Affiliate Fraud Detection for iGaming: What Gets Caught in the First Second, and What Takes a Month

Operators who ask us how affiliate fraud detection works in MAP are nearly always asking a narrower question underneath it, which is whether it would have caught the one partner they are already uneasy about, the one with the conversion rate that nobody on the team can quite account for. Sometimes the answer is yes, inside a second. Sometimes it is yes, but not until the fourth week. And now and again the straight answer is that no software on its own was ever going to catch that one, and a person has to go and have a look.

That spread is the part most people have the wrong picture of. Detection is not one check that runs the once and hands down a verdict. Different kinds of fraud only become visible at different points after the click, some within milliseconds and some only when a chargeback arrives a month later, and each one costs you more the longer it takes to surface. So rather than list checks at you, we are going to go through them in the order they happen, by the clock, and be plain about which part of it the 99.7% on our homepage refers to and which parts it has nothing to do with.

A click comes in. Before anything is written down anywhere, before the player, if there even is a player, has seen a landing page, there is a very short window in which the request its self can be looked at, and a request gives away a surprising amount about where it came from. Whether the browser is a real one or a headless one being driven by a script. Whether the address belongs to somebody's home broadband or to a data centre, or to a proxy that forty other clicks came through in the same minute. Whether this is the three hundredth identical request from one source since twenty past two, arriving at intervals so even that no crowd of human beings anywhere has ever behaved like that. A good deal of this is matching against signatures of traffic that has been seen before, truth be told, and those libraries grow every week on account of the people writing bots being a fairly industrious lot.

The proxy question matters for a reason beyond money, mind you. Traffic routed through a proxy from a country you hold no licence in lands in your reports looking like a market you are perfectly happy to be in, and the regulator will not be the least bit interested in whose bot it was.

MAP blocks around 99.7% of bot traffic inside that first second. The reason for doing it that early rather than further along is cost, plain and simple. A bot click stopped at the door never becomes a registration, never has a commission worked out against it, never sits on a report as a spike somebody has to go and explain to the head of acquisition. Every later layer is cheaper to run because this one got rid of the noise. When a click flood does get through, it goes and inflates your clicks, drags your conversion rates down so that your honest partners look worse than they are, and on any deal that pays per lead it costs you actual money straight away.

What this layer cannot do is judge a human being. A real phone in a real hand tapping a real link looks exactly like what it is. And most of the fraud that costs operators serious money is done by people, with phones, who have read your terms carefully. That lot turns up later. Usually a good bit later.

Registration is a different sort of looking altogether, on account of there now being something to compare against. At the click you are judging one request on its own merits. At registration you can compare it against everything else that has registered, and fraud tends to give its self away by resembling things. Nine accounts in an afternoon off one device, each with a different name on it. Email addresses built on the same stem with a number going up by one each time, which is what a person produces when they are making them up in a hurry. Sign ups landing one every two minutes on the dot from half one until six in the morning. An affiliate whose own logins keep turning up on the same network as the players they are being paid for, which is the self referral problem, the partner signing up through their own link and collecting a commission on somebody who was only ever going to be them.

The gap between click and registration says something too. Real people dither. They always have. They click on a Saturday, go off and read about the welcome offer somewhere else, forget about it, come back on the Wednesday. A registration that completes eleven seconds after the click, form and all, every single time, for one source, did not come from anybody dithering.

This is also where the tracking method starts to matter for fraud and not only for attribution. Cookie stuffing, where somebody quietly drops your tracking into browsers that never clicked on anything and waits for those people to turn up under their own steam, works best when the credit goes to whatever happens to be sitting in the browser. MAP tracks server to server on MasterPostback™, so the credit is decided by a click ID that travels with the player into your platform and comes back with the event, which makes the old stuffing tricks a good deal harder to pull off and a good deal easier to see when somebody tries. We went through the mechanics of that in cookieless tracking with S2S postbacks, and the whole route from click to invoice is in our guide to affiliate tracking software for iGaming operators.

Then some money arrives, and for most programmes the first deposit is the event that triggers payment, which makes it the event that fraud is built around. The most telling thing at this stage is not how many first deposits there were. It is what size they were. People miss that one. Honest players deposit whatever suits them, ten here, fifty there, a hundred on a payday. Harvested accounts deposit exactly the qualifying minimum, over and over, since the minimum is the whole of what the person running them needs. When a third of one source's deposits sit bang on your threshold figure and never a penny above it, it is worth finding out who exactly is behind that source.

How the money is paid in is the other half. One card or one wallet funding several accounts that are meant to be strangers to each other. Cards issued in one country topping up accounts that registered from another. A run of deposits on cards that turn out three weeks later to have been stolen, which hurts three ways at once, the commission that already went out, the chargeback its self, and the dent in your chargeback ratio with the payment provider. For what it is worth, an affiliate platform does not see card numbers and you would not want it to. It sees what your platform passes back alongside each event, and the more of that there is, the more the detection has to go on.

Some fraud looks perfectly fine for weeks and only gives its self away in how the players behave, which is the slowest signal of the lot and, fair is fair, the most reliable one. Real players who deposit go and play the games. They win a bit and lose a bit and come back on a Friday. Bonus abusers clear the wagering as fast as the game will let them, withdraw whatever survived, and are not heard from again. So by the end of the month the detection is looking at how long it took from deposit to first withdrawal, whether anybody from that source has deposited a second time, how the play was spread across games, and whether the chargebacks have started landing.

Here is roughly how that plays out on one partner. The numbers are made up, mind you, but we have seen that same run of events go past more than once. A new partner goes live on a Monday and sends twelve thousand clicks in the first week. Close to four thousand of them are stopped in the first second, a flood from two data centre ranges, and they never appear on the partner's report at all. Of what is left, three hundred register and sixty deposit. By the end of that first day the sixty already look a bit less impressive, since twenty two of them deposited exactly the twenty pound minimum and fourteen came off four devices. By the end of the month four of the sixty have deposited a second time, most of the others withdrew within a day of clearing the bonus, and three chargebacks have come in. None of those findings on its own would have convicted anybody. All of them together, on one source, inside one month, is a pattern. Nobody needs a model to see it at that point.

Which is why the payment window matters every bit as much as the detection. If commission goes out on day three, everything the detection learns in week four arrives too late to stop the money, and you are into clawback, which is a conversation nobody enjoys having with a partner. MAP lets you set qualification rules per brand, per geo, per source and per affiliate, so a partner nobody knows yet can sit on a longer window and a trigger tied to real play, while partners with three good years behind them carry on exactly as they were. The same goes a tier down if you run master and sub-affiliate structures, since an override paid on a harvested sub is money out the door just the same.

There are two ways to build the thinking part of affiliate fraud detection. One is rules, written by a person. More than five registrations from one address in an hour, flag it. Rules are clear, and easy to explain to an affiliate who is cross about a held payment, and fraudsters work them out inside about a fortnight and go and sit at four registrations an hour. The other is a model, trained on what fraud and honest traffic have actually looked like, that takes all the signals together and says how unusual this particular combination is. Five slightly odd things happening at once can mean more than one very odd thing, and a model notices that far better than a rule somebody wrote late on a Thursday.

MAP uses both, which is the usual answer and the correct one. The AI and machine learning scoring runs over conversions and gives each a risk score, and the rules sit next to it so you can tune them to your own programme, on account of what counts as odd for a Brazilian sportsbook looking nothing like what counts as odd on a UK slots brand. It is built into the platform, so there is no separate fraud tool to integrate, pay for on its own invoice and reconcile against every month.

The score exists to decide what happens to the commission, and that is a narrower job than people expect. The affiliate platform does not get to decide whether a player is let into your casino. Your payments and KYC people decide that. What the platform decides is whether money goes out to the partner who sent the player, and when. So a high score need not mean anybody gets banned. It can mean the commission on those conversions is held and a person gets asked to go and look, which is a far cheaper mistake to make than cutting off a good partner over one strange week.

Every fraud system has false positives, ours included, and it is worth being plain about that. A seasonal campaign throws up a spike. A partner in a new market has a thin, odd first month. A review site that genuinely does convert better than everybody else will look, for a while, just like somebody faking it. Whether a detection system helps you or harms you comes down mostly to whether a flag goes to a person or goes straight to an automatic cut off, and every change made after that is kept on the audit trail so there is a record of who decided what. The manual side of what that person should be looking at is its own long read, and worth going and reading your own self if you have not.

It is 99.7% of bots, at the click. It is not 99.7% of fraud, and we would rather nobody left this page thinking otherwise. Real people running several accounts, a partner putting self referrals through a phone borrowed off a cousin, bonus abuse rings depositing with their own money, all of that walks straight through the first second on account of being human, and gets caught, when it does get caught, in the slower layers.

The later layers can only work with what your platform sends back. If withdrawals and chargebacks never come across, the month one checks have nothing to chew on and the whole thing runs on registrations and deposits, which is about half the picture. That part is on you, we are afraid. A good share of any setup week goes on exactly that, and somebody on your side has to be in it.

Brand bidding happens in the ad auction and not on your site. The click data will show you an affiliate converting remarkably well on your brand terms. It will not show you the ad that did it, and that one needs somebody looking at the search results as well.

And none of this does the work that decent terms do. A holdback, a clawback clause and a qualification event that costs something real to fake take the profit out of most of these schemes before they start, and the commission models you pick decide how easy that is to write. Detection will show you who is at it, and the rest is a job for whoever writes your contracts.

On the commercial side MAP charges a flat price, with no per click fee and no cut of what your partners generate. That has always struck us as the right arrangement to have underneath fraud detection in particular, since a platform billing by the click gets paid for the bot farm's clicks the same as anybody else's. Three hundred and more iGaming brands run on it at present.

Take your top five partners by first deposits last month. For each one, count how many of those first deposits were for exactly your minimum qualifying amount, and work it out as a share. Then do the same sum for the programme as a whole. If one partner's share comes out three or four times the programme's, that is worth an afternoon of somebody's time. It proves nothing on its own, mind you, some markets genuinely do deposit small, and some partners' audiences are thriftier than others. What it does is tell you which report to open first. That is all it is for. If you want the fuller version, the fourteen KPIs an affiliate manager ought to be tracking include the second deposit rate by source, which is the other number most programmes never look at.

If what turns up bothers you, the fairest test of any affiliate fraud detection is to see what it makes of a month of your own conversions rather than read about it, and that is what the demo is for. The rest of what the platform does sits on the features page. And if you are weighing platforms against each other our buyer's checklist for iGaming affiliate software has the fraud questions worth putting to every vendor, us included.

Will the fraud detection flag some of our honest partners

Now and again, yes. Any system that catches fraud will sometimes catch a partner who is simply having an unusual month. That is why a high risk score in MAP leads to held commission and a review rather than an automatic ban, and why the rules can be tuned to your markets so the same odd week does not keep tripping the same partner.

Do we need a separate anti-fraud tool alongside MAP

Not for affiliate fraud. The detection is built into the platform, so there is nothing extra to integrate. Many operators do run a payments-side fraud tool for card fraud at the cashier, which is a different job, deciding whether a deposit is let through at all, and the two sit happily side by side.

Can new partners be held to stricter terms than established ones

They can. Qualification rules are set per brand, geo, source and affiliate, so an untested partner can be on a longer payment window and a play-based trigger while your long-standing partners stay on their simpler terms.

Does it work for sportsbook programmes as well as casino

It does, though the signals differ. Bonus abuse on the sports side tends to look like low-risk betting on free bet offers rather than fast slot wagering, and the rules can be set per brand and product so a sportsbook and a casino under the same roof are each judged by what normal looks like for them.