How to prevent affiliate fraud in a SaaS program
The fraud a software affiliate program actually meets, and the settings that stop most of it before any money leaves.
Updated · 10 min read
Affiliate fraud in a software program rarely looks like a criminal ring. It looks like an affiliate buying through their own link, a coupon code on a deal site, or a sale refunded the week after its commission was paid. Each has a signal you can see and a rule that stops it before money leaves your account.
Where the money actually leaks
If you pay commissions on paid sales, fraud only costs you through a commission you approve and then pay. Clicks and signups are free. So the question is not "is this traffic fake?" but "will this commission still be real when I pay it?" That gives you three places to stop it:
- Who gets in. Review affiliates before their links can earn.
- What gets approved. Hold every commission until refunds are unlikely, and look at anything that looks like the affiliate buying from themselves.
- What gets paid. Pay only approved commissions, on a schedule, above a minimum.
Self-referrals and family accounts
The most common case in software. Someone joins, clicks their own link and buys, or their partner, flatmate or second company does.
The signal. The buyer's email matches the affiliate's, or shares their domain or surname. The first sale arrives within hours of them joining, from the same network.
The prevention. Decide your policy first: some programs happily let a customer earn on their own seat. If you do not, say so in writing ("purchases for yourself, your household or your own companies do not earn a commission"), and hold commissions long enough to look at them.
Klibon flags a commission when the buyer looks like the affiliate: the buyer's email is the affiliate's own, or an address the affiliate signed in to Klibon from in the last 30 days shows up on a click on their link in the 24 hours before the sale, or on the conversion itself when your integration reports it. A household on one connection is often caught; a friend in another city is not, so the written rule still matters. A flagged commission is never approved automatically: filter the Commissions tab by Needs review and approve or reject it. The affiliate is not notified either way. The details are in Troubleshooting.
Refund and chargeback abuse
An affiliate sends sales that do not stick: customers who buy for a bonus and then ask for a refund, or stolen cards that come back as chargebacks weeks later.
The signal. One affiliate's refund rate is far above everyone else's, or their refunds cluster just inside your refund policy.
The prevention. Hold every commission for at least as long as your refund policy, and pay only once the hold has passed. A worked example: a customer buys an annual plan at $290 and your commission is 30%, so $87. Your refund policy is 30 days. With a 30-day hold, a refund on day 20 cancels the commission before it was ever approved. With no hold, the $87 is approved immediately and may already be paid; you now have to recover it from future earnings, and an affiliate who never sells again never pays it back.
In Klibon this is the program's refund window, from 0 to 180 days. A commission is pending until the window closes, and a refund before then reduces it, prorated, or reverses it outright. A refund after you have paid never rewrites the settled statement: it appears as a negative line on the affiliate's next one, netted against what they earn then. Paddle and Creem report a chargeback to Klibon as a refund, so it is handled the same way. On Stripe and Polar, Klibon acts on refunds, so check open disputes in your processor before you mark a statement paid. See Recruiting and paying affiliates for each case.
Fake signups and trials
In programs that pay per lead or per trial, an affiliate can fill your signup form with throwaway emails. The fix is structural: pay for payments, not signups.
The signal. Many signups from one affiliate, almost none converting, often on disposable email domains.
The prevention. Commission on paid invoices only, and treat a free trial as nothing until its first paid invoice.
Klibon works this way already. A commission comes from a payment. Reporting a signup with Klibon.signup() only ties that email to the affiliate, so a later payment under the same email is credited to them. A $0 trial invoice produces nothing owed, so a fake account earns nothing until someone actually pays.
Click inflation
Bots, refresh loops or traffic exchanges pump up an affiliate's click count. When you pay on sales, that costs you judgment rather than money: conversion rates stop meaning anything.
The signal. Thousands of clicks and no sales, often in bursts at odd hours. The prevention. Never pay per click or offer a traffic bonus, and read clicks next to conversions.
Klibon filters three kinds of click automatically: bot (the user agent identifies as a crawler or a link preview, such as Slack or WhatsApp fetching a link before showing it), duplicate (the same visitor clicking the same affiliate's links again within seconds) and flood (one address producing far more clicks in an hour than a person makes). Filtered clicks are kept, with the reason shown on the Clicks tab, and do not count towards anything. The Clicks tab also shows where each click came from, which is the column to read when an affiliate's numbers look off.
Cookie stuffing
An affiliate drops their cookie on visitors who never chose to click: a hidden frame, a pop-under, a browser extension. Some of those visitors would have bought from you anyway.
The signal. Clicks from sites unrelated to the affiliate's stated channel. Credited customers who say they found you through search or a friend.
The prevention. Ask every applicant where exactly they will promote you, and check that the clicks come from there. Keep your cookie window reasonable, since a long window makes a stuffed cookie more valuable. Ask a new customer how they heard of you and compare the answer with the credit.
To be clear about the limits: Klibon has no cookie-stuffing detector. A stuffed cookie on many real visitors looks like many real clicks. What helps is that attribution is last click, so a later genuine click replaces a stuffed one, a coupon the customer typed beats any cookie, and the cookie window is yours to set, from 1 to 365 days.
Trademark and brand bidding in paid search
An affiliate runs search ads on your product name and takes a commission on customers who were already typing it. You pay twice: in higher ad prices against your own campaigns, and in commission.
The signal. Search your product name from a private window, from different locations if you can, and look at who is advertising. Use the advertiser search in Google's Ads Transparency Center. In your click data, a large share of an affiliate's clicks arriving from a search engine is worth a question.
The prevention. Write the rule down before anyone joins: no bidding on your brand name, misspellings or "brand + coupon", no ads that impersonate your site, no direct linking from ads to your pricing page. State what happens when the rule is broken.
Klibon gives you a Promotion rules field in your program brief, meant for allowed channels, brand restrictions and prohibited tactics. Affiliates see it on your program page before they apply. Klibon does not police search ads for you; enforcement is the remove and block actions described below.
Coupon leaks to coupon sites
An affiliate's code ends up on a coupon aggregator. Any customer who searches for a discount at checkout finds it and credits that affiliate, whoever actually sent them.
The signal. Sales on a code jump without a matching rise in that affiliate's clicks, or a search for your product name plus "coupon" shows the code.
The prevention. Give every affiliate their own code so a leak is traceable to one person. Use one code per campaign for affiliates who run several, so you can retire the one that leaked. Forbid posting codes on coupon sites in your promotion rules. Keep the discount bounded, for example 20% off the first three months rather than forever.
In Klibon a coupon outranks the cookie on a new customer, and when the two name different affiliates the event is marked Conflict on the event log, so a leaked code overriding other affiliates' clicks shows up as a run of conflicts. A coupon never takes a returning customer from the affiliate who brought them. Archiving a code stops new sales from matching it; codes Klibon created on Stripe are switched off there too, while a code you registered by hand also needs disabling in your processor. See Coupon codes and, for setting codes up well in the first place, the guide on affiliate discount codes.
The settings that stop most of it
| Setting | What it stops | A sensible starting point |
|---|---|---|
| Approval by hand | Throwaway accounts, self-referrers, brand bidders joining unseen | Review every applicant; invite by email only people you already trust |
| Refund window | Paying for sales that are later refunded | Your refund policy length, or longer |
| Commission on payments only | Fake signups and fake trials | No per-click or per-signup payments |
| Minimum payout | Small fake sales being cashed out quickly | At least 50.00, higher if your average commission is large |
| Promotion rules | Brand bidding, coupon sites, misleading claims | Written, specific, visible before anyone joins |
| Per-affiliate codes | Untraceable coupon leaks | One code per affiliate, one per campaign where needed |
On approval: in Klibon, a pending affiliate's link already redirects and records clicks, but earns nothing, and a sale made while they wait is not credited later. An email invitation counts as approval. When you review an applicant, look for a real channel you can visit, an audience that matches your customers and a stated promotion method. More on finding people worth approving in affiliate recruitment.
On the minimum: every Klibon program has a minimum payout of at least 50.00, and you can set it higher, never lower. Below it, no statement is issued and the balance carries to the next month. Take a $49 monthly plan at 30%, so $14.70 a sale. Three approved sales ($44.10) carry over; the fourth takes the total to $58.80 and onto a statement. Someone faking small sales has to get several of them past the refund window and your review before anything is owed.
A ten-minute check before you pay
In Klibon, statements are built on the first of each month from approved commissions only. You pay each affiliate yourself and mark the statement paid, which records the proof and tells the affiliate. Before you do, run through this:
- Work through the Needs review filter on the Commissions tab. Nothing flagged reaches a statement until you decide.
- Compare each affiliate's refund rate with the program's. Ask about any outlier.
- Look at new affiliates' first sales: who bought, how soon after joining, from which code or link.
- Scan the Clicks tab for affiliates with many filtered clicks or clicks from places they never mentioned.
- Check the event log for a run of coupon conflicts on one code.
- Search your product name, and your product name plus "coupon", for ads and leaked codes.
- Check open disputes in your processor if it does not report chargebacks as refunds.
When you find it
Start with a message, not a ban. Many problems are honest: an affiliate who did not read the rules, a relative who used the link unprompted.
If it was deliberate, Klibon gives you two actions. Remove ends the partnership: no new customers, but the ones they already sent keep renewing and earning. Block is the fraud answer: their links stop tracking, renewals stop earning, and every unpaid commission, pending or approved, is reversed and comes off any statement you have not settled. Commissions you already paid stay as they are, and you can unblock later if you were wrong. If your program is new and you are still deciding how strict to be, the guide on creating an affiliate program covers the terms to settle before your first affiliate joins.