in partner programs: what we catch, what we flag, what we leave to you

Plenty of what’s written about affiliate fraud comes from vendors selling AI-powered fraud detection. It implies the problem is sophisticated and scary and only their model can catch it. The reality is more boring: the common patterns are well known, and the defense is mostly mechanical.

This post is the honest version. It walks through what OpenPartner flags automatically (less than you might expect), what it puts in front of you to review, and the categories where no platform can save you and you need to know what to look for yourself.

Category 1: self-referrals

The cleanest fraud pattern. The “partner” signs up, becomes a partner, then uses their own link to refer themselves. Or refers their alt account. Or refers their cousin. Free commission.

What OpenPartner does automatically: nothing specific to self-referrals. It doesn’t compare the customer who converted with the partner’s own email or sign-in, and it doesn’t match IP addresses between a partner’s account and their referrals. We’d rather say so than imply a check that isn’t there.

What you have to catch it:

• The review queue. Every new commission lands in Review queue in your admin, with the partner and the event it was earned on. With no holdback (from the program, or from that partner’s own terms), it waits there until you approve or reverse it. With a holdback, it can’t be approved until the holdback ends, and then it’s approved automatically. Either way, you can reverse it until a payout run picks it up.
• The partner’s referrals. Referrals on a partner’s row lists the customers they referred, with your own user ID next to each one, so a partner whose customers are their own accounts is quick to spot.
• Revoke. Revoking a partner stops their links earning from then on. The links still redirect, so customers don’t hit a dead end, but new attribution is dropped.

None of this auto-rejects anything. False positives are real (shared offices, shared households), so the decision stays with you.

Category 2: cookie stuffing

A “partner” runs a site that drops the cref cookie on visitors who never clicked their share link. The visitor signs up later through a totally unrelated path; the cookie says the cookie-stuffer earned the commission.

What protects against it:

• A cref has to be a real click. The click router writes a Click row for every visit to a partner link and sends its click ID to your site on the landing URL, as cref. Your app passes the cref on when it calls identify, and the API only stitches a click ID it has on record. A made-up cref gets click_not_found and credits no one. That doesn’t stop a stuffer who pushes visitors through their real link without the visitor meaning to click it: to the router, that’s a real click.
• Velocity flags. When one IP address clicks the same link more than 20 times in a minute, the router flags every click past the 20th as velocity. The visitor is still redirected, but attribution skips flagged clicks. The counter lives in the router’s memory and resets when it restarts, so it catches bursts, not a slow drip. Self-hosted installs can change the limit with VELOCITY_MAX and VELOCITY_WINDOW_MS.
• A hard cap per IP. One IP making more than 300 clicks a minute across all your links gets a 429, and no click is recorded.
• Fraud review. Fraud review in your admin lists flagged clicks with the partner, the link and a hash of the IP. Un-flag a false positive and the events that arrived while it was flagged are attributed again. You can also flag a click yourself with POST /clicks/:id/flag, and later events won’t attribute to it.
• The raw click record. Every click keeps a hash of the IP, the user agent, the referrer, the UTM tags, and the country when your edge sends one. It’s all in your data export, so you can look for patterns OpenPartner doesn’t check for.

What we don’t do: flag click-to-conversion ratios. A partner with 200,000 clicks and no signups is probably inflating click counts. Your admin dashboard can rank partners by clicks, revenue or commission over the last 30 days, so that partner is easy to find, but nothing raises an alert. You have to look.

Category 3: fake conversions

The brand sends conversion events to the API. If those events are deterministic and authoritative (your billing system says “invoice #X paid”), there’s no room for the partner to fake them. The partner can fake clicks; only the brand can fake conversions.

This is by design. The server SDK is the source of truth for what counts as a conversion because the brand’s billing system is the source of truth for what’s been paid.

The fraud pattern that does exist here is the brand’s own internal QA accidentally firing test events into production. It happens. Mitigations:

• OpenPartner has no separate test mode for events: anything sent with your production API key counts. Keep QA and staging traffic away from that key.
• If test events do get through, the commissions they created show in the review queue with the partner and the event type they were earned on. Reverse them there, or with POST /commissions/:id/reverse, before they’re paid.

Category 4: incentivized traffic and toolbar/extension stuffing

The grayest area. Partners running browser extensions, cashback toolbars, or incentivized-click traffic where users get a benefit from clicking links they don’t care about.

This isn’t always fraud. Some brands welcome this traffic (cashback affiliates are a legitimate channel). Some brands prohibit it.

OpenPartner doesn’t take a position. It records the data (the referrer, user agent and UTM tags on every click, and what each partner’s clicks went on to earn), and the brand decides which partners are allowed. We make the policy enforceable; we don’t define the policy.

You can pre-screen this on application:

• Your join page asks every applicant for their website or main channel, their social profiles, their audience size and how they’d promote you.
• Set When someone applies to Hold for review in your settings, and no applicant can sign in until an admin approves them.
• Choose which programs each partner can promote.

OpenPartner doesn’t try to detect this traffic for you. Whether it belongs in your program is a call about your brand standards, and we’d rather you make it.

Category 5: payout fraud

Partner submits a fake bank account, fake KYC, fake tax form, gets paid, vanishes. Or someone gets into a partner’s account and quietly changes where the money goes.

On hosted OpenPartner you pay partners yourself, by PayPal, bank transfer or whatever you already use, and mark each payout paid. OpenPartner never holds the money and charges no payout fee. So the last check before money moves is yours, and the platform helps with it:

• Payout details are checked and watched. An IBAN or routing number that can’t be right is refused when it’s saved. Details are stored encrypted. For partners who sign in to the portal, every change emails them saying who made it, so a redirected payout doesn’t go unnoticed.
• Sanctions screening. On hosted OpenPartner, payees are screened against US sanctions lists. A possible match puts a warning on the payout for you to check before you send it. A confirmed match can’t be paid through OpenPartner.

If you run OpenPartner yourself, you can also pay through Stripe Connect Standard. The partner connects their own Stripe account, and Stripe runs its own identity checks. If Stripe restricts the account, the transfer fails, and the next payout run retries once the partner has sorted it out.

What you still have to do as the brand

Three things no platform can do for you:

1. Set commission rates that aren’t fraud-incentivizing. If your commission rate is higher than your customer LTV, you’ve built a fraud incentive into the program.
2. Approve the right partners on the way in. A quick look at a partner’s application and website screens out obvious fakes before any click happens.
3. Watch your monthly commissions for outliers. A partner who’s never converted suddenly drives 200 conversions in a week is either a viral moment or a fraud event. Either way, look.

We flag what we can and put the rest in front of you. You make the call.

Where the holdback policy fits in

Even with the controls above, the cleanest defense against refund-driven commission clawbacks is the payout holdback feature. Set a holdback at least as long as your refund window, and commissions wait it out before they’re approved. A refund OpenPartner hears about in that time reverses the commission before it’s ever paid, so there’s nothing to claw back.

Honest commission programs don’t need exotic fraud detection. They need clear rules, mechanical enforcement, and human review of the small slice of patterns the platform flags. OpenPartner is built for that mechanical-plus-human model rather than promising zero-touch AI fraud detection.

If you want to see the controls in your own program, start on Revshare. Fraud review and the review queue are in every brand’s admin from day one.