Affiliate fraud prevention for SaaS programs

What affiliate fraud looks like in SaaS

Affiliate fraud in software rarely looks like a crime ring. It is usually one partner bending your rules in a way that pays them and costs you: buying the product through their own link, claiming customers who were already on their way to you, or sending sign-ups that were never going to pay.

Subscription billing helps you here. Unlike a store that ships goods, a SaaS company sees every payment, renewal and refund in its billing system, so you can tie each commission to money that actually arrived and stayed. Most of the defences below come down to using that data before you pay, not after.

Self-referrals, fake sign-ups and trial abuse

Self-referral is the most common problem, and often not malicious: a new partner tries the product through their own link and does not realise that breaks the rules. Decide your policy up front. Some programs allow a partner’s own paid account to count, most do not, and either is fine as long as it is written down.

Fake sign-ups only pay off when you reward sign-ups. A flat bonus per trial or free account invites people to create accounts in bulk, from throwaway email addresses, often in bursts from the same network. If you want to reward early funnel activity, keep the amount small and pay it only once the account converts, or cap how many a partner can earn per month.

Trial abuse is the paid version of the same thing. A customer starts a paid plan through a partner link, the partner earns a first-payment commission, and the customer refunds or disputes the charge a week later. Sometimes the partner and the customer are the same person, and sometimes the partner offered to split the commission as a cashback.

• Pay commission on successful payments, never on sign-ups alone.
• Hold the first commission until the refund window has passed.
• Compare the partner’s name, email domain and payout details with the referred customer’s billing details.
• Forbid rebates and cashback offers funded by commission in your partner terms.

Cookie stuffing, coupon leakage and brand bidding

These three have something in common: the customer was real and paid, but the partner did little or nothing to bring them. You pay a commission on a sale you would have made anyway.

Cookie stuffing means setting a referral cookie without a genuine click, through hidden images, pop-unders or forced redirects. The visitor later buys directly and the stuffed cookie claims the sale. The tell is volume without intent: many clicks, very short sessions, almost no pages viewed, yet a share of your organic customers suddenly credited to one partner.

Coupon leakage happens when a partner’s code ends up on a coupon aggregator. Buyers who were already at checkout search for a discount, find the code and use it, and the partner earns commission on customers they never reached. Partner-specific codes at least tell you whose code leaked; a single program-wide code hides it.

Brand bidding is a partner buying search ads on your company name. Someone who types your name into a search engine was already coming to you, so the partner’s ad takes credit for your own brand’s pull, and often raises what you pay for your own brand keyword.

How hold periods and review stop fraud paying out

Detection is useful, but the strongest control is timing. If a commission cannot be paid until the customer has had time to refund, most refund-based fraud simply never pays out, and you have time to look at anything that feels wrong.

1. 1

   Hold every commission past the refund window

   Commonly 30 days, or longer if your refund policy or card dispute exposure is longer. A refund during the hold cancels the commission automatically.

2. 2

   Approve partners before they can earn

   Look at the website, audience or channel a partner describes. Most fraud comes from accounts with no visible audience at all.

3. 3

   Review before each payout

   Scan the approved commissions for new partners, sudden spikes and customers who match the partner. Pause the payout for anything you want to ask about.

4. 4

   Claw back what slipped through

   If a refund or chargeback lands after payout, deduct it from the partner’s next payout rather than chasing repayment.

Affiliatops holds commissions for 30 days by default, cancels or reduces them when Stripe reports a refund, and deducts already-paid amounts from the next payout. The mechanics of the last step are covered in affiliate refunds and clawbacks.

Signals worth a second look

None of these proves fraud on its own. Plenty of honest partners have a burst of clicks after a post goes viral. Treat them as reasons to look closer, and ask the partner before you act.

Watch the ratio between steps more than raw totals. A partner whose click-to-paid rate is far above everyone else’s deserves as much attention as one whose rate is near zero.

What to do when you find it

Most cases are best handled quietly and in proportion. A partner who bought their own plan once needs a reminder of the rules and a reversed commission, not a ban. A partner running bots or stuffing cookies should be removed, with pending commissions reversed as your terms allow.

• Reverse only the commissions you can tie to the behaviour, and keep a note of why.
• Tell the partner what you found and which rule it breaks; honest partners fix problems quickly.
• Deactivate partners who repeat it, and replace any leaked coupon code with a new one.
• Update your terms when you meet a new pattern, so the next case is clearly covered.

Fraud rarely costs a small program much if commissions wait out a hold and payouts get a human look. The expensive cases are programs that pay instantly on sign-ups, with no terms to point to when something goes wrong.

Frequently asked questions