How to Detect Affiliate Fraud in Pop Traffic: A Buyer-Side Audit

The click count looks harmless. Registrations are even better than expected. Then you check the cohort a few days later and find almost no value behind it. By that point, the campaign has already spent days optimizing toward a signal that never represented margin. To detect affiliate fraud in pop traffic, you need to separate a suspicious visit from a suspicious conversion before cutting a placement.

Detect affiliate fraud in pop traffic with two data views

I usually split the audit in two. First, look at the click rows and ask whether the visits themselves make sense. Then move downstream and check whether conversions can actually be tied back to those clicks without strange gaps in timing, IDs, or value.

Segment the data by placement and sub ID, compare each segment with the rest of the campaign, and reconcile transaction IDs before making exclusions.

The useful evidence sits in different places. Request logs, source reports, and tracker click rows tell you what happened before the conversion. Postback timing, matched click IDs, transaction IDs, and downstream events tell you what happened after it. If you only inspect one side, a bad placement can survive several optimization rounds simply because the top-line numbers look plausible.

This is especially important when buying pop traffic for affiliate campaigns. Weak CTR or CR may be enough to make a performance decision. It is not enough to call something fraud.

The dashboard usually gives you a result long before it tells you whether that result is worth anything.

Audit click signals by placement

Start at placement level and look for combinations that don’t fit the rest of the campaign. One strange metric rarely tells you much. Three unrelated distributions breaking in the same placement are harder to dismiss.

For the first pass, export click ID, impression and click timestamps, placement, sub ID, country, IP and ASN, device, language, lander events, postback status, transaction ID, and downstream events. ASN, or Autonomous System Number, tells you which network supplied the IP.

Use your own campaign as the baseline rather than looking for a universal definition of “normal.”

A flat hourly curve by itself isn’t interesting enough to act on. A flat curve combined with hosting traffic and one cloned browser build is a different story.

The metric I care about most still sits further down the funnel:

What happens to the users after the click?

Rule out tracking errors first

Before calling a placement suspicious, make sure your own setup isn’t broken. A 0% lander CTR is often a tracking problem, not a fraud pattern. I’ve seen teams get halfway through a blacklist discussion before someone noticed the lander buttons weren’t pointing to the tracker URL.

Check the click URL, direct-versus-lander path, redirect chain, and any protection tokens expected on the affiliate landing page. A missing parameter can wipe out lander events, break click continuity, and make country or sub ID fields look much stranger than they really are.

That is why getting tracking right before launch comes before source accusations. Calling a wiring problem fraud is one of the easier ways to blacklist perfectly usable traffic.

Validate conversion-side evidence

Once the click data makes sense, move to the conversion chain. What matters here is whether the conversion can be traced back to a believable click and whether the timing and later user behavior fit the rest of the campaign.

Conversion latency is simply the time between click and conversion. Real traffic usually produces a spread: some conversions happen quickly, others arrive later. When hundreds of conversions appear within almost the same interval, that shape deserves a closer look.

A S2S postback is the server-to-server notification that sends a conversion back through the tracking chain.

Start with the basics: can every conversion resolve to an actual click row with a placement, country, and device? A transaction that exists only in the tracker can point to a bad or fabricated postback. A conversion visible only on the advertiser side is more likely to be a tracking failure.

The network, tracker, and advertiser are not supposed to show identical numbers. They count different things. The network records billable traffic under its own rules, the tracker records events that reached its endpoints, and the advertiser decides which conversions were ultimately approved.

The useful comparison is row by row, using the same attribution window.

On an iGaming offer, I normally want at least two events: registration and a later value event. Registration tells you the funnel fired. The second event tells you whether the user was actually worth buying.

Imagine a placement accounted for 5% of clicks and 8% of registrations. That doesn’t look alarming on its own. But what if its p90 conversion latency, however, is under six minutes versus roughly four hours for the rest of the campaign? Then the cohort check showed the bigger problem: 512 registrations produce only three value events where the usual pattern might suggest something closer to 38.

That’s a representative case study, but the logic is the important part.

If you optimize only to the first conversion, you can easily train the campaign toward the wrong inventory. The safer approach is optimizing toward profit rather than conversion count.

I’ve had transaction matching look completely clean while the cohort itself was dead. The IDs passed. The users didn’t.

Set evidence and filtering boundaries

Low-quality traffic, invalid traffic, and affiliate fraud are not interchangeable labels.

Invalid traffic covers non-genuine impressions or clicks. Fraud implies deliberate manipulation of traffic, attribution, conversions, or payout. The distinction matters because a bad-performing placement is easy to exclude; an accusation of fraud needs much stronger evidence.

Small samples make this messier. With only a few conversions, CR can jump dramatically through normal variance. A placement sitting at twice the campaign average after five conversions is not the same signal as one sitting there after fifty.

A useful rough check is relative error, which falls roughly with 1 divided by the square root of the conversion count. Around 25 expected conversions, a ratio above 1.5x starts to deserve attention. Below 10, I’d treat even a 2x difference as a flag to investigate rather than a verdict. Those are working thresholds, not universal standards.

Timing needs the same context. Instead of declaring anything over a fixed number of hours suspicious, use the offer’s own p90 click-to-conversion latency and observe for roughly two to three times that window.

The same principle applies to hourly distributions. Correcting a timezone can shift the curve. It cannot turn an obviously synthetic delivery pattern into a natural one.

Traffic sources do part of this filtering before you ever see the impression: known bot signatures, hosting and proxy origin, malformed requests, duplicates, and other forms of invalid traffic. In Remoby, Engagement Ads add another interaction step – a ready-made funnel – before the billable click, which makes traffic ready to convert. This is the key advantage of this ad format.

Keep the buyer-side checks

IP filters are useful, but they’re a poor fraud detector on their own. Carrier-grade NAT can put thousands of legitimate mobile users behind a small number of addresses, while residential proxies can rotate through apparently normal IPs.

Attribution abuse can also happen with no obvious IP anomaly at all.

I would contain suspicious traffic at placement or sub ID level first, then compare the segment across country, language, carrier, OS, browser, and device mix. You’re looking for whether the whole population makes sense, not whether one field looks unusual.

The buyer still has to catch things the network cannot see: incentivized traffic where it isn’t allowed, misleading funnels, conversion manipulation, offer abuse, broken attribution, or users who convert at the first event and disappear immediately after it.

No source-side filter can tell you whether the advertiser’s downstream economics are healthy.

Manual checks are fine at the beginning, but they stop scaling quickly. The first things worth automating are usually transaction reconciliation, anomaly queries, and placement-level cohort checks. I wouldn’t pay for elaborate device graphs until those basics are already working.

Run a one-hour campaign check

If I had one hour to review a suspicious campaign, I’d do it in this order:

Сheck available volume by GEO and placement before reallocating spend.

I prefer temporary exclusions at this stage because they give you a chance to see whether the campaign actually improves. A permanent blacklist based on one strange Tuesday can hide a tracking issue just as easily as it can remove a bad placement.