How do I know a partner is not just referring themselves?

Referly compares the affiliate's email against the buyer's, and the affiliate's signup IP against the IP on the referral's first click. A match holds the commission with the matched field named on the row, or rejects it outright, depending on which action you chose.

Does it actually stop the fraud, or just flag it?

It stops the payment, which is the part that costs you money. A held commission never becomes payable and never enters a payout batch until you release it. Referly does not block the sale or ban the affiliate on its own; those are your decisions.

Can it detect cookie stuffing or brand bidding?

Not automatically, and no affiliate platform can from the sale record alone. What Referly gives you is the evidence: referrer domain and type, the ad click ids, the click-to-referral ratio and the unique-click flag. Those make both patterns visible, and your program terms make them enforceable.

Is there a risk score or an AI model behind this?

No, and we would rather say so. There are two deterministic checks, email and IP, and a complete click record you can read yourself. A score you cannot inspect is not evidence you can act on when an affiliate disputes a decision.

My whole office shares one IP. Will that flag everyone?

It can, which is why the default action is to hold for review rather than reject. A shared office or NAT address will produce matches you should release. If it happens constantly, turn IP matching off and keep email matching, or mark the referral to skip future checks.

What happens to a commission I decline?

It moves to DECLINED and never becomes payable. The affiliate's pending balance drops accordingly. You can also deactivate the affiliate, which holds their future commissions, or ban them, which stops them earning at all.

Does a refund claw the commission back?

Yes, automatically. The refund is detected from your payment platform, the commission is reversed and the affiliate's pending balance drops by that amount. Setting a holding period to match your refund window means the reversal almost always lands before any payout does.

Is fraud protection on the cheapest plan?

Yes. Fraud protection, automatic refund detection, link tracking and coupon tracking are all on the $75 Startup plan. The only related thing that starts on Business is automatic coupon generation, which is what carries the anti-leakage rules on a code.

Affiliate fraud detection

Stop paying for sales you already had

A customer signs up as their own affiliate and takes 20% off. It is the most common way programs leak money, and it looks legitimate. Referly matches email and IP on every referral and holds the payout.

Start free See pricing

On every plan, no fraud tier
Two deterministic checks, no black box
Held before the money moves

Rewards1 on hold

Sam Whitfieldsam.w@otto-sons.com$69.80On Hold

Fraud Prevention

Referral's email matches affiliate's email
Referral's IP address matches affiliate's IP address

AcceptReject

Email + IP matched

Nothing paid yet

The taxonomy

Four ways an affiliate program leaks money

Almost none of it is sophisticated. Most of it is a customer discovering they can refer themselves.

Self-referral
Coupon leakage
Cookie stuffing
Brand bidding

Self-referrals
A customer signs up as an affiliate, uses their own code, and takes 20% off their own purchase. The most common form by a wide margin, and usually not malicious. Someone spots the discount and takes it.
Your affiliate program quietly becomes a discount coupon that you also pay a commission on.
What gives it away
- The affiliate's email is the customer's email
- The signup IP matches the purchase IP
- The account has exactly one referral
Coupon-code leakage
A personal discount code ends up on a coupon aggregator. Every checkout that was already going to happen now carries a discount and a commission, and the affiliate did nothing.
The expensive one for ecommerce brands, because the volume is real traffic that was already yours.
What gives it away
- Sudden redemption volume with no matching click traffic
- Orders with no referring click at all
- Redemptions concentrated on one code
Cookie stuffing
A site drops your affiliate cookie on visitors who never clicked, through a hidden iframe, a 1×1 image or a redirect chain. Any purchase for the next sixty days looks referred.
You pay commission on organic and paid customers you had already acquired.
What gives it away
- A very high click count with a very low click-to-referral rate
- Referring domains unrelated to your product
- Clicks that never render a page view
Brand bidding
An affiliate buys search ads on your brand name, sits above your own organic result, and collects commission on people who were already looking for you.
You pay twice: once in the ad auction they push you up in, once in commission.
What gives it away
- Paid-search referrers
- A gclid or msclkid on the click record
- A conversion rate far above every other partner

What Referly catches

Self-referrals get caught before the payout

Two comparisons on every referral, then whatever you told Referly to do about a match.

One referral, checked

Devon signs up as an affiliate, then buys with his own code. Here is what Referly compares.

When detected

Commission $69.80 on order #4821Held for your review

Reason on the row: email and IP matched.

These are the only two checks that exist. Cookie stuffing and brand bidding produce no verdict here, because Referly evidences them rather than detecting them.

Self-referrals get caught automatically by email and IP matching, then held for your review or rejected outright.

Email matching
The affiliate's own email address against the referred customer's.
IP matching
The affiliate's signup IP against the IP recorded on the referral's first click.
Your choice of action
Hold the commission for review, or reject it automatically. You pick, per program.
No accusation
The affiliate never sees a flagged screen. They see a commission that is still pending.

Fraud protection is on every plan, including the $75 Startup plan. There is no fraud tier.

The evidence

Every click arrives with its paperwork

Referly stores what happened, not just that it happened. Referrer, country, device, ad click id and VPN status are on every click.

A partner bidding on your brand name arrives with a gclid and a Google paid referrer. You do not need a detector to see that. You need the field, and the field is there.

What else a click records

Network: IP, GeoIP country, region, city and ISP, with proxy and VPN flags
Source: Referrer URL, parsed domain, and a referrer type classification
Campaign: utm_source, utm_medium, utm_campaign, utm_term, utm_content
Ad click ids: gclid, gbraid, wbraid, fbclid, msclkid, ttclid, twclid, li_fat_id
Destination: Full landing URL, pathname and query string
Device: User agent, browser, OS, device type, screen and viewport, language
Uniqueness: Device id and a unique-click flag

Click #82,104

3 Feb 2026, 14:22 UTC · Devon Reyes

VPN detected

Network

IP: 81.2.44.19
Location: Frankfurt, DE
ISP: Deutsche Telekom
VPN: Detected

Source

Referrer: google.com
Type: paid search
gclid: Cj0KCQiA…

Campaign

utm_source: google
utm_medium: cpc
utm_campaign: brand

Destination

Landing: /pricing?ref=devon
Device: Chrome 132 · macOS
Viewport: 1512 × 982

Nothing above fired a rule. The red fields are the record telling you what this click was, so you can decide what to do about it.

Coupon rules

Rules that stop a code becoming a public discount

Auto-generated codes carry rules, so a leaked code stops being profitable to leak.

Business and up

First-time orders only
Aggregator traffic is mostly returning customers. This removes most of it.
Minimum order value
Kills the small basket that costs more to fulfil than it earns.
Expiry date
A leaked code gets a shelf life instead of a lifetime.
Redemption limit
A hard ceiling on how many times one code can be used.
Allowed groups
Codes only mint for the partner groups you chose, not everyone who joins.
Personal code structure
Built from a prefix plus the affiliate's name, email, discount or random characters, so codes are personal rather than guessable.

Coupon tracking itself is on every plan, including Startup. Minting codes automatically, which is what carries these rules, starts on Business.

How coupon tracking works

The honest table

What we catch, and what we only show you

Two of these four are caught automatically. For the other two, Referly gives you the evidence and the controls, and you make the call.

Threat	Detected automatically	Evidence you get	Your move
Self-referral	Email and IP matching	The matched field is named on the hold	Release, decline, or ban
Coupon leakage	Not automatic	Redemptions with no matching click, and per-code redemption counts	Tighten the code rules, or rotate the code
Cookie stuffing	Not automatic	Click-to-referral ratio, referrer domain and type, unique-click flag	Decline, ban, enforce your terms
Brand bidding	Not automatic	Paid referrer, gclid or msclkid, UTM medium, landing page	Enforce your terms, decline

Referly has no machine-learning risk score and does not monitor search-ad auctions for your brand name. What it has is a complete click record, an approval step before money moves, and rules you set yourself.

The gap

Nothing gets paid before you say so

Commissions sit in an approval state, behind a holding period, until they are payable.

Refunded sales are detected automatically and the matching commission is reversed, so you never pay out on refunded revenue.

How the holding period works The terms that make this enforceable

Approval states
Every commission is ON HOLD, ACCEPTED or DECLINED. Nothing pays out from a hold.
Named hold reasons
Program settings, fraud prevention, affiliate deactivated or affiliate banned. The row tells you which rule fired.
Holding period
Keeps every commission unpayable until your refund window has passed, whatever its approval state.
Refund reversal
A refunded sale is detected automatically and the matching commission is reversed.
Deactivate or ban
An affiliate's future commissions hold, or stop being earned entirely.
Bot protection
Portal signup sits behind reCAPTCHA, so the affiliate list itself is not farmed.

“I spend all day testing out sign up flows and campaigns. I have tried most affiliate platforms out there, but very few are as easy and powerful as Referly. Quick setup and accurate tracking.”

Kasper WoodAffiliate Content Manager

Availability

Fraud and approval features by plan

The detection itself is not a paid tier. Only the coupon-rule automation is gated.

Feature	Startup	Business	Enterprise
Fraud protection
Automatic refund detection
Coupon code tracking
Link tracking
Automatic coupon generation
Affiliate groups and segmentation

Fraud protection, refund detection and coupon tracking are on every plan, including Startup. Automatic coupon generation, which carries the anti-leakage rules, starts on Business.
Referly takes 0% of your sales on every plan, so a held commission costs you nothing to hold.

Compare all plans

FAQ

Before you connect anything

The questions founders ask in the first ten minutes.

Start for free Book a demo

14-day free trial · No credit card required · Cancel anytime

Referly compares the affiliate's email against the buyer's, and the affiliate's signup IP against the IP on the referral's first click. A match holds the commission with the matched field named on the row, or rejects it outright, depending on which action you chose.

Where this bites hardest

Explore

The rest of the platform

Tracking and attribution

Commissions and rewards

Commission plansPercentage or flat, one-off or every renewal, per partner or per product.

Payouts, tax and invoicing

Your branded affiliate portal

Recruiting and growth

Engage add-on

Messaging and announcementsTalk to your partners inside the portal they already use.

Gamify add-on

GamificationLeaderboards, contests and bonuses for the quiet ninety percent.

Program essentials

Analytics and reportingSee which partners actually sell, by fourteen dimensions.

Integrations and developers

API and webhooksA real REST API, and fifteen webhook events.

Affiliate fraud detection

Stop paying for sales you already had

Start free See pricing

On every plan, no fraud tier
Two deterministic checks, no black box
Held before the money moves

Rewards1 on hold

Sam Whitfieldsam.w@otto-sons.com$69.80On Hold

Fraud Prevention

Referral's email matches affiliate's email
Referral's IP address matches affiliate's IP address

AcceptReject

Email + IP matched

Nothing paid yet

The taxonomy

Four ways an affiliate program leaks money

Almost none of it is sophisticated. Most of it is a customer discovering they can refer themselves.

Self-referral
Coupon leakage
Cookie stuffing
Brand bidding

Self-referrals
A customer signs up as an affiliate, uses their own code, and takes 20% off their own purchase. The most common form by a wide margin, and usually not malicious. Someone spots the discount and takes it.
Your affiliate program quietly becomes a discount coupon that you also pay a commission on.
What gives it away
- The affiliate's email is the customer's email
- The signup IP matches the purchase IP
- The account has exactly one referral
Coupon-code leakage
A personal discount code ends up on a coupon aggregator. Every checkout that was already going to happen now carries a discount and a commission, and the affiliate did nothing.
The expensive one for ecommerce brands, because the volume is real traffic that was already yours.
What gives it away
- Sudden redemption volume with no matching click traffic
- Orders with no referring click at all
- Redemptions concentrated on one code
Cookie stuffing
A site drops your affiliate cookie on visitors who never clicked, through a hidden iframe, a 1×1 image or a redirect chain. Any purchase for the next sixty days looks referred.
You pay commission on organic and paid customers you had already acquired.
What gives it away
- A very high click count with a very low click-to-referral rate
- Referring domains unrelated to your product
- Clicks that never render a page view
Brand bidding
An affiliate buys search ads on your brand name, sits above your own organic result, and collects commission on people who were already looking for you.
You pay twice: once in the ad auction they push you up in, once in commission.
What gives it away
- Paid-search referrers
- A gclid or msclkid on the click record
- A conversion rate far above every other partner

What Referly catches

Self-referrals get caught before the payout

Two comparisons on every referral, then whatever you told Referly to do about a match.

One referral, checked

Devon signs up as an affiliate, then buys with his own code. Here is what Referly compares.

When detected

Commission $69.80 on order #4821Held for your review

Reason on the row: email and IP matched.

These are the only two checks that exist. Cookie stuffing and brand bidding produce no verdict here, because Referly evidences them rather than detecting them.

Self-referrals get caught automatically by email and IP matching, then held for your review or rejected outright.

Email matching
The affiliate's own email address against the referred customer's.
IP matching
The affiliate's signup IP against the IP recorded on the referral's first click.
Your choice of action
Hold the commission for review, or reject it automatically. You pick, per program.
No accusation
The affiliate never sees a flagged screen. They see a commission that is still pending.

Fraud protection is on every plan, including the $75 Startup plan. There is no fraud tier.

The evidence

Every click arrives with its paperwork

Referly stores what happened, not just that it happened. Referrer, country, device, ad click id and VPN status are on every click.

A partner bidding on your brand name arrives with a gclid and a Google paid referrer. You do not need a detector to see that. You need the field, and the field is there.

What else a click records

Network: IP, GeoIP country, region, city and ISP, with proxy and VPN flags
Source: Referrer URL, parsed domain, and a referrer type classification
Campaign: utm_source, utm_medium, utm_campaign, utm_term, utm_content
Ad click ids: gclid, gbraid, wbraid, fbclid, msclkid, ttclid, twclid, li_fat_id
Destination: Full landing URL, pathname and query string
Device: User agent, browser, OS, device type, screen and viewport, language
Uniqueness: Device id and a unique-click flag

Click #82,104

3 Feb 2026, 14:22 UTC · Devon Reyes

VPN detected

Network

IP: 81.2.44.19
Location: Frankfurt, DE
ISP: Deutsche Telekom
VPN: Detected

Source

Referrer: google.com
Type: paid search
gclid: Cj0KCQiA…

Campaign

utm_source: google
utm_medium: cpc
utm_campaign: brand

Destination

Landing: /pricing?ref=devon
Device: Chrome 132 · macOS
Viewport: 1512 × 982

Nothing above fired a rule. The red fields are the record telling you what this click was, so you can decide what to do about it.

Coupon rules

Rules that stop a code becoming a public discount

Auto-generated codes carry rules, so a leaked code stops being profitable to leak.

Business and up

First-time orders only
Aggregator traffic is mostly returning customers. This removes most of it.
Minimum order value
Kills the small basket that costs more to fulfil than it earns.
Expiry date
A leaked code gets a shelf life instead of a lifetime.
Redemption limit
A hard ceiling on how many times one code can be used.
Allowed groups
Codes only mint for the partner groups you chose, not everyone who joins.
Personal code structure
Built from a prefix plus the affiliate's name, email, discount or random characters, so codes are personal rather than guessable.

Coupon tracking itself is on every plan, including Startup. Minting codes automatically, which is what carries these rules, starts on Business.

How coupon tracking works

The honest table

What we catch, and what we only show you

Two of these four are caught automatically. For the other two, Referly gives you the evidence and the controls, and you make the call.

Threat	Detected automatically	Evidence you get	Your move
Self-referral	Email and IP matching	The matched field is named on the hold	Release, decline, or ban
Coupon leakage	Not automatic	Redemptions with no matching click, and per-code redemption counts	Tighten the code rules, or rotate the code
Cookie stuffing	Not automatic	Click-to-referral ratio, referrer domain and type, unique-click flag	Decline, ban, enforce your terms
Brand bidding	Not automatic	Paid referrer, gclid or msclkid, UTM medium, landing page	Enforce your terms, decline

The gap

Nothing gets paid before you say so

Commissions sit in an approval state, behind a holding period, until they are payable.

Refunded sales are detected automatically and the matching commission is reversed, so you never pay out on refunded revenue.

How the holding period works The terms that make this enforceable

Approval states
Every commission is ON HOLD, ACCEPTED or DECLINED. Nothing pays out from a hold.
Named hold reasons
Program settings, fraud prevention, affiliate deactivated or affiliate banned. The row tells you which rule fired.
Holding period
Keeps every commission unpayable until your refund window has passed, whatever its approval state.
Refund reversal
A refunded sale is detected automatically and the matching commission is reversed.
Deactivate or ban
An affiliate's future commissions hold, or stop being earned entirely.
Bot protection
Portal signup sits behind reCAPTCHA, so the affiliate list itself is not farmed.

“I spend all day testing out sign up flows and campaigns. I have tried most affiliate platforms out there, but very few are as easy and powerful as Referly. Quick setup and accurate tracking.”

Kasper WoodAffiliate Content Manager

Availability

Fraud and approval features by plan

The detection itself is not a paid tier. Only the coupon-rule automation is gated.

Feature	Startup	Business	Enterprise
Fraud protection
Automatic refund detection
Coupon code tracking
Link tracking
Automatic coupon generation
Affiliate groups and segmentation

Fraud protection, refund detection and coupon tracking are on every plan, including Startup. Automatic coupon generation, which carries the anti-leakage rules, starts on Business.
Referly takes 0% of your sales on every plan, so a held commission costs you nothing to hold.

Compare all plans

FAQ

Before you connect anything

The questions founders ask in the first ten minutes.

Start for free Book a demo

14-day free trial · No credit card required · Cancel anytime

Referly compares the affiliate's email against the buyer's, and the affiliate's signup IP against the IP on the referral's first click. A match holds the commission with the matched field named on the row, or rejects it outright, depending on which action you chose.

Where this bites hardest

Explore

The rest of the platform

Tracking and attribution

Commissions and rewards

Commission plansPercentage or flat, one-off or every renewal, per partner or per product.

Payouts, tax and invoicing

Your branded affiliate portal

Recruiting and growth

Engage add-on

Messaging and announcementsTalk to your partners inside the portal they already use.

Gamify add-on

GamificationLeaderboards, contests and bonuses for the quiet ninety percent.

Program essentials

Analytics and reportingSee which partners actually sell, by fourteen dimensions.

Integrations and developers

API and webhooksA real REST API, and fifteen webhook events.

Affiliate fraud detection

Four ways an affiliate program leaks money

Self-referrals

Coupon-code leakage

Cookie stuffing

Brand bidding

Self-referrals get caught before the payout

Email matching

IP matching

Your choice of action

No accusation

Every click arrives with its paperwork

Rules that stop a code becoming a public discount

First-time orders only

Minimum order value

Expiry date

Redemption limit

Allowed groups

Personal code structure

What we catch, and what we only show you

Nothing gets paid before you say so

Approval states

Named hold reasons

Holding period

Refund reversal

Deactivate or ban

Bot protection

Fraud and approval features by plan

Before you connect anything

Read next

Where this bites hardest

The rest of the platform

Affiliate fraud detection

Four ways an affiliate program leaks money

Self-referrals

Coupon-code leakage

Cookie stuffing

Brand bidding

Self-referrals get caught before the payout

Email matching

IP matching

Your choice of action

No accusation

Every click arrives with its paperwork

Rules that stop a code becoming a public discount

First-time orders only

Minimum order value

Expiry date

Redemption limit

Allowed groups

Personal code structure

What we catch, and what we only show you

Nothing gets paid before you say so

Approval states

Named hold reasons

Holding period

Refund reversal

Deactivate or ban

Bot protection

Fraud and approval features by plan

Before you connect anything

Read next

Where this bites hardest

The rest of the platform