Key takeaways
- Self-referral is a partner converting through their own link or code to earn on their own purchase.
- Coupon abuse is a code earning commission on traffic the partner never genuinely drove, often via leaked codes.
- Detect self-referral by correlating the partner's identity, device, and IP with the converting customer.
- Detect coupon abuse by comparing redemptions against the partner's real click volume and audience size.
- Flag and hold suspicious conversions through a clearing window so clawbacks can reverse anything confirmed.
Self-referral and coupon abuse are the frauds that hide in plain sight, because the conversions are real purchases. Someone genuinely bought something — the fraud is in who claims credit and whether they earned it. That makes these harder to spot than obvious bot traffic, but they leave correlation signatures you can detect systematically instead of relying on a finance manager's gut feeling.
What is self-referral fraud?
Self-referral fraud is when an affiliate buys through their own tracking link or code to pocket commission on their own purchase. It can be small and opportunistic — a partner saving on a personal order — or systematic, with rings of accounts buying and refunding to farm commissions.
How do you detect self-referrals?
You detect self-referrals by correlating the converting customer with the partner across the identifiers a person can't easily separate. One overlap is suspicious; several together is close to conclusive.
- Email match: the customer's email matches or shares a domain with the partner account.
- Device match: the conversion comes from a device the partner has used to log in.
- IP match: the converting IP overlaps with the partner's known IPs.
- Payment fingerprint: the same card or billing details recur across the partner's own conversions.
- Behavior: the click-to-conversion gap is implausibly short, as if the same person did both.
One signal flags, several confirm
Don't auto-reject on a single coincidence — a partner might legitimately be on the same office IP as a real customer. Weight the signals: device plus IP plus email overlap on the same conversion is a pattern no honest journey produces, and that's what you act on.
What is coupon abuse and how do you spot it?
Coupon abuse is when a partner's code earns commission on conversions the partner never drove, and you spot it by comparing redemptions to the partner's real reach. A code that converts far more often than the partner's click volume or audience could explain is the classic signature of a leaked or scraped code.
- Redemptions-to-clicks ratio: a code redeeming heavily while the partner sends almost no clicks suggests the code escaped their audience.
- Sudden spikes: a quiet code that suddenly surges often means it landed on a coupon aggregator.
- Geographic mismatch: redemptions from regions the partner's audience doesn't cover.
- Self-redemption: the partner's own code used by the partner — coupon abuse and self-referral overlapping.
Real referrals leave a trail of clicks. When the redemptions are loud but the clicks are silent, the code is doing the partner's work for them — and that's the fraud.
What do you do with a flagged conversion?
You hold it rather than pay it, then resolve it during a clearing window. Detection isn't useful if the commission still flies out the door, so flagged conversions should be held automatically and reviewed before approval. If a conversion is confirmed fraudulent — or surfaces as fraud after approval — a clawback reverses the commission so it never reaches a payout. Afflio's device and IP-velocity fraud rules plus clawbacks are built to operate this loop: correlate identifiers, flag and hold the outliers, and reverse what's confirmed.
How do I detect if an affiliate is self-referring?
Correlate the converting customer with the partner across email, device, IP, and payment fingerprint. A single overlap can be coincidence, but device, IP, and email matching on the same conversion is a strong signal of self-referral. Hold such conversions for review before approving them.
How can I tell if a promo code has been leaked?
Compare the code's redemptions against the partner's actual click volume and audience size. A code redeeming far more than the partner could plausibly drive — especially a sudden spike — usually means it was scraped onto a coupon aggregator site.
What should I do when I flag a suspicious conversion?
Hold it instead of paying it, and review it during a clearing window. If it is confirmed fraudulent, use a clawback to reverse the commission. Afflio supports automatic flagging via velocity rules and clawbacks so suspicious conversions never reach a payout.