Affiliate fraud detection
Stop paying for sales you already had
A customer signs up as their own affiliate and takes 20% off. It is the most common way programs leak money, and it looks legitimate. Referly matches email and IP on every referral and holds the payout.
- On every plan, no fraud tier
- Two deterministic checks, no black box
- Held before the money moves
Sam Whitfieldsam.w@otto-sons.com$69.80On HoldFraud Prevention
- Referral's email matches affiliate's email
- Referral's IP address matches affiliate's IP address
The taxonomy
Four ways an affiliate program leaks money
Almost none of it is sophisticated. Most of it is a customer discovering they can refer themselves.
Self-referral
Coupon leakage
Cookie stuffing
Brand bidding
Self-referrals
A customer signs up as an affiliate, uses their own code, and takes 20% off their own purchase. The most common form by a wide margin, and usually not malicious. Someone spots the discount and takes it.
Your affiliate program quietly becomes a discount coupon that you also pay a commission on.
What gives it away
- The affiliate's email is the customer's email
- The signup IP matches the purchase IP
- The account has exactly one referral
Coupon-code leakage
A personal discount code ends up on a coupon aggregator. Every checkout that was already going to happen now carries a discount and a commission, and the affiliate did nothing.
The expensive one for ecommerce brands, because the volume is real traffic that was already yours.
What gives it away
- Sudden redemption volume with no matching click traffic
- Orders with no referring click at all
- Redemptions concentrated on one code
Brand bidding
An affiliate buys search ads on your brand name, sits above your own organic result, and collects commission on people who were already looking for you.
You pay twice: once in the ad auction they push you up in, once in commission.
What gives it away
- Paid-search referrers
- A gclid or msclkid on the click record
- A conversion rate far above every other partner
What Referly catches
Self-referrals get caught before the payout
Two comparisons on every referral, then whatever you told Referly to do about a match.
One referral, checked
Devon signs up as an affiliate, then buys with his own code. Here is what Referly compares.
Reason on the row: email and IP matched.
These are the only two checks that exist. Cookie stuffing and brand bidding produce no verdict here, because Referly evidences them rather than detecting them.
Self-referrals get caught automatically by email and IP matching, then held for your review or rejected outright.
Email matching
The affiliate's own email address against the referred customer's.
IP matching
The affiliate's signup IP against the IP recorded on the referral's first click.
Your choice of action
Hold the commission for review, or reject it automatically. You pick, per program.
No accusation
The affiliate never sees a flagged screen. They see a commission that is still pending.
Fraud protection is on every plan, including the $75 Startup plan. There is no fraud tier.
The evidence
Every click arrives with its paperwork
Referly stores what happened, not just that it happened. Referrer, country, device, ad click id and VPN status are on every click.
A partner bidding on your brand name arrives with a gclid and a Google paid referrer. You do not need a detector to see that. You need the field, and the field is there.
- Network
- IP, GeoIP country, region, city and ISP, with proxy and VPN flags
- Source
- Referrer URL, parsed domain, and a referrer type classification
- Campaign
- utm_source, utm_medium, utm_campaign, utm_term, utm_content
- Ad click ids
- gclid, gbraid, wbraid, fbclid, msclkid, ttclid, twclid, li_fat_id
- Destination
- Full landing URL, pathname and query string
- Device
- User agent, browser, OS, device type, screen and viewport, language
- Uniqueness
- Device id and a unique-click flag
Click #82,104
3 Feb 2026, 14:22 UTC · Devon Reyes
Network
- IP
- 81.2.44.19
- Location
- Frankfurt, DE
- ISP
- Deutsche Telekom
- VPN
- Detected
Source
- Referrer
- google.com
- Type
- paid search
- gclid
- Cj0KCQiA…
Campaign
- utm_source
- utm_medium
- cpc
- utm_campaign
- brand
Destination
- Landing
- /pricing?ref=devon
- Device
- Chrome 132 · macOS
- Viewport
- 1512 × 982
Nothing above fired a rule. The red fields are the record telling you what this click was, so you can decide what to do about it.
Coupon rules
Rules that stop a code becoming a public discount
Auto-generated codes carry rules, so a leaked code stops being profitable to leak.
First-time orders only
Aggregator traffic is mostly returning customers. This removes most of it.
Minimum order value
Kills the small basket that costs more to fulfil than it earns.
Expiry date
A leaked code gets a shelf life instead of a lifetime.
Redemption limit
A hard ceiling on how many times one code can be used.
Allowed groups
Codes only mint for the partner groups you chose, not everyone who joins.
Personal code structure
Built from a prefix plus the affiliate's name, email, discount or random characters, so codes are personal rather than guessable.
Coupon tracking itself is on every plan, including Startup. Minting codes automatically, which is what carries these rules, starts on Business.
The honest table
What we catch, and what we only show you
Two of these four are caught automatically. For the other two, Referly gives you the evidence and the controls, and you make the call.
| Threat | Detected automatically | Evidence you get | Your move |
|---|---|---|---|
| Self-referral | Email and IP matching | The matched field is named on the hold | Release, decline, or ban |
| Coupon leakage | Not automatic | Redemptions with no matching click, and per-code redemption counts | Tighten the code rules, or rotate the code |
| Cookie stuffing | Not automatic | Click-to-referral ratio, referrer domain and type, unique-click flag | Decline, ban, enforce your terms |
| Brand bidding | Not automatic | Paid referrer, gclid or msclkid, UTM medium, landing page | Enforce your terms, decline |
Referly has no machine-learning risk score and does not monitor search-ad auctions for your brand name. What it has is a complete click record, an approval step before money moves, and rules you set yourself.
The gap
Nothing gets paid before you say so
Commissions sit in an approval state, behind a holding period, until they are payable.
Refunded sales are detected automatically and the matching commission is reversed, so you never pay out on refunded revenue.
Approval states
Every commission is ON HOLD, ACCEPTED or DECLINED. Nothing pays out from a hold.
Named hold reasons
Program settings, fraud prevention, affiliate deactivated or affiliate banned. The row tells you which rule fired.
Holding period
Keeps every commission unpayable until your refund window has passed, whatever its approval state.
Refund reversal
A refunded sale is detected automatically and the matching commission is reversed.
Deactivate or ban
An affiliate's future commissions hold, or stop being earned entirely.
Bot protection
Portal signup sits behind reCAPTCHA, so the affiliate list itself is not farmed.
“I spend all day testing out sign up flows and campaigns. I have tried most affiliate platforms out there, but very few are as easy and powerful as Referly. Quick setup and accurate tracking.”
Kasper WoodAffiliate Content ManagerAvailability
Fraud and approval features by plan
The detection itself is not a paid tier. Only the coupon-rule automation is gated.
| Feature | Startup | Business | Enterprise |
|---|---|---|---|
| Fraud protection | |||
| Automatic refund detection | |||
| Coupon code tracking | |||
| Link tracking | |||
| Automatic coupon generation | |||
| Affiliate groups and segmentation |
- Fraud protection, refund detection and coupon tracking are on every plan, including Startup. Automatic coupon generation, which carries the anti-leakage rules, starts on Business.
- Referly takes 0% of your sales on every plan, so a held commission costs you nothing to hold.
FAQ
Before you connect anything
The questions founders ask in the first ten minutes.
14-day free trial · No credit card required · Cancel anytime
Referly compares the affiliate's email against the buyer's, and the affiliate's signup IP against the IP on the referral's first click. A match holds the commission with the matched field named on the row, or rejects it outright, depending on which action you chose.
Read next
Where this bites hardest
Explore
The rest of the platform
Tracking and attribution
Commissions and rewards
Payouts, tax and invoicing
Your branded affiliate portal
Recruiting and growth
Integrations and developers