Affiliate click fraud: how to detect it and stay compliant

Affiliate click fraud is any click or conversion manufactured to collect a commission that is not owed: bots tapping links, extensions that rewrite them at the last second, leaked coupons or bought traffic that never buys. Because affiliate pays on results, that fraud ends in rejected commissions, withheld payments and closed campaigns, even when the publisher did not cause it.

What is affiliate click fraud and why does it affect you?

In display advertising, fraud inflates impressions and clicks an advertiser pays for without getting anything back; we cover it in invalid traffic and ad fraud. In affiliate the goal is different: claiming a sale that was not generated, or generating clicks that look like buying intent. What is at stake is the commission, and the brand that pays it reviews every conversion before confirming it.

This article covers the two sides of compliance a publisher controls: keeping traffic clean and respecting disclosure and privacy rules. It is not legal advice; it is a practical guide to know what to ask and what to demand from the platform you work with.

Which types of fraud affect a publisher?

• Non-human clicks: crawlers, bots and monitoring tools that follow links. They never buy, but they inflate clicks and can trigger alarms at the brand.
• Forced clicks: hidden frames or automatic redirects that record a click the reader never asked for. They are banned in practically every program.
• Link hijacking: browser extensions that swap your link for theirs right before checkout and keep your commission.
• Leaked coupons: a code meant for your audience ends up on coupon sites and the brand stops crediting you for those sales.
• Incentivized or bought traffic that arrives with no real intention to buy.

Publishers rarely originate these practices, but they often pay the price if nobody filters them: rejected commissions, withheld payments or removal from a campaign that was actually working for them.

How is affiliate click fraud detected?

• Count only what a person could see: an impression exists when the module was on screen long enough, not when the code ran.
• Sign every click: the link carries a server-issued code that expires and cannot be forged.
• Discard duplicates: several clicks from the same browser on the same link within a short time count as one.
• Flag instead of deleting: a suspicious click is logged with its reason and excluded from payment, so it can be reviewed later.
• Count each sale only once, even if the store's notification arrives more than once.

None of these defenses is exotic. You can check all of them by asking the platform how it handles them and looking at its reports. If it cannot answer, that is a signal.

Disclosure: what regulators expect

Consumer authorities in the United States, the European Union and much of Latin America agree on the essentials: any commercial relationship must be disclosed clearly and visibly, close to the content, without depending on the reader hovering over something or opening a dropdown. A note hidden at the bottom of the page is not enough.

For a publisher, the right practice is simple. Every commercial module shows the word “Sponsored”, every affiliate link is marked with rel="sponsored", which is what Google asks for on paid links, and buying guides carry an affiliate note at the top, not at the end.

Privacy: why a cookie-free format helps

European privacy rules and some US state laws require consent for cookies and equivalent technologies that are not strictly necessary. An affiliate module that stores an identifier in the reader's browser to follow them across pages falls squarely into that category and complicates your consent banner. We go over the context in consent and privacy in monetization.

The alternative is a format designed not to need any of that: no cookies on your site, no reader profiles, with the click identified in the link itself. Cookies the store sets on its own pages are its responsibility. Even so, every site is a case of its own, and it is worth reviewing it with a professional in your country.

Each program's own rules

Every brand has its rules: no buying search ads on its name, no unauthorized coupons, no promotion in certain categories or markets. A publisher should be able to see those restrictions before an offer is shown, not discover them when sales get rejected.

It is also worth reading each campaign's terms: some ban links in newsletters or on social media, others require the displayed price to stay up to date. When the platform gathers those rules and stops showing what does not comply, the publisher does not have to read every program's fine print.

An affiliate click fraud checklist

• Impressions counted only when viewable.
• Clicks signed with a code that expires.
• Duplicate clicks discarded and exclusion reasons visible.
• Sales counted once even if the notification repeats.
• “Sponsored” on every module and rel="sponsored" on every link.
• An affiliate note at the top of buying guides.
• No reader identifier stored in their browser.

A publisher who can answer these questions works with peace of mind, gets paid what they generate and keeps their readers.

How ADQ Links, ADEQ's affiliate product, handles it

In ADQ Links every click identifies the originating site and is signed, and bot clicks and repeated clicks are discarded. We work as a transparent sub-network: the brand always knows which site its offer appeared on. Only live campaigns from real brands are shown, on sites reviewed one by one, and a campaign that is paused, expired or not selling in the reader's country does not appear.

Every placement carries a “Sponsored” label and every link rel="sponsored nofollow". The formats set no cookies on your site and build no reader profiles: each offer is chosen by page topic and country. And everything is managed from your ADEQ panel, with the same report and the same payment.

Frequently asked questions

Am I responsible if a bot clicks my links?

You almost never cause the problem, but the brand can withhold payments or close the campaign if that traffic is not filtered. That is why it pays to work with a platform that flags suspicious clicks with their reason and excludes them before they reach the brand.

Is it enough to write “affiliate link” at the end of the article?

No. Regulators ask for disclosure close to the content and visible without scrolling or opening anything. The usual approach is a note at the top of the guide and a “Sponsored” label on every module.

How do I know if someone is hijacking my links?

The typical sign is clicks that do not match the sales credited to you, especially with very well-known stores. Compare your clicks with conversions per store and ask your platform what it detects; when the pattern is clear, the brand can investigate it.