Methodology
We don’t infer fraud. We capture it.
Analytics can tell you something looks wrong. It can’t show your network, your board or your partner exactly what happened. Our method is built around reproducible evidence: observed behaviour, recorded as it happens, with a clear chain of reasoning from capture to conclusion.
Intake & scoping
We start with how your programme is meant to work: terms, commission tiers, cookie windows, validation periods, deduplication rules and tracking set-up. Then we look at where the numbers and the rules disagree.
Together we agree the hypotheses to test, the partners in scope and what “proven” needs to look like for you to act.
Inputs
- Programme terms & network contract
- Partner list, tiers & payouts
- Network click & transaction exports
- Order and analytics data (optional)
- Tag manager container (optional)
Evidence capture
We encounter your partners the way your customers do: across devices, browsers, locations and installed extensions. Every session is instrumented, so we record not only what’s visible on screen but every request, redirect, cookie write and script execution behind it.
Where cloaking is suspected, we vary geography, device fingerprint, referrer and time of day until the behaviour shows itself.
Techniques
- Instrumented & headless browser sessions
- Full network traffic capture (HAR)
- Redirect-chain & referrer tracing
- Cookie write timing & origin
- Extension & toolbar test environments
- Geo / device / time variation
- Paid-search brand-term surveillance
Analysis & attribution rebuild
Captured behaviour tells us how. Your data tells us how much. We reconcile clicks, cookies and orders to reconstruct real customer journeys, then measure the share of each partner’s commission that is invalid, non-incremental or simply unexplained.
Every partner ends up with a risk score, the evidence behind it, and an estimate of the money involved.
Analysis
- Click-to-conversion latency profiling
- Last-click overwrite detection
- Existing-customer overlap
- Device & identity clustering
- Sub-ID and sub-network tracing
- Tag firing vs traffic source
Report, recovery & prevention
Findings are written for decision-makers and evidenced for scrutiny. Each one has a recommended action, whether that’s reversing commission, renegotiating terms, removing a partner, fixing tracking or simply monitoring.
We then help you carry out those actions, from network submissions to tightening terms so the same leak can’t reopen.
Outputs
- Executive summary
- Partner risk ledger
- Per-partner evidence packs
- Quantified impact model
- Remediation & terms recommendations
- Debrief with your team
Principles
How we hold ourselves to account.
Reproducible
Every finding is timestamped, recorded and documented so someone else could follow the same steps and see the same thing.
Proportionate
We separate proven abuse from suspicious-but-unproven patterns, and tell you which is which. We don’t inflate findings to justify the fee.
Confidential
All work is under NDA. Your data stays in scope, is held securely and is deleted at the end of the engagement unless you ask otherwise.
Next step
Let’s scope your investigation.
Share a little about your programme and what’s concerning you. We’ll suggest the lightest-touch way to get a definitive answer.