Why the CPA model is particularly exposed
In cost-per-action, the advertiser pays not for an impression or a click but for a specific action: a lead, a registration, an app install, a completed order. That ought to protect against fraud better than paying per click — but in practice the fraud simply moved one level up. Instead of inflating clicks, the operators learned to fake the action itself rather than only the traffic leading to it.
The economics of the model make it worse: an affiliate earns per accepted action, so the more actions they deliver, the more they make. That is an honest incentive for an honest partner — bring more real customers. It is exactly the same incentive that pushes a dishonest one to generate actions by any means, including fictitious ones, wherever quality control is weak.
The structure of traffic arbitrage compounds it: between the advertiser and the final source there is usually an affiliate network, and inside it dozens or hundreds of affiliates of varying quality and honesty. Checking each one by hand is unrealistic, and commission accrues on the submitted lead — often before anyone can tell the lead was fake.
The variety of channels matters too. Traffic reaches CPA offers from paid search and social, native and teaser networks, email, push notifications and influencers. Each channel has its own risk profile and its own typical schemes, so there is no universal “check it like this” rule — the approach has to account for the specific source rather than applying one filter to everything.
And the network itself has an interest in the volume flowing through it, and is not always motivated to dig into the quality of every source as long as the formal terms of the offer are met. Responsibility for verifying lead quality ultimately lands on the advertiser; relying solely on the network’s own controls is not always enough.
The types of affiliate fraud
| Type | How it works |
|---|---|
| Fake leads | enquiries with non-existent or stolen contact details, generated by hand or by script |
| Bot orders | automated order placement with no intent to buy, purely for the conversion payout |
| Incentivised traffic disguised as organic | users are paid or otherwise motivated to complete the action, although the programme forbids it |
| Inflation through dummy accounts | the same people or bots register repeatedly under different details |
| Traffic source substitution | an affiliate passes off someone else’s or prohibited traffic as their own to bypass offer restrictions |
| Cookie stuffing | the affiliate is credited with somebody else’s conversions by hijacking attribution, with no real involvement |
Many of these schemes start from the same junk and bot traffic that hits ordinary paid search — the mechanics are in what click fraud is, and the detection signals in how to tell a bot from a human in advertising.
What actually helps
- •Score traffic quality per source and per affiliate, not in aggregate,
- •Validate contact details at the point of submission rather than at the point of payout,
- •Tie commission to confirmed results, with a hold period before payment,
- •Watch the pattern — a sudden change in one source is worth investigating before accusing anyone.
Frequently asked questions
How is CPA fraud different from ordinary click fraud?
In paid search you pay per click, so fraud means inflating clicks. In CPA you pay per action — a lead, a registration, an order — so fraudsters learned to fake the action itself rather than the click. The damage is larger: you are paying for a result that supposedly happened and then have to work out that it did not.
Can fraud in an affiliate programme be eliminated entirely?
Unlikely — the schemes keep evolving alongside the defences. But it can be pushed down to a level where it no longer eats the margin: check lead quality rather than lead count, and pay for confirmed results rather than for submitted forms. That is an ongoing process, not a one-time setting.
If fraud goes up, does that prove the affiliate is a fraudster?
Not necessarily. Sometimes a rise in junk leads comes from one traffic source rather than from the affiliate themselves — their placement may be getting bot traffic without their knowledge. Investigate by source and by pattern rather than accusing a partner on the basis of one anomaly.