Quick answer: Affiliate fraud is earning commission through deception: faking clicks, leads or players, or claiming credit for customers you didn't send. The common types are click fraud, fake leads, cookie stuffing, URL hijacking, hidden landing pages, malware and bonus abuse. Programs look for it constantly, and honest affiliates can trip the same alarms by accident.
I'm Rihards, founder of Seven Affiliates, and I've spent five years in iGaming. I run a program, so I'm the one holding the clipboard in this story, and I'd like you never to meet the clipboard.
Think of a nightclub with a bouncer. [Straightens imaginary earpiece.] Most people in the queue are just here for a nice evening. A few are trying to get in on someone else's ID. This post covers both: what the bouncer is looking for, and how not to look like trouble when you aren't.
The 7 types of affiliate fraud at a glance
| # | Type | What's being faked |
|---|---|---|
| 1 | Click fraud | Visitors: bots generate the clicks |
| 2 | Fake leads | Sign-ups: bots or stolen details fill the forms |
| 3 | Cookie stuffing | The referral: a cookie is dropped without a real click |
| 4 | URL hijacking | The route: a lookalike domain redirects through an affiliate link |
| 5 | Hidden landing pages | The visit: pages load out of sight and set cookies |
| 6 | Malware and malvertising | The device: software inserts an affiliate code |
| 7 | Bonus abuse and fake players | The customer: accounts exist only to trigger a payout |
Types 1 to 6 follow the list published by the partnership platform impact.com. Type 7 is the gambling-specific one, covered below.
What is affiliate fraud?
It's getting paid for results that aren't real. Impact.com's definition: "Affiliate fraud occurs when scammers use deceptive tactics to earn commission payouts from affiliate marketing programs. They fabricate clicks, generate fake leads, or claim attribution for sales they didn't actually drive."
The gambling version is the same idea with bigger numbers. The security firm Group-IB calls it "the deliberate misuse of affiliate partnerships within the online gambling ecosystem to generate commissions through dishonest or manipulative tactics" (Group-IB).
Notice who loses. Impact.com lists three effects, and the middle one is the one affiliates forget: "Legitimate affiliates lose earnings to scammers." So fraud isn't a game between cheats and programs. The person at the back of the queue who behaved all night pays for it too.
Types 1 and 2: what are fake clicks and fake leads?
They're traffic with nobody behind it. Impact.com describes click fraud as "Leveraging a network of bots to mimic user behavior, generating thousands of fake click events for paid leads". Fake leads are the next step up: the bot doesn't just click, it fills in the form.
Group-IB says the same about gambling: "affiliates abuse the cost-per-lead (CPL) model by using bots to generate fake leads and trigger rewards." This is why per-registration deals come with filters. Our CPL vs CPA guide covers what gets excluded.
| Type | Warning signs a program looks for |
|---|---|
| Click fraud | "Traffic surges at odd hours", "Low session duration, high bounce rates", "Clicks from data centers/hosting providers" |
| Fake leads | "High chargeback rates", "Lead data from temporary email services" |
Warning signs quoted from impact.com.
Here's the uncomfortable bit for anyone who buys traffic. You can end up with bot clicks without ever touching a bot, because the cheap traffic source you bought from was full of them. The bouncer doesn't care who printed the fake ID. You're the one holding it.
Types 3 to 6: how do people steal the credit?
By making the tracking believe a click happened when it didn't. The customer is real in these cases. What's fake is the claim that this affiliate sent them.
| Type | How impact.com describes it |
|---|---|
| 3. Cookie stuffing | "Automatically drops a cookie on a user's browser, claiming credit for a future purchase the user makes." |
| 4. URL hijacking | "Buying similar domains (typosquatting), triggering a click, and immediately redirecting the user to the actual site to claim credit." |
| 5. Hidden landing pages | "Publishers trigger hidden pages with affiliate links to open and drop cookies without the user's knowledge" |
| 6. Malware | "Malicious software that automatically inserts the scammer's affiliate code when an infected user makes a purchase." |
All four have the same tell: commission with no visible visit behind it. Impact.com's signs for cookie stuffing include "High conversions, minimal referral traffic" and "Attribution for customers who never clicked links".
These methods mostly attack cookie-based tracking, which is one reason programs prefer server-side tracking with a click ID. Our postback URL guide explains how that works, and the brand bidding guide covers the close cousin of type 4: bidding on a brand's name to catch people who were already on their way.
Has anyone actually gone to prison for this?
Yes. The best-known case involves eBay's affiliate program. According to Wikipedia's summary, "In 2014, Shawn Hogan, a prominent figure in eBay's affiliate program was convicted of wire fraud for engaging in cookie stuffing and received a five-month-long federal prison sentence along with a $25,000 fine" (Wikipedia).
The same article says he had made "over $28 million through eBay's affiliate commissions". It also notes that in the United States, cookie stuffing "has been considered a form of wire fraud".
| The eBay cookie stuffing case | Detail, per Wikipedia |
|---|---|
| Method | Cookie stuffing |
| Commissions involved | Over $28 million |
| Charge | Wire fraud, guilty plea |
| Sentence | Five months in federal prison and a $25,000 fine |
So "it's only a terms of service thing" is not a safe assumption. [Earpiece crackles. It's the police.] At that point the bouncer is the least of your problems.
Type 7: what does affiliate fraud look like in iGaming?
It looks like players who aren't really players. Gambling adds a twist the retail lists don't have: the "customer" can be manufactured too. Group-IB describes schemes where "bots are used to register accounts, deposit funds, and exploit bonuses".
That's a fake account that deposits just enough to trigger a CPA payment, collects the welcome bonus, and vanishes. The operator pays twice, once to the affiliate and once in bonus money, for a player who never existed.
| Red flags Group-IB lists for iGaming | Why it looks suspicious |
|---|---|
| "Unusually high conversion rates from a single affiliate" | Real audiences are messier than that |
| "A spike in signups during promotion periods" | Bonus hunters arrive in batches |
| "Similar device or IP data across multiple accounts" | One person, many accounts |
| "High withdrawal activity without consistent gameplay" | The account exists to move a bonus |
Red flags quoted from Group-IB. The reasons in the second column are mine.
How do honest affiliates get flagged by mistake?
By doing something legitimate that looks, from the outside, exactly like the list above. Read those four red flags again. A good campaign that goes well produces the first one. A campaign timed to a promotion produces the second.
| What you did | What it can look like | How to head it off |
|---|---|---|
| Launched a big campaign overnight | A traffic surge at odd hours | Tell your account manager before you launch |
| Bought traffic from a new source | Bot clicks, if the source is poor | Test small and check quality first |
| Promoted during a bonus period | A sign-up spike | Say which promotion you're running |
| Sent traffic from one community | Similar IP and device data | Explain where the audience comes from |
The pattern in the right-hand column is boring and it works: talk first, and keep records of where your traffic comes from. Impact.com's own advice to programs is to give partners "a chance to explain before taking action". An explanation lands much better when it arrives before the question.
Being on the guest list beats arguing at the door. Our guides to affiliate metrics and compliance rules cover the numbers and rules worth watching.
Where the line is at Seven Affiliates
We're building a curated network of private iGaming offers, and curated only means something if the traffic is real. Every offer has its own terms on traffic sources and countries, agreed with your account manager.
| Topic | Our position |
|---|---|
| Brand bidding | Not allowed by default, unless the specific offer explicitly allows it |
| Generic PPC traffic | Allowed, subject to each offer's terms |
| A traffic source you're unsure about | Ask your account manager first, and get the answer in writing |
| Deal types | CPA, RevShare and Hybrid, with RevShare on NGR and no negative carryover |
If you're planning something that might look unusual, tell us before you start. We would much rather hear about it from you than work it out from a chart.
FAQ
What is affiliate fraud?
Affiliate fraud is using deceptive tactics to earn commission from an affiliate program, such as faking clicks, generating fake leads, or claiming credit for customers the affiliate did not actually send.
What are the most common types of affiliate fraud?
Click fraud, fake leads, cookie stuffing, URL hijacking through lookalike domains, hidden landing pages, and malware that inserts affiliate codes. In iGaming, fake player accounts and bonus abuse are also common.
What is cookie stuffing?
Cookie stuffing is dropping an affiliate cookie on someone's browser without a real click, so the affiliate is credited for a purchase they did not influence. In the United States it has been prosecuted as wire fraud.
Is affiliate fraud illegal?
It can be. Beyond breaking a program's terms, some methods have led to criminal convictions. An eBay affiliate received a five-month federal prison sentence in 2014 for wire fraud involving cookie stuffing.
How can an honest affiliate avoid being flagged for fraud?
Tell your account manager before launching large or unusual campaigns, test new traffic sources at small volume, keep records of where traffic comes from, and follow each offer's rules on traffic types and countries.
Have real traffic and want offers that fit it? See how the Seven Affiliates iGaming affiliate program works, then apply here.