The answer to how to prevent affiliate fraud is to set your payout rules first and add detection second. Pay only on paid invoices, hold commissions through your refund window and have a person approve every payout batch. Then match the signals that catch the schemes those rules miss.
This guide comes from the OpenPromoter fraud code and docs, plus the Stripe and Google docs, all checked in November 2026. One thing to know first: we make OpenPromoter. So the rules and schemes come first because they apply to any tool, and our own product gets one section near the end.
You get the five payout rules that make most schemes pointless, with a worked example of what one fake referral costs. Then come the eight schemes seen most in SaaS programs, the signal behind each one and the steps to take once you find a case.
What Is Affiliate Fraud in a SaaS Program?
Affiliate fraud is any commission paid for a customer the partner did not honestly bring you. In a SaaS program it repeats, because a recurring commission keeps paying on every invoice. A single fake referral on a monthly plan can draw money for a year before anyone looks at it.
Three things make subscription software an easy target. Free trials and cheap first months let a fraudster create a customer for almost nothing. Recurring payouts turn that one customer into a stream of commissions, and partners are paid in cash to accounts you may never see in person.
Refunds and disputes stretch the risk window further. Stripe says card networks allow cardholders to dispute payments within 120 days of the original payment in most cases. When that happens, Stripe debits the disputed amount plus a dispute fee from your account.
So a commission paid on day 30 can belong to a payment that disappears on day 100. Most partners never cause a problem. The rules below make sure the few who would try gain nothing from it.
What One Fake Referral Costs
One fake referral costs you its full commission for every month it stays live, plus any dispute fee if the card was stolen. On a recurring plan the loss grows each billing cycle. A hold period and a payout review cap that loss at the first month or remove it.
Here is a worked example with round numbers. Say your plan costs $99 a month and you pay partners 30% for 12 months. Each paying referral earns the partner $29.70 a month, or $356.40 over the year.
Now say a partner signs up with a second email and a prepaid card. With no hold period and automatic payouts, you pay $29.70 within days of the first invoice. If nobody notices, the program pays the full $356.40 on a customer who never used the product.
The same case looks very different with a 30 day hold. The first commission sits as pending while the self-referral signal fires. You reverse it before it is ever paid, and the loss is the time spent reading one flag.
Scale it up and the numbers explain why rules beat detection alone. Ten fake referrals in one quarter would cost $3,564 over a year on this plan. Detection finds them, but the hold period is what keeps the money in your account while you look.
How to Prevent Affiliate Fraud With Payout Rules
The answer to how to prevent affiliate fraud is mostly payout rules that make cheating slow and unprofitable. Pay only on paid invoices, hold commissions past your refund window and claw back refunds that land after payout. A minimum balance and a person approving each batch close the remaining gaps.
These five rules carry most of the weight. Set them before you invite your first partner:
- Pay on paid invoices only: Book commissions from your billing system's paid invoice events. A click, a trial or a checkout visit never earns money on its own.
- Hold through the refund window: Keep each commission pending for at least as long as your refund policy. A 30 day refund promise needs a hold of 30 days or more.
- Claw back late refunds: When a customer refunds after the commission was paid, deduct that amount from the partner's next payout. Say so in your terms before it ever happens.
- Set a minimum payout: A balance below the minimum waits in the ledger. Small fake balances stay visible there instead of leaving your account each week.
- Have a person approve every batch: Software can prepare payouts, but a team member should read the list before money moves. Require two-factor authentication on large batches.
Card disputes can arrive up to 120 days after a payment, according to Stripe's dispute docs. A 30 day hold catches most refunds, and the clawback rule covers the disputes that come later.
Two smaller rules support the five above. Approve new partners by hand until you trust your own approval rules, and read each applicant's site and audience first. Base tiers and bonuses on paying customers or revenue, because a tier that counts clicks pays people to fake them.
OpenPromoter's defaults follow this pattern, and the commissions and payouts docs list every state a commission moves through. Commissions stay pending for 30 days by default, and the default minimum payout is $50. Batches above $1,000 need a fresh two-factor code before they go out.
Payouts there start in an awaiting approval state, and only a signed-in owner, admin or finance member can approve them. API keys and the AI features can prepare a batch but cannot send one. You can read how that works on the affiliate payouts with human approval page.
Eight Affiliate Fraud Schemes and the Signal That Catches Each
Eight affiliate fraud schemes cover most cases in SaaS programs, and each one leaves a trace in your data. Self-referral, duplicate accounts and refund abuse reach a paid commission most directly. Click-level schemes such as cookie stuffing come last, since a paid-invoice rule already blocks most of their payout.
Each scheme below lists what it looks like, the signal that catches it and the rule that stops it. Where a number appears, it is the threshold the OpenPromoter code uses. Treat it as a starting point you can copy and tune.
1. Self-Referral
A partner signs up through their own link and earns a commission on their own subscription. Some use a second email address, a family member's card or a work account to hide it.
The signal is a match between the partner and the customer. Compare emails after you remove +tags and Gmail dots, since name+2@gmail.com and n.ame@gmail.com reach one inbox. OpenPromoter strips both before it compares, and it also checks whether the customer signed up from the network the partner applied from.
Stripe adds a stronger check for card payments. Its PaymentMethod object carries a card fingerprint that uniquely identifies a card number. Stripe says you can use it to see whether two customers who signed up with you use the same card.
The rule is simple. State in your terms that partners cannot earn on their own accounts, and hold any commission where the customer matches the partner.
2. Fake and Duplicate Accounts
A partner creates several referred accounts that are really one person. Each one earns a signup bounty or a first-month commission before it goes quiet.
The signal is shared details across accounts that should be strangers. Look for one network behind several signups, the same card or name pattern, and accounts that never use the product after the first day. OpenPromoter raises this flag once three or more referred accounts share a network.
The rule is to avoid paying for signups alone. If you must offer a signup bounty, keep it small and hold it until the account pays its first invoice.
3. Refunds After Payout
Referred customers pay once and the partner's commission goes out. Soon after, the customer asks for a full refund. Sometimes the partner and the customer split the commission between them.
The signal is a partner whose paid commissions keep turning into refunds. OpenPromoter flags a partner once three or more commissions were paid and at least 30% of them were refunded later.
The rule is the hold period plus the clawback. Hold commissions through your refund window. Deduct any refund that arrives later from the partner's next payout.
4. Fast Churn
Some referred customers cancel within days of their first payment. It can be an honest bad fit, or it can be a partner buying first months to collect a commission.
The signal is churn far faster than your normal customers show. OpenPromoter flags a partner with five or more referrals when at least half of them canceled within a week. Compare the partner's numbers to your overall churn before you act, since one bad campaign can look like fraud.
The rule is the same hold period. A commission that is still pending when the customer cancels never reaches the partner.
5. Coupon Leaking
A partner's coupon code ends up on a coupon or deal site. Buyers who never saw the partner use it at checkout, and the partner earns on every sale.
The signal is coupon sales with no partner click before them. OpenPromoter flags it when at least 80% of a partner's referrals came through the coupon. It also needs five or more referrals and fewer clicks than coupon sales.
The rule is a unique code per partner. With one code each, you can tell at once whose code leaked.
Say in your terms whether codes may go on coupon sites. When one leaks anyway, retire that code and issue the partner a new one.
6. Brand Bidding
A partner buys search ads on your product name. People who were already searching for you click the ad and the affiliate link before they buy. You then pay a commission on customers you already had.
The signal is a click that came from a paid search ad. Google says auto-tagging adds a GCLID parameter to the URLs people click through from your ads. OpenPromoter looks for that parameter and similar ones such as msclkid, and it flags a partner after three such clicks.
The rule is a clear ban on bidding for your brand name and its misspellings. Reverse commissions from clicks that came through brand ads, and say in your terms that you will.
7. Cookie Stuffing
A partner drops a tracking cookie on visitors who never chose to click. Hidden frames, pop-unders and forced redirects are the usual methods. The partner then collects credit for sales they had nothing to do with.
The signal is a very high click count with almost no signups behind it. Clicks with no referring page or odd timing are another sign worth checking.
The rule is attribution that needs a real choice by the buyer. Pay only on paid invoices, and prefer a coupon code or a click id passed to checkout. The affiliate tracking docs show how OpenPromoter records the click and the referral.
8. Click Spam and Bots
Scripts or click farms send traffic through a partner's link. It inflates click counts and can push a partner into a higher tier if tiers count clicks.
The signal is bursts of clicks from one visitor and crawler or scripted user agents. OpenPromoter flags any visitor with 25 or more clicks, and bot traffic once 30% of at least 20 clicks look automated.
The rule is to base every tier and bonus on paying customers or revenue. A click should never earn money on its own.
One more check sits outside the eight. When one person runs several partner accounts, they often send every payout to the same PayPal or Wise account. Flag any payout account that appears on more than one partner before you pay any of them.
What to Put in Your Affiliate Terms
Your affiliate terms should name every scheme you check for and the penalty for each. A partner who reads that self-referral, brand bidding and coupon posting are banned has less room to argue later. Clear terms also let you reverse commissions without a long dispute.
These clauses cover the schemes in this guide:
- Self-referral: Partners cannot earn on their own accounts or on accounts they control.
- Brand bidding: Partners may not buy search ads on your brand name or its misspellings.
- Coupon sites: State whether codes may appear on coupon or deal sites, and what happens if they do.
- Hold and clawback: Commissions stay pending through the hold period, and refunds after payout come off the next payout.
- Review and reversal: You may hold any commission for review and reverse commissions that break the terms.
- Account closure: You may close an account and keep its unpaid balance after a confirmed breach.
Publish the terms where every applicant sees them before they join. Partners who know what gets checked are less likely to try it, and honest partners like knowing the rules up front.
What to Do When You Find Affiliate Fraud
When you find affiliate fraud, hold the money first and decide second. Freeze the partner's unpaid commissions, review the evidence and ask the partner before you reverse anything. A short message clears up many honest mistakes before you close an account.
Work through these steps in order:
- Hold the commissions: Stop money moving while you look. A held commission waits in the ledger until you decide.
- Check the evidence: Read the signal, the customer record and the partner's other referrals. One flag is a question, while three flags on one partner are a pattern.
- Ask the partner: A partner buying a plan for their own team is a common honest case. Ask what happened and give them a few days to reply.
- Reverse what was not earned: Cancel unpaid commissions and claw back paid ones from the next payout.
- Close the account if needed: Keep every record in case the partner disputes the decision or a chargeback arrives later.
Write down what happened and which rule caught it. After a few months the notes show which checks matter for your program and which flags are mostly noise.
How OpenPromoter Handles Affiliate Fraud Detection
OpenPromoter handles affiliate fraud detection with ten published signals that score every partner and every new referral. The signals combine into a risk score from 0 to 100. Commissions above your threshold wait in a review queue before any payout includes them.
The ten signals are the eight schemes above plus same network as partner and a payout account shared with another partner. Each signal carries its own weight, and several weak ones add up without passing 100. The full list sits in the security docs.
The default hold threshold is a score of 70, and you can change it per program. Partners are rescored every day from their last 90 days of clicks and referrals. In the review queue you dismiss a flag as fine or confirm it to ban the partner and keep their commissions held.
The checks run on every plan, including the free self-hosted version under the AGPL-3.0 license. Scoring is rule-based and needs no AI key. The affiliate fraud detection features page shows the review queue and the score.
Conclusion
The best answer to how to prevent affiliate fraud is to make it unprofitable before you try to catch it. Pay on paid invoices, hold commissions through your refund window and claw back late refunds. Then have a person approve every payout batch.
Detection comes second and works best with published thresholds. Match emails, networks, coupons and ad click ids against each partner, and treat one flag as a question to ask.
If you are still setting up your program, read the guide to starting a SaaS affiliate program and set the hold period on day one.
Frequently asked questions
Can affiliate fraud be completely prevented?
No rule set stops every case, because a careful fraudster can look like a normal customer. Payout rules still remove most of the reward, since a held commission can be reversed before it is ever paid.
How do you detect affiliate fraud?
Compare each referral with the partner who sent it. Next, look for patterns across all of that partner's traffic. Shared emails, networks and cards point to self-referral, while coupon sales with no clicks point to a leaked code.
Does Stripe Radar stop affiliate fraud?
Radar screens payments for fraud and lists tools such as free trial abuse prevention for trial signups. It does not know which partner sent a customer. That means it cannot judge whether a commission was honestly earned.
How long should you hold affiliate commissions?
Hold each commission for at least your refund window, and OpenPromoter holds them for 30 days by default. Stripe says card disputes can arrive up to 120 days after payment. A clawback rule covers anything later.
Should you let affiliates bid on your brand name?
Most SaaS programs ban it, because those ads mostly capture people who were already searching for you. If you allow it, set the rules in writing. Then decide whether brand ad clicks earn the full rate.
What is the most common type of affiliate fraud in SaaS?
No public study we could verify ranks the schemes for SaaS programs. Self-referral and refund abuse reach a paid commission most directly. Check those two first.
Do you need fraud software for a small affiliate program?
A small program can start with the five payout rules and a monthly review of each partner's referrals. Software earns its place once you have more partners than you can read by hand each month.
