Affiliate Fraud Guide: Cookie Stuffing and Fake Leads

Affiliate fraud pays criminals commission for sales and leads they did not cause, and it usually hides inside numbers that look like a successful programme. Unlike programmatic ad fraud, where the loss is wasted impressions, affiliate and lead generation fraud hits cost-per-action budgets directly: you pay for a sale, an install or a lead that was stolen from another channel, never happened, or came from a person who never consented. This guide covers cookie stuffing, attribution hijacking, fake and recycled leads, incentivised traffic, brand bidding and coupon extension abuse, with detection signals, programme controls and the disclosure rules regulators expect advertisers to enforce. It is written for ecommerce, performance marketing, fraud and security teams who run or audit affiliate and lead programmes.

Key takeaways

Affiliate fraud is attribution fraud in most cases: the fraudster inserts themselves into the last click before a sale that would have happened anyway, so the order is real but the commission is not earned.
Lead fraud is a data quality and consent problem as much as a cost problem, because fake or co-registered leads lead to calls and emails to people who never asked for them.
Time to convert is the strongest single signal: click-to-order gaps of a few seconds, clusters of clicks with no page views, and orders already in the basket before the affiliate click point to stuffing or hijacking.
Programme terms are your main control: clear rules on brand bidding, extensions, incentives and sub-affiliates, backed by validation windows, holdbacks and clawback rights, stop most abuse before it is paid.
Regulators hold the brand responsible: the FTC and the UK ASA both treat the advertiser as accountable for what its affiliates publish, so monitoring is a compliance duty, not an optional fraud project.

How affiliate and lead fraud differs from ad fraud

Ad fraud targets impressions and clicks bought through ad exchanges, measured against the Media Rating Council invalid traffic (IVT) guidelines. That ecosystem is covered in the Ad fraud and connected TV ad fraud guide. Affiliate programmes work differently: a publisher (the affiliate) gets a tracking link from the advertiser or an affiliate network, and earns a commission when a tracked user completes an action, usually a sale (cost per sale), a qualified lead (cost per lead) or an install (cost per install). Attribution usually relies on a cookie, a click identifier passed in the URL, or a server-to-server postback, and most programmes pay the last affiliate click inside a cookie window (often 7 to 30 days).

That model creates two incentives for fraud. First, anyone who can plant the last click before checkout earns commission on organic or other-channel sales. Second, anyone who can produce form submissions that pass basic validation earns per-lead fees whether or not a real, interested person exists. OWASP classifies the automated version of these abuses under OAT-003 Cost-Inflation Fraud, which lists affiliate marketing among the chargeable services that are abused, and fake sign-ups under OAT-019 Account Creation.

Dimension	Programmatic ad fraud	Affiliate and lead fraud
What you pay for	Impressions, clicks, video views	Sales, leads, installs, sign-ups
Typical loss	Spend on non-human or unviewable inventory	Commission on sales you would have made anyway; payment for leads that never convert
Main standard	MRC IVT guidelines, ads.txt, sellers.json	Programme terms, network policies, consumer protection and endorsement rules
Who commits it	Bot operators, fake sites, spoofed supply	Rogue affiliates, sub-affiliates, extension and app developers, lead brokers
Where it shows	Traffic quality metrics	Conversion timing, refund and cancellation rates, lead contact rates, channel overlap

The main schemes

Cookie stuffing and forced clicks

Cookie stuffing drops an affiliate cookie on a visitor's browser without a genuine click: hidden iframes or zero-size images that load the tracking URL, pop-unders, redirects through unrelated sites, or scripts on compromised pages. The visitor later buys directly or through another channel, and the stuffed cookie claims the commission. Variants include forced clicks on mobile (a full-page redirect through a tracking link on page load) and click spamming, where an app or site fires large volumes of clicks in the hope that some users later convert.

Attribution hijacking and coupon extension abuse

Here the fraudster watches for a user who is already about to buy, then inserts a click at the last moment. Browser extensions and shopping apps are the common vehicle: they detect a checkout page and silently open the affiliate link, or replace an existing affiliate code with their own. Google's Chrome Web Store affiliate ads policy (last updated March 2025) states that an affiliate code, link or cookie may only be included after related user action and when the extension offers a direct, transparent benefit tied to its core function, and lists silently updating a shopping cookie and replacing affiliate or promo codes without the user's explicit knowledge as violations. See the Browser Extension Security Guide for the endpoint side of extension control.

Brand bidding and trademark abuse

An affiliate bids on your brand name in paid search, or uses your trademark in ad text or a lookalike display URL, and collects commission on people who were already searching for you. Some programmes allow it under strict terms; most forbid it. Under Google's Ads trademark policy, trademark owners can file complaints that restrict use of the mark in ad text by named advertisers, while use of trademarks as keywords is not restricted. Your terms therefore need to ban brand keywords explicitly if that is your intent, because the platform policy alone will not stop it.

Fake, recycled and co-registered leads

Lead fraud ranges from bots filling forms with synthetic identities, through humans paid to submit forms (lead farms), to legitimate-looking leads resold many times or harvested from unrelated sweepstakes and "consent" pages. Warning signs include valid-looking data with no matching intent, phone numbers that never answer, the same device or IP submitting many leads, and leads arriving in bursts outside normal hours. Bot-driven submissions overlap with sign-up abuse covered in the Fake Account Creation and Sign-up Fraud Guide.

Incentivised traffic and cashback misuse

Cashback, rewards and loyalty sites are legitimate affiliate models when disclosed and permitted. The fraud is undisclosed incentives: paying users to install, register or buy and then cancel, which inflates CPA actions with people who have no lasting interest. Reward points abuse links closely to the Loyalty Points and Gift Card Fraud Guide.

Transaction fraud through affiliates

Some affiliates drive purchases with stolen cards so the commission is paid before the chargeback lands. Cancellation and chargeback rates per affiliate expose this, and the fraud team's card controls apply as normal. See the Chargeback Management and Dispute Guide.

Detection signals and data you need

Affiliate fraud detection depends on joining click, session and order data that usually live in separate systems: the affiliate network's click logs, web analytics, the order management system and the lead or CRM platform. Without a shared identifier (a click ID carried into the order record) most of the signals below cannot be computed.

Signal	What it suggests	Data needed
Click-to-conversion time of seconds, or a click logged after items were added to basket	Last-moment hijacking, extension injection	Click timestamp, basket events, order timestamp
High click volume with low or no landing page views	Cookie stuffing, hidden iframes, click spamming	Network click logs joined to analytics sessions
Referrer missing, mismatched or from sites unrelated to the affiliate's declared promotion method	Stuffing through third-party or compromised sites	HTTP referrer, declared traffic sources
Affiliate conversions rising while paid search brand or direct traffic falls	Brand bidding, attribution theft from your own channels	Channel attribution reports, search query reports
High cancellation, return or chargeback rate for one affiliate	Incentivised or fraudulent purchases	Order lifecycle by affiliate ID
Leads with low contact rate, duplicate phones or emails, many leads per device or IP	Fake or recycled leads, bots	Lead records, device and network attributes, call outcomes
Same customers repeatedly attributed to one affiliate across unrelated purchases	Persistent extension or app injection	Customer ID joined to attribution history

Test your own journey: buy through your site from clean browser profiles with popular shopping extensions installed and watch which affiliate parameters appear. This is the most direct way to spot unauthorised injection.
Validate leads at the point of capture: email and phone format and reachability checks, duplicate detection against recent leads, velocity limits per device and network, and a record of the page and consent wording the person actually saw.
Keep evidence: raw click logs, referrers, user agents and timestamps for the length of your clawback window, so you can support reversals and terminations.

Programme controls that prevent payment for fraud

Vet affiliates before approval: require named owners, a business address, the promotion methods they will use (content site, email, paid search, cashback, extension, app) and examples of live properties. Re-vet when a sub-affiliate network or new traffic source is added.
Write explicit terms: state whether brand bidding, trademark use in domains, browser extensions, incentivised traffic, email and SMS, and sub-affiliates are allowed. Ambiguous terms make reversals hard to defend.
Set validation windows: approve commission only after the return or cancellation period ends (for leads, after a contact or qualification check), so reversals happen before payment.
Use holdbacks and clawbacks: retain a share of new affiliates' earnings for a probation period, and keep contractual rights to reverse commission found to be fraudulent.
Tighten attribution: shorten cookie windows where data supports it, require a landing page view within the session before crediting a click, and prefer server-to-server tracking with signed click IDs over client-side pixels that are easy to fire.
Control coupons: issue affiliate-specific codes, expire them, and monitor where they are published, so leaked codes do not redirect commission.
Monitor continuously: run the detection signals above weekly per affiliate, review the top earners and fastest growers first, and investigate before payment cycles close.
Act and record: warn, reverse, suspend or terminate according to a published enforcement ladder, and share confirmed fraud indicators with your network.

For the wider fraud programme these controls plug into, see the Fraud Prevention Guide for Digital Businesses.

Disclosure and compliance duties

Fraud controls and advertising compliance overlap, because the same monitoring finds both. Regulators expect brands to supervise affiliates.

United States: the FTC Endorsement Guides (16 CFR Part 255) require material connections, such as commissions, to be disclosed clearly and conspicuously (section 255.5), and treat procured fake reviews and manipulated review content as deceptive (section 255.2). The FTC's published Q&A says affiliates should disclose close to the recommendation, that the label "affiliate link" alone is not adequate, and that advertisers should train, monitor and act on what network members say on their behalf.
United Kingdom: ASA guidance on affiliate marketing says both the brand and the affiliate are responsible under the CAP Code even when the affiliate created the content alone, and that affiliate content must be obviously identifiable as marketing, typically with an "Ad" label up front. It notes the ASA has found the term "affiliate" on its own and bottom-of-page disclaimers insufficient.
Lead consent: leads used for calls, texts or emails must meet the marketing consent rules where the lead will be contacted. Keep the consent wording, timestamp and source page with each lead so you can show where consent came from. See the Online Fraud Regulation Map for the wider legal picture.

Decision guidance

Situation	Recommended approach	Trade-off
Small programme run through one network	Use the network's fraud tools, strict terms, 30-day validation and monthly manual review of top affiliates	Limited visibility into raw click data
Large programme with many sub-affiliates	Server-to-server tracking, your own click ID in order records, automated scoring per affiliate, quarterly audits of sub-networks	Engineering effort and data sharing agreements with networks
Lead generation with phone follow-up	Pay on qualified or contacted leads, not on submission; capture consent evidence per lead	Higher per-lead price, fewer suppliers willing to accept
Cashback and coupon partners	Allow only with user-initiated activation, disclosed incentives and unique codes; test extensions regularly	Some partners will leave rather than accept restrictions
Brand search	Ban brand bidding by default, or allow named partners with negative keyword lists and a fixed lower commission	Possible loss of shelf space on comparison and voucher sites

Measurement and KPIs

Reversal rate: share of affiliate commission reversed before payment, by affiliate and by scheme type.
Incremental conversion rate: results of holdout or geo tests showing how many affiliate-attributed sales would have happened without the affiliate.
Median click-to-order time per affiliate, with alerts on affiliates whose median falls below a set threshold.
Lead contact and qualification rate per supplier, and the share of leads failing validation at capture.
Post-sale loss rate: cancellations, returns and chargebacks per affiliate compared with the site average.
Time to action: days from first signal to reversal or suspension.

The Fraud Metrics and KPIs Guide covers how to report these alongside other fraud losses.

Common failure patterns

Paying on the transaction date: commission goes out before returns, cancellations and chargebacks are known, so fraud is paid and then has to be chased.
Trusting top performers: the affiliates with the highest conversion rates are often the ones intercepting existing customers, yet they get the least scrutiny.
Vague terms on extensions and brand bidding: without an explicit ban, reversals become disputes the advertiser loses.
No click ID in the order record: fraud and marketing teams cannot join clicks to orders, so timing analysis never happens.
Buying leads by submission count: suppliers are rewarded for volume, not for people who want to be contacted, which also creates consent and complaint exposure.
Ignoring sub-affiliates: a reputable network partner resells traffic from sources nobody has vetted.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	GV.SC-07	Affiliates and lead suppliers are third parties whose risks are assessed and monitored over the relationship
NIST CSF 2.0	DE.AE-02	Analyse anomalous click, conversion and lead events to understand the activity behind them
NIST SP 800-53 Rev. 5	SR-6 Supplier Assessments and Reviews	Vetting and periodic audits of affiliates and sub-networks
NIST SP 800-53 Rev. 5	AU-6 Audit Record Review, Analysis, and Reporting	Regular review of click and order logs per affiliate
OWASP Automated Threats	OAT-003 Cost-Inflation Fraud, OAT-019 Account Creation	Automated click, conversion and sign-up abuse against chargeable programmes

Practitioner checklist

Carry a unique click ID from the affiliate link into every order and lead record.
Publish programme terms that explicitly cover brand bidding, extensions, incentives, email, SMS and sub-affiliates.
Approve commission only after the return, cancellation or lead qualification window closes.
Alert on click-to-order times of seconds and on clicks logged after basket events.
Test checkout monthly from clean browsers with common shopping extensions installed.
Validate leads at capture and record the consent wording, page and timestamp with each one.
Review the top ten affiliates by earnings and growth before every payment cycle.
Run a holdout or geo test at least yearly to measure true incrementality.
Check affiliate content for clear "Ad" or commission disclosures and act on missing labels.

Affiliate Fraud Guide: Detect Cookie Stuffing and Fake Leads