AF-01HIGH IMPACT
Cookie stuffing
Affiliate cookies forced onto browsers through hidden iframes, image pixels, pop-unders and auto-redirects, so the publisher gets paid for sales they never influenced.
Independent affiliate fraud investigation
Your affiliate programme is paying for sales it didn’t make.
We investigate affiliate traffic the way forensic accountants investigate ledgers. Cookie stuffing, click hijacking, attribution theft and rogue retargeting are traced to source, documented to evidentiary standard, and turned into recovered budget.
The visibility gap
Your dashboard reports what happened. We find out why.
Network reporting is built to count conversions, not question them. The fraud that costs you most looks exactly like a top-performing partner.
View 01Network dashboard
“Partner 4471 is our best performer.”
Conversions1,240▲ 18%
Conv. rate9.4%▲ 2.1
EPC$2.86▲ 11%
Commission$41.2k▲ 23%
Every metric points the same way: give this partner a higher tier.
View 02Forensic review
“Partner 4471 is harvesting sales you already had.”
- F-01Cookies dropped without a click. A hidden iframe on a high-traffic forum sets the affiliate cookie on page load.
- F-02Conversions cluster seconds after the click. Most of the “clicks” happen on your own checkout page, not the publisher’s.
- F-03Customers were already yours. Order-level matching shows a large share came from existing customers on brand search and email.
Illustrative example of a typical finding pattern.
What we investigate
The fraud catalogue.
Each technique leaves a different trail: in network requests, redirect chains, cookie timing, device signals and order data. We know where each one hides.
AF-02HIGH IMPACT
Click hijacking
Browser extensions, toolbars and malware that intercept the journey at the last moment and overwrite the genuine referrer’s attribution.
AF-03HIGH IMPACT
Clickjacking
Invisible overlays and disguised buttons that trick users into clicking an affiliate link they never saw, manufacturing “clicks” that look legitimate.
AF-04MEDIUM–HIGH
Retargeting script leakage
Third-party and partner tags on your site that fire affiliate pixels, piggyback other scripts, or claim credit for visitors who arrived organically.
AF-05MEDIUM–HIGH
Brand-term bidding
Affiliates buying your trademark on paid search, sometimes with geo or time cloaking so your team never sees the ads, then taking commission on your own customers.
AF-06MEDIUM
Coupon & voucher poaching
Code sites and cashback layers that intercept customers who were already at checkout, paying commission on a sale that was going to close anyway.
AF-07HIGH IMPACT
Lead & conversion fraud
Bot-filled forms, recycled identities, incentivised sign-ups and device farms inflating CPA and CPL programmes with leads that never convert.
AF-08MEDIUM
Sub-affiliate laundering
Low-quality or banned traffic passed through sub-networks and sub-IDs so it arrives looking like an approved, reputable partner.
How an investigation runs
From suspicion to signed-off evidence.
A typical programme audit runs in four phases. You get findings you can act on, not a dashboard you need to interpret.
01
Intake & scoping
We review your programme terms, commission structure, tracking set-up and network data, then agree what we’re looking for and where.
Investigation scope
02
Evidence capture
Controlled browsing environments, publisher crawls, network traffic captures and tag inspection record what actually happens on the wire.
Timestamped captures
03
Analysis & attribution rebuild
We reconcile clicks, cookies and orders, reconstruct the real customer journeys, and measure the commission each partner actually earned.
Partner risk ledger
04
Report & recovery
A written findings report with an evidence pack per partner, quantified impact, and clear actions: reverse, renegotiate, remove or monitor.
Findings report + evidence
Leakage estimator
What could invalid commission be costing you?
Move the sliders to match your programme. The rate you choose is an assumption; an audit replaces it with a measured number.
Unvalidated programmes with voucher, cashback and sub-network exposure tend to sit at the higher end.
Depends on your validation window, network terms and how quickly evidence is presented.
Estimated annual leakage
$50k
paid out for sales your affiliates didn’t drive
$4kper month
$30kpotentially recoverable per year
This is a scenario model, not a quote or a guarantee. Actual leakage varies widely by vertical, network and programme set-up.
Why an outside investigator
Your team runs the programme. We interrogate it.
In-house affiliate managers are measured on growth and partner relationships. That isn’t a failing, but it isn’t investigation either.
The best fraud doesn’t look like fraud. It looks like your best partner.
- /01
Adversarial mindset
We approach every partner the way a fraudster would: how could this commission have been manufactured?
- /02
Forensic tooling
Instrumented browsers, traffic interception, redirect-chain tracing and tag inspection. This is capability most marketing teams don’t have and shouldn’t need to build.
- /03
Independence
No commission, no network affiliation, no partner relationships to protect. Our only incentive is getting the answer right.
- /04
Evidentiary standard
Timestamped, reproducible captures and a clear chain of reasoning, built to stand up in a network dispute, a partner conversation or a board review.
- /05
Prevention, not just detection
We review programme terms, tracking and commission design before launch, so the mistakes are avoided rather than recovered afterwards.
What you receive
A report you can act on the same day.
No raw data dumps. Every finding is quantified, evidenced and tied to a clear recommendation.
- Executive summary: exposure, priority actions and estimated impact, written for the board.
- Partner risk ledger: every publisher scored, with the evidence behind each score.
- Evidence packs: screen recordings, network captures and redirect chains, ready for your network.
- Remediation plan: reversals, term changes, tracking fixes and dedupe rules.
- Debrief session: a walkthrough with your team and, if you want, with your network.
Findings report · AF-0417
Section 3.2: Partner risk CONFIDENTIAL
Section 3.2: Partner risk CONFIDENTIAL
3.2 High-risk partners requiring action
Four partners account for a disproportionate share of flagged commission. In each case, captured evidence shows the affiliate cookie being set without a qualifying user interaction. Recommended action: reverse unvalidated commission and suspend pending review.
| Partner | Technique | Evidence | Flagged |
|---|---|---|---|
| pub_4471 | Cookie stuffing | EX-12, EX-13 | $18,240 |
| pub_6614 | Clickjacking | EX-19 | $9,705 |
| ext:coupon-hlp | Last-click hijack | EX-21–24 | $7,380 |
| pub_3058 | Brand bidding | EX-27 | $4,115 |
Illustrative sample · Figures are fictional
Confidential. No obligation.
Every month unaudited is another month of commission paid out.
Tell us about your programme. We’ll come back within two working days with an initial view and a proposed scope.