Affiliate Fraud Detection for SaaS: Six Patterns, Six Controls

Most affiliate fraud against SaaS programs is boring. Someone buys through their own link, or a customer refunds after the commission has already gone out. Affiliate fraud detection matters, but in my experience the controls that save the most money are structural. A hold period that matches your refund window, plus an automatic commission clawback, catches losses whether or not you ever identify the pattern behind them. Detection is the second layer.

Here are the six patterns I see most, the signal for each, and the control that stops it.

Work through the steps in this order. The first two do most of the work.

Step 1: Pay only on server-confirmed revenue

Fake trial signups only cost you money if you pay for them. Pay per trial or per signup and someone will script 400 trials with disposable emails, and you will owe on every one.

Pay on payment, and only on payment confirmed by your billing system: Stripe events, Paddle webhooks, or your own backend calling an API with a secret key. Never let a browser pixel on a thank-you page create a commission. Anyone with dev tools can fire that request.

This one decision kills the fake-trial pattern outright. A trial that never converts generates zero commission, so there is nothing to farm. If you are still designing your program, make this call before choosing rates or recruiting anyone; it sits near the top of How to Start an Affiliate Program for Your SaaS, in Order.

Step 2: Set the hold period to your refund window, then automate clawbacks

Take a $490 annual plan, 20% commission ($98), and a 30-day money-back guarantee. With a 7-day hold, that $98 is approved on day 7 and goes out in your next payout run. The customer refunds on day 25. You have returned $490 and paid $98 for a sale that never happened.

Set the hold to 30 days and the refund arrives while the commission is still pending. It gets cancelled. No chasing, no awkward email.

The rule I use: hold period equals the longest refund window you actually honor. A 14-day guarantee gets a 14-day hold. A 30-day guarantee gets 30. If you sell high-ticket annual plans and see chargebacks, add a buffer on top.

The hold won't catch everything. A customer who refunds on day 40 as a goodwill gesture slips past it, which is where the commission clawback comes in. Record the reversal as a negative adjustment against the affiliate's next payout. If they are owed $150 next month, they receive $52. Partial refunds should scale: refund half of the $490 and the commission drops by $49.

This is why I rank these controls above detection. A refund-for-commission scheme, a self-referral that gets refunded, a stolen card that gets disputed: the same two settings handle all of them, and you never had to know which one it was. In Anderro, the hold period is configurable from 7 to 90 days (default 30); a refund on an unpaid commission cancels it, a partial refund reduces it proportionally, a refund after payout becomes a negative adjustment netted against the next payout, and a Stripe dispute reverses the commission (restored if you win the dispute).

Step 3: Match customer emails against affiliate payout emails

Self-referral is the most common pattern and the easiest to price. Say your plan is $49/mo, referred customers get 20% off, and affiliates earn 30% recurring. The affiliate signs up through their own link and pays $39.20. They earn back $11.76 a month. Their effective price is $27.44, which is 44% off a plan you never discounted that far. The commission rate math assumes the buyer and the earner are different people; self-referral breaks that assumption.

The signal: the customer's email matches the affiliate's login email, or the email on their PayPal or Wise payout account. Check all three, because affiliates often sign up with a work address and get paid to a personal one. Flag matches automatically and hold the commission for review rather than approving it silently.

Anderro's self-referral detection compares the customer email with the affiliate's login, PayPal and Wise emails on every plan. Whatever tool you use, put a one-line ban in your terms so you have grounds to reverse the commission when you find one.

Step 4: Deduplicate clicks and alert on IP clusters

Click inflation looks like 3,000 clicks in a day from one IP range and zero conversions. It rarely costs you commission directly if you pay on revenue, but it pollutes your data: inflated click counts make an affiliate look like a top performer when they ask for a higher tier, and they bury real traffic patterns.

The controls:

• Count one click per visitor per day, so refreshing a link 500 times registers once.
• Rate-limit clicks per IP.
• Alert when a large share of an affiliate's clicks comes from one IP cluster, then review before acting.

Cookie stuffing is harder. The affiliate drops your referral cookie on visitors who never chose to click: hidden iframes, pop-unders, browser extensions. The tell is conversions from people who were already yours. Pull the affiliate's last ten conversions and check whether the customer had an account or trial before the referral click. If seven of ten did, someone is claiming credit for your own pipeline. A 30-day cookie window gives a stuffer far less to harvest than 90 days, and asking affiliates to list their placements gives you something to verify.

Step 5: Ban brand bidding in your terms, then check weekly

Brand bidding is an affiliate running paid search ads on your company name, sending the click through their link, and collecting commission on someone who was already searching for you. On that $490 annual plan, you just paid $98 for a customer who would have cost $0.

Detection here is manual and cheap. Once a week, search your brand name plus "pricing", "login", "review" and "discount" in a private window. If an ad lands on your site through a referral link, you have your answer. A conversion spike on an affiliate with no visible content is another hint.

The control is a clause in your terms, written before you need it:

• No bidding on your brand name, misspellings, or brand plus any modifier.
• No use of your brand in ad copy or display URLs.
• Commissions earned in violation are reversed, and the affiliate is removed.

Where this goes wrong

The controls above backfire in predictable ways.

Holds longer than the refund window. A 90-day hold on a monthly plan with a 14-day guarantee means a good affiliate waits three months for their first payout. They leave. Match the window; don't exceed it without a chargeback reason.

Relying on clawbacks alone. A negative adjustment only recovers money if the affiliate keeps earning. A fraudster with one $98 commission and no future sales leaves you holding a balance you will never collect. The hold period is the primary control; the clawback is the backstop.

Banning on IP clusters without review. Coworking spaces, university networks and corporate VPNs put many real people behind one address. A newsletter forwarded inside a 200-person company looks like a cluster. Read the conversions before you remove anyone.

Treating a clean email match as proof of innocence. An affiliate who buys with a partner's email passes the check. Steps 1 and 2 still limit the damage.

Terms you never enforce. A brand-bidding ban you don't check weekly is decoration, and affiliates figure that out quickly.

Do this today: look up the longest refund window you honor, set your hold period to that number, and confirm that a refund after payout creates a negative adjustment on the next payout. Detection rules can wait until next week.