Guides
Referral Fraud Prevention Basics: Stop Self-Referrals Before They Cost You
Every referral program is an offer of money for introductions, and some of the introductions will be fake. The good news for small programs: the common fraud is not sophisticated, and a handful of plain defences — applied before you pay, not after — stops most of it.
Know what you are actually defending against
Referral fraud sounds like a hacker problem. In small programs it is mostly a neighbours-and-second-email problem. The dominant abuse is the self-referral: one person creates a second email address, refers themselves, and collects both sides of the reward — no technical skill required, which is exactly why it is the most common. Behind it come referral rings, small groups (or one person with many addresses) cycling referrals among themselves so rewards flow without a single real new customer, and link stuffing, where a code meant for personal recommendations gets posted to deal forums and generates sign-ups from strangers. Bot abuse of public forms exists too, though it matters more as programs grow.
Notice what all four share: they exploit programs that pay early, pay automatically, and never look at their own data. That is encouraging, because it means the defences are mostly about when and how you pay, not about buying fraud technology.
The five defences, in the order to add them
- Pay on a real milestone, never on sign-up. A completed first purchase, a paid subscription that survives its first cycle, genuine usage — pick the event that means a real customer arrived. Fraud optimises for the easiest thing that pays; raising the bar removes most of the incentive before any detection is needed.
- Verify identity at the door. Confirmed email for both referrer and new customer, a phone check where the program justifies it, and disposable email domains rejected or flagged. This filters the laziest self-referrals — the ones typed in a minute with a throwaway address.
- Hold rewards before paying them. New rewards sit in a pending state for a short window — days, not months — while you review. The hold also quietly filters fake accounts that never return to use the product at all.
- Cap velocity. Limit how many referrals one person can submit per day and per month. Genuine advocates rarely need to refer dozens of people in a day; farming operations usually do.
- Review patterns before each payout. Sort what is due and scan for the clusters: repeated or near-identical emails, identical IP addresses, sudden spikes from one referrer, conversions that happen suspiciously instantly and never engage again.
What success looks like: a payout run where every paid reward traces to a verified customer who passed a real milestone, the pending holds were actually reviewed, and anything odd was looked at before money moved — not discovered in next quarter's numbers.
Signals are stacks, not verdicts
| Signal | Alone, it may just mean | It becomes serious when combined with |
|---|---|---|
| Same IP address | A household, office, school, or shared connection | Same payment method and instant conversion |
| Similar email addresses | A person re-joining after a genuine mistake, or family naming habits | Multiple accounts, no follow-on usage |
| Fast conversion after clicking | A warm recommendation between friends who talked first | A pattern of fast conversions across many referrals |
| No engagement after sign-up | A customer who is simply busy, or a poor onboarding flow | Reward claimed at the first possible moment, then silence, repeatedly |
This table carries the duty most fraud guides skip: false positives are real people. Families share addresses and payment cards. Workplaces share networks. A signal should open a review, not execute a punishment — flag for a human look, ask for an explanation where the relationship matters, and keep an appeal path with a stated window. A program that voids an honest advocate's earnings on one IP match has not prevented fraud; it has manufactured a critic with a screenshot. The stacked-signal rule protects both sides: fraud reveals itself in combinations and patterns, while honest oddity usually explains itself in one message.
Write the rules down before you need them
Finally, put the defences in your program terms in plain language: self-referrals are prohibited, rewards may be held for review for a stated period, milestones define when a referral counts, and commissions can be reversed when fraud is confirmed under those stated criteria. Written rules do three jobs at once — they deter the casual abuser who reads them, they make enforcement a matter of applying a policy rather than making an accusation, and they give an honest referrer caught by a flag something fair to appeal against. Prevention, in the end, is mostly this: pay late enough to check, check patterns rather than people, and say the rules out loud in advance.
General information about referral program practices, not legal advice. Program terms and consumer-protection rules vary by jurisdiction — have significant programs reviewed before launch.
A pre-payout checklist you can run in fifteen minutes
Before each payout run — weekly, monthly, whatever your program's rhythm — export what is due and work this list in order. First, sort by referrer and look at the top of the list: high performers get the first look, because that is where both your best advocates and your worst abusers live, and confusing one for the other is the expensive error in both directions. Second, scan for clusters: same or near-identical emails, shared IP addresses across “different” customers, referrals that converted within moments and never returned. Third, check the milestone evidence for anything flagged: a real purchase, still standing, from a verified account.
Fourth, apply the stacked-signal rule from the table above: one flag earns a message asking for clarification, two or more earn a hold while you review, and a documented pattern earns enforcement under the written terms — with the evidence saved either way. Fifth, pay everyone else on time, visibly, and without resentment. That last step is a fraud control too, and the one programs forget: honest referrers who are paid promptly and treated as presumed-legitimate become the program's immune system, reporting the abusers, defending the rules in public, and staying. Fraud prevention that makes honest people feel accused is just churn with extra steps. The fifteen minutes buys you both halves of the result: the fake referrals stopped, and the real ones still glad they came.
What to watch as the program grows
The defences above are sized for a program's first phase, and growth changes the fraud before it changes the budget. Public promotion invites link stuffing at scale, so the placement rules in your terms — where links may and may not be posted — start to matter as much as identity checks. Paid recruitment of promoters invites organised sign-up farming, which shows up less as single suspicious accounts and more as timing patterns: bursts of referrals in the same hour, from the same region, converting at rates no honest audience produces. And success itself paints a target: a program known to pay promptly and publicly will be tested by professionals, not just neighbours with second emails.
The response is not to rebuild the program around suspicion. It is to keep the same principles and let the tooling catch up gradually: the milestone stays real, the hold stays in place, the payout review moves from a spreadsheet scan to whatever reporting your platform provides, and the written terms grow a clause at a time as each new abuse teaches you its name. Programs that survive growth are the ones whose rules were honest at small scale — because enforcement at any size is just the small-scale promise, kept in public, with better records.