Affiliate Fraud: What It Is and How It Becomes a Chargeback
Affiliate fraud is any attempt to generate fake commissions or referrals by manipulating an affiliate program, through tactics like cookie stuffing, click fraud, or fake leads. Sometimes the fraud involves a real purchase, say a stolen card used to trigger a commission. The merchant who fulfilled that order fights the chargeback that follows.
When I worked chargeback support, the disputes that came in through an affiliate link were the hardest to trace. Merchants assumed the network's fraud tools had already screened that traffic, so nobody pulled the referral data the reason code asked for.
Read this once and you'll know which four pieces of evidence to gather before you answer one of these disputes.
Key takeaways
Want to catch these before they file? Our dispute alerts reach you while a refund still closes the case.
What is affiliate fraud?
Affiliate fraud is the deceptive manipulation of an affiliate program to generate commissions the affiliate never legitimately earned. It covers everything from a browser script that fakes a referral to a stolen-card purchase run through a partner link.
It works because affiliate programs pay on attributed clicks or sales. Attribution runs on cookies, referral links, and promo codes, and anyone can fake all three.
If you can fake the attribution, you get paid, and no real buyer has to exist.
One version of this costs you more than a wasted commission. A real affiliate can refer a buyer paying with a stolen card, without knowing it. You end up answering one of the standard types of chargebacks with your name on it.
Common affiliate fraud tactics
Cookie stuffing, click fraud, fake leads, and typosquatting are the four tactics affiliate managers watch for, split by whether the fraud fakes the traffic or the buyer. Only one of them ends in a chargeback you have to answer:
- Cookie stuffing: Dropping affiliate cookies on visitors who never clicked a link.
- Click fraud: Generating fake clicks to inflate traffic-based payouts.
- Fake leads and sales fraud: Submitting invented signups, or real purchases funded by stolen cards.
- Typosquatting: Registering misspelled versions of your domain to catch buyers already headed to you.
The first two are covered together below, since they attack the same attribution layer.
1. Cookie stuffing and click fraud
Cookie stuffing plants an affiliate tracking cookie in a visitor's browser without that visitor ever clicking an affiliate link. Click fraud is the traffic-side version, where bots or paid clickers hit an affiliate link to inflate a per-click payout.
Both attack attribution rather than payment. A stuffed cookie waits in the browser until the visitor buys on their own. Your tracking then pays the affiliate for a sale you already had. Click fraud never involves a buyer, so it only pays out under a cost-per-click deal.
Neither one ends in a chargeback. Nobody's card was charged without their permission, so no cardholder has anything to dispute. What you lose is commission on sales you already owned.
2. Fake leads and stolen-card sales fraud
Fake leads are invented signups submitted to collect a per-lead payout, and sales fraud is the same idea taken all the way to a completed purchase. A lead-gen program pays for a form fill, so a fraudster fills forms with made-up names and throwaway emails.
Sales fraud is where real money moves. The affiliate needs a finished order to earn a commission, so they place one with a stolen card. Your store takes a real payment, ships real goods, and pays a real commission on it.
Every part of that transaction looks clean at the time. The card authorizes, the address validates, the tracking fires correctly, and the affiliate gets paid on schedule.
Then the actual cardholder sees the charge.
3. Typosquatting and brand impersonation
Typosquatting is registering domains that misspell your brand, then routing the traffic through an affiliate link to claim commission on customers who were already coming to you. Brand impersonation is the broader version, covering ads, social profiles, or coupon sites that use your name to look official.
The damage here is stolen attribution rather than payment fraud. A buyer who typed your brand into the address bar lands on a near-miss domain, gets sent on through a partner link, and buys from you anyway. You pay a commission on a customer the affiliate did nothing to win.
One case is worth watching, impersonation that takes payment directly. A fake storefront collects card details under your brand name. Those buyers call their bank about a charge from a business they think is you.
Your support team handles those calls even though the payment never touched your processor.
How affiliate fraud turns into a chargeback
When an affiliate-driven sale is funded by a stolen card, the cardholder disputes the charge and that dispute lands on you. You shipped the order, so you're the merchant of record on the transaction the bank reverses. The affiliate and the network stay out of it.
Networks screen for commission abuse, meaning fake clicks, duplicate cookies, and bot-made leads. Card checks sit outside their scope, because the purchase isn't their transaction.
A stolen card can pass every check the network runs and still be stolen.
Say an affiliate sends you a sale funded by a stolen card. The click looks organic, the order converts, and the network pays the commission on schedule. Six weeks later the real cardholder reads their statement and calls their issuer. By the time you hear about it you're out:
- The goods you shipped.
- The sale itself, reversed by the bank.
- The chargeback fee, win or lose.
- The commission you already paid the affiliate.
That's the bill three of the four tactics never hand you, which is why teams file the whole category under marketing and miss the stolen-card version. One industry study put the total cost at over $3.4 billion globally in 2022.
Which reason code applies to an affiliate-fraud sale?
A stolen-card affiliate sale disputes under the ordinary fraud reason code family, most often Visa 10.4 or Mastercard 4837. The dispute reason code, also called a chargeback reason code, describes what happened to the payment. The marketing channel behind the sale gets a label only in your own reporting.
Card networks sort disputes by what failed in the payment itself. Visa 10.4 covers a card-absent sale the cardholder says they never approved. Mastercard 4837 is the matching no-cardholder-authorization code.
The issuer sees a card-not-present order the cardholder disowns, with no trace of your affiliate link in the record. Check the exact code on your dispute notice against our reason code lookup tool to confirm which evidence it asks for.
Our guide to true fraud has the full mechanics of that code family.
One branch changes your evidence entirely. When the buyer says they never agreed to a recurring charge on an affiliate signup, the dispute arrives under a cancelled-recurring code. The bank then wants your cancellation terms and your consent record.
How to fight a chargeback that started with affiliate fraud
Gather the referral log, the device and shipping details, delivery confirmation, and the account's order history before you write your response. That's the 4-Point Affiliate Chargeback Evidence Check, and each point answers something the bank will otherwise hold against you. You can pull all four from systems you already run:
- Pull the affiliate referral log: Shows how the order came in.
- Check device and shipping mismatches: Flags the pattern behind the fraud.
- Confirm delivery or fulfillment: Rebuts a "never got it" claim.
- Review prior order history: Tells a one-time buyer from a repeat.
Work them in that order, because each one narrows what the next has to prove.
1. Pull the affiliate referral log
Export the referral record for the disputed order from your affiliate platform, showing the partner ID, click timestamp, landing page, and the gap between click and purchase. In most affiliate tools this sits under a per-transaction or conversion report.
The monthly commission summary won't have it.
The referral log names the affiliate who sent the order, which an anonymous fraud dispute never does. You also see whether the click came seconds or days before the sale.
A cluster of same-day sales through one affiliate is the signal worth acting on.
Pull the log before you respond to the dispute. Some platforms delete granular click data on a rolling window, so the record you need can expire while you draft.
2. Check device and shipping mismatches against the account
Compare the billing address, shipping address, device fingerprint, and IP location on the disputed order against every other order from that account. Your payment processor's dashboard has most of this. Stripe records IP, device, and the AVS and CVC results on each charge.
Mismatches are what make a fraud-code response credible. A billing country that differs from the shipping country, a first-time device, a same-day affiliate click. That combination is what a stolen-card order usually looks like.
The reverse finding matters just as much. When the device, address, and IP all match how that account normally buys, first-party misuse is the more likely explanation than true fraud.
A matching device and address point you toward a different response entirely.
3. Confirm delivery or service fulfillment
Attach carrier tracking showing delivery to the verified address, or, for digital goods, the access and usage logs tied to the account. Tracking is what a 10.4 or 4837 response needs, because an order confirmation or an invoice only proves you took the order.
Delivery proof rules out the simplest cardholder story, that nothing ever arrived. That leaves the question of who placed the order.
For a digital product, login timestamps, login IP addresses, and usage after purchase do the same job.
Signed delivery to the cardholder's own billing address is the strongest version. Delivery to a freight forwarder or a reshipping address is weak, and on its own it tends to confirm the fraud.
4. Review the account's prior order history
Check whether the account has ordered before, whether those orders were disputed, and whether other accounts share its card, device, or shipping address. Two or more clean prior purchases from the same buyer change how a fraud dispute reads.
History tells you whether you're fighting an incident or a pattern.
A single stolen-card order through an affiliate link is a cost of doing business. Five of them from one affiliate in a month is an affiliate problem.
When the pattern repeats, pause that affiliate and hold their unpaid commissions. Send their next orders to manual approval, and check the billing and shipping match and the device history on each one.
All four points work after the fraud is done, and the chargeback fee lands whether you win or lose. They also build the packet for a fraud code, so the cancelled-recurring branch above needs your cancellation terms instead.
That's the argument for catching the order earlier. A pre-dispute alert from Ethoca or Verifi reaches you while the complaint is still with the bank. You can refund the order and close it before it becomes a chargeback. We built our alerts to catch exactly that window.
If the dispute has already filed, our chargeback rebuttal template gives you the structure for the packet these four points feed.
Card networks also watch how many fraud disputes you take, and affiliate-driven ones count the same as any other toward Visa's monitoring program thresholds.
FAQ
Is affiliate fraud common in affiliate marketing?
Common enough to carry real money. CHEQ's 2022 study put global affiliate marketing fraud losses at over $3.4 billion.
Can a merchant get in trouble for an affiliate's fraud?
Yes, indirectly. You carry the ratio and the processor scrutiny that follows, including under Visa's Acquirer Monitoring Program (VAMP), while the affiliate who sent the order carries neither.
Should you drop an affiliate who sent a fraudulent sale?
Keep them after one incident, since a legitimate affiliate can unknowingly refer a fraudulent buyer. Drop them when the fraud repeats after you've already held their traffic for review.
