Fraud detection in partner programs: what we catch, what we flag, what we leave to you

Most posts about affiliate fraud are written by vendors selling AI-powered fraud detection. They imply the problem is sophisticated and scary and only their model can catch it. The reality is more boring: 90% of partner fraud is the same handful of patterns, and the defense is mostly mechanical.

This post is the honest version. It walks through the categories of fraud OpenPartner catches automatically, the categories it surfaces for human review, and the categories where no platform can save you and you need to know what to look for yourself.

Category 1: self-referrals

The cleanest fraud pattern. The “partner” signs up, becomes a partner, then uses their own link to refer themselves. Or refers their alt account. Or refers their cousin. Free commission.

What we do automatically:

• Block conversions where the converting userId was the partner’s own application email or one of their connected identities.
• Flag conversions where the partner’s referral happened from the same IP as the partner’s account login within a recent window.
• Flag any pattern where one partner’s cluster of referrals all converge on a tight set of payment methods or email patterns.

The first one is hard-blocked at the attribution engine level. The second and third are flags surfaced in the admin’s review queue. We don’t auto-reject — false positives are real (shared offices, shared households) — but we make sure the brand sees them.

Category 2: cookie stuffing

A “partner” runs a site that drops the cref cookie on visitors who never clicked their share link. The visitor signs up later through a totally unrelated path; the cookie says the cookie-stuffer earned the commission.

What protects against it:

• The cref cookie is set by the brand’s own SDK, only when the URL contains ?cref=<clickId> and that clickId matches a real Click row in our database. A fabricated cref doesn’t resolve to a partner; an absent click record fails attribution.
• The Click row carries the IP, user-agent, and referrer of the original click. If a partner’s clicks all come from one IP, or carry suspicious referrer patterns, the pattern shows up in the partner’s analytics view and the admin’s quality dashboard.
• Click-to-conversion ratios that fall an order of magnitude outside the program’s norm get flagged. A partner with 200,000 clicks and zero conversions is probably inflating click counts; we surface it.

We don’t run a heuristic that blocks unusual click ratios — they’re an honest signal of audience quality, not always fraud — but they go on the partner’s record.

Category 3: fake conversions

The brand fires conversion events into the API. If those events are deterministic and authoritative (your billing system says “invoice #X paid”), there’s no room for the partner to fake them. The partner can fake clicks; only the brand can fake conversions.

This is by design. The server SDK is the source of truth for what counts as a conversion because the brand’s billing system is the source of truth for what’s been paid.

The fraud pattern that does exist here is the brand’s own internal QA accidentally firing test events into production. It happens. Mitigations:

• Use distinct API keys per environment; the test key produces events tagged test: true that don’t generate commissions.
• The admin’s commission ledger shows the source of every commission so you can audit what fired and back it out.

Category 4: incentivized traffic and toolbar/extension stuffing

The grayest area. Partners running browser extensions, cashback toolbars, or incentivized-click traffic where users get a benefit from clicking links they don’t care about.

This isn’t always fraud. Some brands welcome this traffic (cashback affiliates are a legitimate channel). Some brands prohibit it.

OpenPartner doesn’t take a position. The platform surfaces the data — referrer patterns, session lengths, conversion rates per partner — and the brand decides which partners are allowed. We make the policy enforceable; we don’t define the policy.

You can pre-screen this on application via:

• Required website URL on the partner application form
• Manual approval workflow before a partner’s links go live
• Per-partner program flags (which campaigns they’re approved for)

If you outsource the screening to OpenPartner’s pattern detection, you’re trusting our heuristics for a decision that’s actually about your brand standards. We’d rather you make that call.

Category 5: payout fraud

Partner submits a fake bank account, fake KYC, fake tax form, gets paid, vanishes.

We outsource this entirely to Stripe Connect Standard. The partner connects their own Stripe account, Stripe runs KYC, Stripe handles tax docs (1099-K in the US, equivalents elsewhere). If Stripe approves the account, we’re transferring real money to a real identity-verified entity. If Stripe restricts the account, payouts pause and the partner sees a clear “your Stripe account is restricted” message in the portal.

This is one of the strongest reasons we built on Stripe Connect rather than a custom PayPal/wire flow. Stripe is better at catching payout fraud than any affiliate platform can be on its own.

What you still have to do as the brand

Three things no platform can do for you:

1. Set commission rates that aren’t fraud-incentivizing. If your commission rate is higher than your customer LTV, you’ve built a fraud incentive into the program.
2. Approve the right partners on the way in. A 60-second look at a partner’s application and website kills 80% of fraud before any click happens.
3. Watch your monthly commissions for outliers. A partner who’s never converted suddenly drives 200 conversions in a week is either a viral moment or a fraud event. Either way, look.

We surface the signals. You make the call.

Where the holdback policy fits in

Even with the controls above, the cleanest defense against refund-driven commission clawbacks is the payout holdback feature. Setting a 14-day or 30-day holdback matches your refund window — commissions accrue but don’t approve until the refund window closes, so the platform clears refund-driven fraud automatically.

Honest commission programs don’t need exotic fraud detection. They need clear rules, mechanical enforcement, and human review of the small slice of patterns the platform flags. OpenPartner is built for that mechanical-plus-human model rather than promising zero-touch AI fraud detection that no one can actually deliver.

If you want to see the controls in your own program, start on Revshare and the fraud-review queue is on by default for every hosted plan.