Rules and ethics
Part of Affiliate fraud prevention UK: spotting fake clicks and sales
Affiliate fraud prevention UK: spotting fake clicks and sales
How UK merchants spot fake clicks, invalid traffic and fake sales in affiliate programmes, with checks, tools and the UK rules that back a clawback.
What to take away
- Affiliate fraud tends to arrive as a pattern: several conversions from one device, a sudden spike, or clicks that never reach a product page.
- Pause the payout before you investigate. Most networks will hold pending commission while a query is open.
- Detection is validation: server-to-server postbacks, refund windows and per-publisher caps.
- Your main legal footing is the network contract and your programme terms, backed by UK fraud and computer misuse law.
- Monitoring visitor data brings UK GDPR duties, so collect IP addresses and device signals for a stated reason and a set period.
How affiliate fraud shows up in UK programmes
Affiliate marketing pays for outcomes, so the incentive to fake an outcome is built into the model. Wikipedia's entry on affiliate fraud sets out the common categories, from cookie dropping to fake leads and self-referral.
In a British shop the signs are practical rather than forensic. One publisher's commission climbs while their click volume stays flat. Returns and cancellations on their orders run above your shop average. Orders cluster around a few delivery addresses and card numbers.
Fashion and homeware programmes live with high return rates, so a fraudulent order can look normal until the refund lands. Voucher and cashback publishers also take last-click credit for sales they did not create.
Patterns to check first
These four patterns are the usual starting points.
| Pattern | What you see | First check |
|---|---|---|
| Bot clicks | Hundreds of clicks from a narrow IP range, no add to basket | Click logs by IP and device |
| Cookie dropping | Commission with no matching click, often from coupon or toolbar extensions | Click to sale timestamps |
| Fake leads | Form fills with disposable email addresses and no follow-up contact | Lead quality by publisher |
| Self-referral | Orders placed by the publisher or their staff through their own link | Customer and card matching |
A single flagged order proves little. A cluster over several days gives you something to act on.
Tools that catch fake clicks before payout
Networks screen traffic at their end, and how well they do it varies. Reading the Awin vs Tradedoubler UK comparison before you sign helps, because their validation rules and reporting depth differ.
Third-party click fraud tools score each visit on device fingerprint, IP reputation, time to conversion and mouse behaviour. Pricing is usually based on the number of clicks reviewed.
Server-to-server postbacks are the stronger fix. They let you delay commission until the return window closes, so a refunded order never becomes a payable one. Pixel-only tracking can be copied or fired by someone else's page.
The ASA's guidance on online affiliate marketing explains that affiliate content counts as marketing and has to be identifiable as such.
A 72-hour check when commission spikes
When one publisher's numbers jump, run this sequence before the next payment run.
- Freeze that publisher's pending commission in the network dashboard and note the time you did it.
- Export raw clicks, conversions and order values for the same 72 hours by publisher, device and IP.
- Compare their refund and cancellation rate with your shop average for the same period.
- Place a test order from a clean device through their link and watch which events fire.
- Ask the network's compliance team for a traffic quality report on that publisher.
- If the pattern holds, terminate under your programme terms and invoice back the invalid commission.
What UK law and rules give you
Contract does most of the work. Network terms usually define invalid traffic and allow you to withhold commission while a claim is open; your own programme terms can add caps and audit rights.
Beyond that, the Fraud Act 2006 covers dishonest acts in England, Wales and Northern Ireland, while Scotland deals with fraud under common law. The Computer Misuse Act 1990 applies across the UK where someone interferes with tracking they have no right to touch. A single small dispute is usually better handled through the network's own process.
Investigating means processing personal data such as IP addresses, order details and device identifiers. The ICO's UK GDPR guidance covers lawful basis, retention limits and the rights of the people whose data you hold.
Fraud risk starts at recruitment, so combine the checks here with the outreach tactics in how to recruit affiliates UK.
Common questions
What counts as affiliate fraud in the UK?
Invalid clicks, fake leads, cookie dropping and self-referral all count. The common thread is commission earned without a genuine customer journey.
Can I refuse to pay commission on invalid traffic?
Usually yes, if your programme terms or the network's terms define invalid traffic and allow withholding. Read that wording at sign-up, not during a dispute.
Do I need my own fraud tools if the network already screens traffic?
Networks cannot see your refund data, which is where a lot of fake sales show up. Shops with high return rates or generous commissions usually add their own checks.
How long should I keep click logs?
Only as long as you need them for the claim. A defined window, such as the commission approval period plus your dispute period, is easier to justify under UK GDPR than keeping everything indefinitely.