Affiliate fraud prevention UK: signs and checks

What to take away

Affiliate fraud tends to arrive as a patternseveral conversions from one device, a sudden spike, or clicks that never reach a product page.
Pause the payout before you investigate. Most networks will hold pending commission while a query is open.
Detection is validationserver-to-server postbacks, refund windows and per-publisher caps.
Your main legal footing is the network contract and your programme terms, backed by UK fraud and computer misuse law.
Monitoring visitor data brings UK GDPR duties, so collect IP addresses and device signals for a stated reason and a set period.

How affiliate fraud shows up in UK programmes

Affiliate marketing pays for outcomes, so the incentive to fake an outcome is built into the model. Wikipedia's entry on affiliate fraud sets out the common categories, from cookie dropping to fake leads and self-referral.

In a British shop the signs are practical rather than forensic. One publisher's commission climbs while their click volume stays flat. Returns and cancellations on their orders run above your shop average. Orders cluster around a few delivery addresses and card numbers.

Fashion and homeware programmes live with high return rates, so a fraudulent order can look normal until the refund lands. Voucher and cashback publishers also take last-click credit for sales they did not create.

Patterns to check first

These four patterns are the usual starting points.

Cookie dropping:Look for attributed sales with no corresponding genuine click or landing-page visit in your logs.
Fake leads or orders:Check for duplicate lead details and clusters of cancellations or refunds.
Self-referral:Where lawful, compare publisher identity with customer and order records for signs that the publisher referred their own purchase.
Invalid clicks:Review repeated clicks from the same device or IP address, and clicks with no matching product-page visit.

Four affiliate fraud patterns

Pattern

Bot clicks: Narrow IP range
Cookie dropping: Commission, no matching click
Fake leads: Disposable emails, no follow-up
Self-referral: Publisher's own orders

What you see

Bot clicks: Click logs by IP
Cookie dropping: Click to sale timestamps
Fake leads: Lead quality by publisher
Self-referral: Customer and card matching

First check

Bot clicks
Cookie dropping
Fake leads
Self-referral

A single flagged order proves little. A cluster over several days gives you something to act on.

Checking clicks and sales before payout

Networks screen traffic at their end, and how well they do it varies. The Awin vs Tradedoubler UK comparison is separate background reading; before signing, check the network's own validation process and reporting.

If you use third-party click fraud tools, check which signals they score—such as device fingerprint, IP reputation, time to conversion and mouse behaviour—and whether you can verify alerts against your own order and refund data.

Server-to-server postbacks are the stronger fix. They let you delay commission until the return window closes, so a refunded order never becomes a payable one. Pixel-only tracking can be copied or fired by someone else's page.

The ASA's guidance on online affiliate marketing explains that affiliate content counts as marketing and has to be identifiable as such.

A 72-hour check when commission spikes

When one publisher's numbers jump, run this sequence before the next payment run.

Record the publisher and the affected period, then pause disputed commission where your programme or network terms allow.
Compare click, landing-page and conversion records with that publisher's usual pattern and the wider programme activity.
Match attributed conversions to postbacks and order or lead records; flag missing journeys, duplicates and repeated identifiers.
Check refunds, cancellations, delivery addresses and payment details for suspicious clusters, using only data needed for the investigation.
Ask the network to review the disputed traffic under its terms, and preserve the relevant logs and correspondence.
Document your decision, release valid commission and withhold disputed commission only where the applicable terms allow. Report suspected criminal fraud through the relevant route below.

72-hour commission spike check

Freeze pending commission, note the time
Export raw clicks, conversions, order values
Compare refund rate with shop average
Place test order from a clean device
Request network traffic quality report
Terminate and invoice back invalid commission

What UK law and rules give you

Contract does most of the work. Network terms usually define invalid traffic and allow you to withhold commission while a claim is open; your own programme terms can add caps and audit rights.

Beyond that, the Fraud Act 2006 covers dishonest acts in England, Wales and Northern Ireland, while Scotland deals with fraud under common law. The Computer Misuse Act 1990 applies across the UK where someone interferes with tracking they have no right to touch. A single small dispute is usually better handled through the network's own process. For suspected criminal fraud in England, Wales and Northern Ireland, report it to Report Fraud (formerly Action Fraud); in Scotland, contact Police Scotland.

Investigating means processing personal data such as IP addresses, order details and device identifiers. The ICO's UK GDPR guidance covers lawful basis, retention limits and the rights of the people whose data you hold.

Fraud risk starts at recruitment, so combine the checks here with the outreach tactics in how to recruit affiliates UK.

Common questions

What counts as affiliate fraud in the UK?

Invalid clicks, fake leads, cookie dropping and self-referral all count. The common thread is commission earned without a genuine customer journey.

Can I refuse to pay commission on invalid traffic?

Usually yes, if your programme terms or the network's terms define invalid traffic and allow withholding. Read that wording at sign-up, not during a dispute.

Do I need my own fraud tools if the network already screens traffic?

Networks cannot see your refund data, which is where a lot of fake sales show up. Shops with high return rates or generous commissions usually add their own checks.

How long should I keep click logs?

Only as long as you need them for the claim. A defined window, such as the commission approval period plus your dispute period, is easier to justify under UK GDPR than keeping everything indefinitely.