Affiliate Fraud Detection

Affiliate Fraud Detection

Build the rule set a program owner uses to flag fraudulent affiliate activity, then investigate and escalate it. This is a defensive skill: it protects programs from being defrauded, and describes each fraud pattern only to the depth needed to recognize it.

No canonical affiliate-fraud detection framework exists. The only ratified standard is the IAB/MRC invalid-traffic split, an ad-measurement standard the affiliate industry borrows rather than one written for affiliate programs:

• GIVT - caught by routine list filtration: known bots, data-center IPs, non-browser user agents.
• SIVT - needs advanced analytics and corroboration: hijacked devices, adware, cookie stuffing.

The PMA's Toolbar and Software Industry Standard is a voluntary, non-binding proposal, not a ratified standard. Force-fit no other framework.

The single highest-leverage control is a commission hold/validation window of 30-90 days, not a detection algorithm. The strongest independent evidence agrees: Edelman's research (related to Edelman & Brandi, _JMR_ 2015) found delaying affiliate payments by two to four months could eliminate more than 70% of fraud without decreasing profit.

Control Leverage

Four controls compete for the hours before the next payout cycle. Rank them before writing a single rule.

• value (most first): hold window > clawback clause set > detection rule set > new-partner terms
• effort (most first): clawback clause set > detection rule set > new-partner terms == hold window
• compliance cost (most first): clawback clause set > hold window == new-partner terms > detection rule set
• efficiency (best first): hold window > detection rule set > new-partner terms > clawback clause set

Set the hold window first, then build the rule set; a program missing both has no working control however good its detection gets.

The efficiency order starves the clawback clause set - top of the value axis, bottom of the ratio, so it loses every round. Promote it above everything else when the program sells subscriptions, high-ticket, or delayed-delivery goods, or has already paid out on a chargeback: there, the only control that touches money already gone is the one the ratio ranks last.

Re-Rank Before Delivering

Every ordering in this skill is a default, not a law. It shifts with the program and with who executes it, so re-rank it against what the Interview told you:

• The platform cannot configure a hold window → delete that rung from the deliverable and say so. A ruled-out control parked at the bottom of a plan comes back as scope. What remains is rule set > new-partner terms > clawback clause set, and the clawback clauses stop being optional.
• Nobody has review hours → the 24-48h review under Hold & Investigate never happens. Route the rule set to Watch plus one monthly batch review, and let the hold window carry the program.
• The roster is small enough to read by hand, roughly under 20 partners → 2-SD outlier math and per-event scoring are false precision on that sample. Inspect the partner list and skip the statistical rungs.
• The user already owns something the order assumes away - server-side postbacks, a fraud analyst, a standing chargeback reserve - promote whatever that asset makes cheap.

Ground Rules

• Recognize, never perpetrate: state the observable tell each pattern leaves in program data; write no evasion or how-to-build detail.
• Label every numeric threshold with its provenance: vendor/agency rule of thumb, academic result, or a baseline the user derives from their own data. Never present a vendor heuristic as an industry constant.
• Warn off headline loss statistics: the famous "17% of affiliate traffic is fake / $3.4B" figure is single-vendor marketing with circular citation.
• Treat low incrementality as a repricing problem, never as fraud. Coupon, cashback, loyalty, extension, retargeting, and brand-search partners are legitimate by default.
• Keep B2B and B2C signals separate. Say explicitly when a rule applies to both.
• B2C fraud: a stolen-attribution sale, visible in click-timing, cookie-drop, and chargeback signals within hours-to-days.
• B2B lead-gen fraud: a fake form-fill whose worthlessness surfaces weeks later in downstream rates.
• Never assume the network does the policing: networks earn a share of commission volume, so their compliance is reactive - it acts on evidence-backed complaints, not brand-specific surveillance.
• Expect AI-generated synthetic traffic to degrade behavioral heuristics (session duration, scroll depth); treat recent vendor detection-efficacy claims as unverified and weight server-side and downstream-outcome signals instead.

Interview

Ask before building anything:

• One question per message.
• Multiple-choice where possible.
• Skip anything already answered.

Ask the first three questions below before any of the rest: the controls diverge by two orders of magnitude in time-to-effect and effort, and the answers decide the order everything downstream is delivered in.

• By when must this rule set be protecting money - the next payout cycle, or a quarter out? A cycle puts the whole load on the hold window and band assignment and rules the clawback clause set out of scope; a quarter puts contract changes back on the table.
• One-off cleanup of a partner you already suspect, or a standing control that compounds? One-off promotes the dossier and enforcement path and skips baseline derivation; standing promotes baselines, monitoring cadence, and the KPI loop.