Fraud, leakage, and the polite way to say no

By Jimi Barkway · Published 1 September 2026 · Updated 3 September 2026 · Part of the honest manual

Every founder asks the same first question about affiliate fraud. How bad is it? The honest answer comes from the category's own data. The source is FirstPromoter's July 2026 study: 31.4 million referrals across 3,425 programs, July 2026. Figures were re-checked 3 September 2026. In it, about 4% of referrals get flagged for review. Classic self-referral trips only around 0.15%. Fraud is a real cost, not an existential one. The bigger cost is usually something that isn't fraud at all. We'll get to it.

Know each one by its signature

Self-referral. Someone buys your product through their own link. That turns your program into a private discount. Signature: matching emails, addresses or payment details between partner and "customer". This is the one abuse software should catch entirely on its own. We block it by default on every plan.

Brand bidding. The partner runs search ads on your brand name. They tax traffic that was already yours. Signature: a sudden jump in referrals with search as the source. It's timed to nothing the partner published. Worth knowing: in that same study, 96% of all flagged referrals were paid-ad traffic. So say a program's numbers go strange without explanation. Brand bidding is usually where the trail ends up.

Coupon-code leak. A partner's discount code escapes onto coupon sites. Every checkout that hunts for a code hands them credit. Signature: one code's usage suddenly dwarfing its partner's actual audience. Minutes between click and purchase.

Cookie stuffing. Dropping your tracking cookie on people who never meaningfully clicked. Then harvesting credit if any of them ever buy. Signature: clicks way up, conversion rate collapsing toward zero.

Incentivised traffic. The partner rewards people for signing up. Signature: a burst of conversions that churns to nothing inside a month or two. None of them wanted the product.

And the boring one that costs the most: low-quality volume. Not fraud. No rule broken. An entirely sincere partner whose referred customers cancel in month one, every time. No terms clause catches it. Only module 6's habit of watching churn per affiliate does. At most small programs this quietly outcosts all the actual fraud combined.

The boring defences, configured on day one

Most protection is settings, not vigilance. A hold period is how long you sit on a commission before you are allowed to pay it out. Yours wants to be at least as long as your refund window (module 3). Self-referral blocking on. Your blocked traffic sources and brand keywords listed. And the terms from module 2 naming what's banned, in writing, before anyone joined. Those blocking safeguards ship on every plan of ours.

On top of that sits monitoring. Flags raised against referrals and payouts, with the evidence attached (on our Scale plan). That matters for one specific reason. You want to act on evidence, not vibes. Every action below starts with being sure.

The part nobody publishes: the actual words

Detection is the easy half. The hard half is that enforcement means messaging a real person and telling them no. Often one with an audience. Founders postpone that conversation for weeks. The delay costs more than the fraud. So here are the three messages, ready in advance.

Short, honest about the reason, and it leaves the door visibly open. What it never does is invent a fake capacity excuse. People compare notes.

The generous read is doing real work. Half the time it genuinely was an agency. The partner keeps their dignity while the behaviour stops either way. Firm on the facts, warm to the person.

Two things in that last message do the heavy lifting. Paying the legitimate balance signals the process was fair. That is what everyone watching will ask about. And "final" saves you the three follow-up emails asking for another chance.

When to eat the loss

Not every flag deserves the full process. A $9 commission with ambiguous evidence isn't worth an accusation that might be wrong. Void it quietly or let it stand, and watch for a repeat. Save the confrontation for clear evidence and meaningful money. You're running a program, not a courtroom. Being known as fair is worth more than any single clawback. A clawback is money you take back from a partner after you have already paid it.

What do founders ask about fraud?

One module left, and it's the strange one. It's module 8, when to stop paying attention to all of this.