What is affiliate fraud?

Affiliate fraud is when an affiliate partner earns commission they did not legitimately earn. That includes submitting fabricated or stolen lead data, and taking credit for customers who would have converted anyway, for example by bidding on the advertiser’s brand name or forcing tracking cookies.

What is ad hijacking in affiliate marketing?

Ad hijacking is when an affiliate runs paid search ads on an advertiser’s brand terms, often copying the advertiser’s ad text and display URL, then routes the click through their affiliate link. The customer was already searching for the brand, but the affiliate collects the commission.

How can I tell if affiliate leads are fake?

Check each lead at the moment it is submitted. Look at whether the phone number is live and reachable, whether the email address exists and has history, whether the IP address matches the stated location or comes from a data centre or proxy, and whether the same details appear across many submissions. Compare conversion and contact rates by affiliate: fake traffic tends to stand out quickly.

Should I stop working with affiliates?

Not necessarily. Most affiliates are legitimate, and the channel can work well. The fix is to make every lead and conversion prove itself before it is paid for, and to write clear rules about brand bidding and data sourcing into affiliate terms.

Affiliate Fraud: How Fake Leads, Stolen Data and Ad Hijacking Hide in Plain Sight

Why is affiliate fraud so hard to see?

In affiliate marketing, familiarity can pass for legitimacy. A partner who has been sending leads for months, with numbers that look roughly right, rarely gets questioned. The leads arrive in the CRM, sales get attributed, and invoices get paid.

That is exactly why affiliate fraud survives. It doesn’t look like an attack. It looks like the channel working. The damage only shows up later, as contact rates that never quite recover, sales teams chasing people who never asked to be called, or a marketing budget that keeps growing without the business growing with it.

What types of affiliate fraud are there?

Affiliate fraud tends to fall into two groups. They need different defences, so it helps to keep them separate.

1. Fake or stolen lead data

Here the affiliate sells you leads that are not what they claim to be:

Fabricated leads: invented names, numbers and email addresses, sometimes generated by scripts or bots filling in forms.
Stolen or recycled data: real people’s details taken from breaches, scraped lists or old databases, submitted as if the person had just filled in your form.
Incentivised or misled sign-ups: real people who entered their details for something else, such as a prize draw, and have no interest in your product.

The data can be partly or entirely real, which is what makes it convincing. A real name, a real address and a working email do not prove that this person asked to hear from you.

2. Claiming customers you would have won anyway

The second group doesn’t involve fake people at all. The customer is real and genuinely converts. The fraud is in who gets paid for it:

Ad hijacking (brand bidding): the affiliate bids on your brand name in search, often copying your ad text, so customers already looking for you click through an affiliate link first.
Cookie stuffing: tracking cookies are dropped without a genuine click, so the affiliate is credited for any later purchase.
Last-click interception: coupon or toolbar tricks that insert an affiliate link at the final step of a journey the affiliate had no part in.

You end up paying commission on revenue you already had.

What does episode 005 cover?

In episode 005, Simon is joined by Andy Cooney, co-founder of Marcode, to look at affiliate fraud from both of these angles: fabricated leads and stolen data on one side, and ad hijacking and undeserved commissions on the other. The conversation keeps coming back to the theme in the title: the fraud hides in plain sight because it sits inside relationships and reports that everyone already trusts.

Listen to the full episode for the detail.

How do you detect fake affiliate leads?

The most effective control is to check every lead when it arrives, before it reaches your sales team or your invoice. Useful checks include:

Phone validation and HLR lookups. Check that the number is valid, live on a network and reachable. Watch for patterns as well as single results. Provero’s HLR study of around a million UK numbers found that 7% of numbers returning “absent subscriber” on three checks were later reachable. A single status isn’t a verdict, but repeated patterns across one source are worth investigating.
Email verification. Confirm the mailbox exists, isn’t disposable, and ideally has some history. Brand-new addresses in bulk from one affiliate are a warning sign.
IP and device signals. Compare the IP location with the stated address, and flag data-centre, VPN and proxy traffic. Many submissions from the same device or IP range point to automation.
Breach exposure. Details that appear in known breaches are not automatically fake, but a high share of breached records from one source suggests recycled or stolen data.
Duplicate and velocity checks. The same phone or email appearing across many submissions, or bursts of leads at odd hours, are classic signs of scripted traffic.
Consent evidence. Ask for proof of where and when each person agreed to be contacted: the page, the timestamp and the wording. Legitimate affiliates can usually provide it.

Then compare affiliates against each other. Contact rate, conversion rate and complaint rate by source will usually expose a bad partner within weeks.

How do you stop ad hijacking and commission fraud?

Set clear rules on brand bidding. Write into affiliate terms whether partners may bid on your brand terms, misspellings and trademark variations, and what happens if they do.
Monitor your brand search results. Search your own brand terms regularly from different locations and devices, or use a monitoring tool, and record any ads that redirect through affiliate links.
Check click-to-conversion patterns. Very short gaps between click and purchase, or affiliates whose conversions are mostly from existing customers, deserve a closer look.
Hold back commission. Pay after a validation or cooling-off period rather than instantly, so you have time to reverse fraudulent claims.

How do you prevent affiliate fraud long term?

Change what you pay for. When affiliates are paid on raw lead volume, every incentive points towards more leads, real or not. When they are paid on leads that pass validation, are contactable and convert, the incentive flips: quality becomes the way to earn more.

Pair that with routine checks at the point of capture and clear contract terms, and most affiliate fraud stops being worth the effort. See how to solve affiliate fraud, with example checks for both fake leads and brand-term hijacking.