How to spot affiliate fraud in AffiliateWP

What does affiliate fraud look like in practice?

Mostly it’s ordinary people bending your terms, not organised crime. The common patterns are:

• Self-referrals. An affiliate buys through their own link to get a discount on their own order.
• Coupon leakage. An affiliate’s coupon ends up on a coupon website. Customers who were buying anyway use it, and the affiliate earns on sales they didn’t cause.
• Paid-ad hijacking. An affiliate bids on your brand name in search ads, catching customers who were already looking for you.
• Fake accounts. One person registers several affiliate accounts to game sign-up bonuses or tiers.
• Refund cycling. Orders that are placed, earn a commission, then get refunded after the payout.

Each one has a different signal. Some can be caught by a rule at the moment the referral is created. Others only show up as a pattern over days.

What does AffiliateWP catch on its own?

More than it used to. Its settings live under AffiliateWP → Settings → Anti-Fraud, and AffiliateWP’s anti-fraud guide splits them by plan (checked September 2026).

On every plan:

• Self-Referral Prevention. Catches affiliates buying through their own link, by matching the customer’s email to the affiliate’s or noticing the affiliate is logged in. It can allow, flag or reject, and rejects by default.
• Blocked Referring Sites. Blocks all visits from domains you list, so no visit or referral is recorded from them.

On the Pro plan:

• Referring Site Detection: checks that traffic comes from the sites affiliates registered with.
• Conversion Rate Detection: flags conversion rates that are unusually high or low, once an affiliate has at least 10 referrals. The default range is 2 to 20 percent.
• PPC Traffic Detection: spots referrals from paid ads through click IDs, UTM tags and referrer domains.
• IP Velocity Detection: catches several affiliate registrations from one IP address, three in 24 hours by default.

If you only do one thing after reading this, check that Self-Referral Prevention is still set to Reject. It’s the most common pattern and it costs nothing to stop.

Should a check flag or reject?

Reject when the rule is almost never wrong. Flag when an honest affiliate could trip it.

Self-referrals are the clear case for Reject: a customer whose email is the affiliate’s own is not a referral. Paid-ad traffic depends on your terms. If you allow affiliates to run ads but not on your brand name, a flag lets you check which it was. Conversion-rate checks can only flag, and that’s right, because a small affiliate with three sales from ten visits looks identical to a fraudulent one until you look.

IP velocity has a third option, Require Approval, which suits it well. A family or an office sharing one connection can register several genuine affiliates, so holding new accounts for a look is kinder than blocking them.

A good test for any setting: if it went wrong for your best affiliate, would you rather have found out from a flag or from their angry email?

What do rules miss?

Rules judge one referral at a time, at the moment it’s created. Some fraud only looks like fraud in aggregate:

• Bursts. Ten orders in an hour from one affiliate might be a great newsletter, or a card-testing run. Either way, it deserves a look.
• Look-alike customers. The email isn’t the affiliate’s, but it’s the same company domain, or the same surname. A strict email match won’t see it.
• Spikes. An affiliate who usually sends two sales a day suddenly sends forty. Good news or a leaked coupon, you want to know which before payday.

These need a person to judge. The job of software is to put them in front of that person early, while the referrals are still pending.

How do you get suspicious patterns in front of someone?

This is the part we built into WP Referral Clarity, as an Anomalies screen that sits beside AffiliateWP’s settings rather than replacing them. It checks three patterns on the same schedule as its dashboard:

• Rapid repeat conversions: an unusually high number of referrals from one affiliate in a short window.
• Referrer and referee match: the customer’s name or email domain matches the affiliate’s own, a common self-referral pattern that exact email matching misses.
• Volume spike: an affiliate’s referrals for the day are a large multiple of their usual daily average.

If you’re deciding between AffiliateWP’s own tools and an add-on for this, see AffiliateWP’s reports compared with WP Referral Clarity. The Anomalies screen never blocks, rejects or changes a referral. Each row has View referral, which opens it in AffiliateWP where you take any action, and Mark reviewed for the ones that turn out fine. We made it read-only on purpose. A false positive that silently rejects a good affiliate’s sales costs you the affiliate.

What does a weekly review routine look like?

Fraud checks only work if someone looks before money moves. A routine that fits in fifteen minutes a week:

1. Before each payout run, clear the flags. Open everything AffiliateWP flagged and everything on the Anomalies screen. Decide each one: fine, reject, or ask the affiliate.
2. Look at the top earners. A new name at the top of the leaderboard is worth thirty seconds. Where are their visits coming from?
3. Search for your coupons. Search the web for your store name plus “coupon”. Any affiliate coupon on a coupon site is a conversation to have.
4. Check refunds against paid referrals. Referrals should be rejected automatically when their order is refunded, if that option is on under AffiliateWP → Settings → Commissions. Make sure it is.
5. Write down what you decided and why. When an affiliate disputes a rejection, you’ll want the reason.

Why does the pending window matter for fraud?

Because it’s your review time. A referral that’s still pending can be rejected with one click. One that’s been paid means asking an affiliate to return money, which rarely goes well.

If your referrals move to unpaid the moment an order completes, you have almost no window. Holding them for your return period (AffiliateWP’s Force Pending Referrals add-on does this) gives refunds time to land and you time to review. Tell affiliates you do it, and why. Our guide on what pending means in AffiliateWP covers how to explain the wait without triggering emails.

How do you raise it with an affiliate?

Ask before you accuse. Most flagged patterns have innocent explanations: a newsletter went out, a customer happened to share a surname, a colleague bought through the link. A short, specific question (“we saw 14 orders from your link between 2pm and 3pm on Tuesday; was that a promotion?”) gets a straight answer more often than a rejection does.

When it isn’t innocent, point to the term it breaks. That’s why the terms need to name self-referrals, coupon sites and brand bidding explicitly. A rule nobody wrote down is hard to enforce.

What none of this does

• Stop fraud you don’t review. Flags that nobody opens change nothing.
• Replace your terms. Software can spot a pattern. Only your terms decide whether it’s allowed.
• Catch everything. A careful fraudster who stays below every threshold will get through. The aim is to make it unprofitable and to catch the common cases cheaply.