The Affiliate Brand-Bidding Fraud Playbook

01The size and shape of the problem

Affiliate fraud is not a rounding error. It is the largest unmonitored leak in the performance marketing stack.

The CHEQ and University of Baltimore study puts the cost of affiliate fraud at roughly $3.4 billion per year in the United States alone, up from $1.4 billion in 2020. That is a 143% increase in 24 months. Juniper Research's broader ad fraud estimate landed at $84 billion for 2023, projected to hit $172 billion by 2028. Those are headline numbers, and I have the same instinct you do when you see them — "vendor research, take it with salt." But the trend direction is not in dispute. Fraud is up. Fraud is up faster than brand spend. And the specific subcategory of brand-bidding fraud is up faster than the rest of the fraud.

BforeAI's March 2025 analysis of a 33,000-ad sample found that 6.9% of ads on branded queries in their dataset were from unauthorized affiliates, and that 31% of the brands in the sample had at least one affiliate bidding their terms. That is the more interesting number for you, because it is per-brand. It means roughly one in three affiliate programs has a live infection at any given moment, whether the brand knows it or not.

At AdCrime we operate a global scanner network with regional hubs across the Americas, Europe, and Asia-Pacific, plus the ability to reach into any specific market a client's customers actually come from. Our detection rates on programs that have never been audited before are consistently higher than the BforeAI number. The reason is geographic coverage — if you only scan from one country, you miss the fraudsters running geo-targeted campaigns designed to hide from the brand's local IP. The more vantage points you scan from, the more fraud you surface. This is not complicated. It is operationally expensive, which is why most in-house teams never build it and why most vendors cut corners on it.

Why brand-bidding fraud has accelerated since 2020

Four things happened between 2020 and 2024 that made this problem structurally worse.

These four forces are still active. None of them are reversing. The volume of fraud will keep climbing until the cost of executing it rises, and the cost will only rise when detection improves. That is the thesis. That is why I built AdCrime. That is why this Playbook exists.

The verticals getting hit hardest

Every vertical is a target, but the economics favor fraudsters in a handful of specific categories. If you run affiliate in any of these, your prior should be that you already have an active infection:

• VPN, hosting, and SaaS with recurring revenue — because the per-sale commission is often $50–$100 and the CPCs on branded queries are under $5. The arbitrage math is obvious.
• Gambling and sports betting — because the affiliate commissions are a percentage of lifetime value, which is lucrative, and the regulatory environment already tolerates ambiguous behavior.
• Personal finance and lending — because one qualified lead can pay $200+. CHEQ data has flagged personal finance as one of the highest-fraud verticals, meaningfully above the cross-industry baseline.
• DTC fashion, beauty, and wellness — because the coupon-search behavior is near-universal in these categories. Nordstrom lost approximately $1.4 million to a single cash-back portal exploiting a system error — the two brothers involved pled guilty to wire fraud (FBI, 2012).
• Travel and booking — one unnamed travel site has been reported as spending $7 million per month on affiliate acquisition, a non-trivial portion of which industry observers believe was being siphoned through attribution fraud.

If you are running a program in any of these categories and you have not audited it in the last 90 days, you are almost certainly paying for commissions you should not be paying for. The only question is how much.

$3.4B — U.S. affiliate fraud losses, 2022 (CHEQ / University of Baltimore)

>

1 in 3 — Brands with at least one affiliate bidding their terms (BforeAI, March 2025)

>

100% — Affiliate programs AdCrime has scanned that contained unauthorized brand bidders

02The five fraud patterns

Brand-bidding fraud is not one thing. It is five distinct operational patterns, each with its own mechanics, its own detection signature, and its own recovery approach. Understanding which pattern you are fighting is the first step to fighting it correctly.

Pattern 1 — Direct brand-term bidding

Pattern 2 — Trademark-plus-modifier bidding

Pattern 3 — Typosquatting and lookalike domains

Pattern 4 — Cloaking

Pattern 5 — Attribution hijacking via browser extensions and toolbars

03Why the networks don't catch it

There is a question you should ask yourself at this point, and the answer is important for everything that comes after.

The networks have the data. They own the click logs, the publisher IDs, the conversion records. CJ, Impact, Awin, ShareASale, PartnerStack — each of them could, in theory, build a real-time detection layer that flagged unauthorized brand bidding the moment it happened. None of them have done so in any serious way. Why?

The honest answer is that the networks have structured their business models around not noticing.

The revenue model

Every major affiliate network is paid as a percentage of commission volume flowing through its platform. CJ takes an override of roughly 20–30% on every commission processed. Awin charges a tracking fee plus a percentage. PartnerStack and Impact have their own variations on the theme. The economics are simple: every fraudulent commission that flows through the network is also a commission the network is taking its cut on. Detection costs money. Letting the commission through costs nothing and generates revenue. This is not a conspiracy theory, it is just how the incentives are pointed.

Ben Edelman — the Harvard researcher who has been studying affiliate compliance longer than anyone — has documented this structural conflict across multiple papers. The most pointed observation, which I am paraphrasing because I cannot reproduce the original at length: for one large client, he personally proved that nine out of the client's top ten affiliates were breaking program rules, and the network had not flagged any of them. Nine out of ten. Top ten by volume. That is not a detection failure. That is a detection refusal.

The terms of service

Read any major affiliate network's publisher agreement carefully and you will find language that shifts the responsibility for compliance enforcement almost entirely onto the brand. Awin's Clause 5.7 is the most aggressive on record: it effectively limits advertiser recovery rights for commissions paid on approved transactions. CJ, Impact, and ShareASale have slightly softer versions of the same idea. The pattern is consistent: the network collects the fee, and the brand carries the risk.

When you push a network on this during a dispute, the language in their reply will always come back to program terms. "Our platform merely facilitates the relationship. Enforcement of your program rules is your responsibility." This is legally defensible and operationally convenient. It is also the single biggest reason brand-bidding fraud has been allowed to metastasize.

The visibility argument the networks will make

In fairness to the networks, they will argue — correctly, up to a point — that they cannot see what happens upstream of the affiliate click. They cannot see the Google Ads campaign the affiliate is running. They cannot see the cloaked landing page. They cannot see the browser extension firing client-side. All they see is a click and a conversion. Everything before the click is invisible to them.

This is true. But it is also beside the point. The networks have two signals they could act on even without upstream visibility:

1. The conversion rate anomaly. A publisher with a 40% conversion rate on branded queries is almost certainly either typosquatting, cloaking, or attribution-hijacking. The networks can see this.
2. The explicit complaint. When a brand files a dispute with evidence, the network can process it and terminate the partner. They can do this today. Most of them drag their feet because processing the dispute costs them the commission they would have earned.

The structural point is that the networks have built a business where they get paid regardless of whether the commission is legitimate, and where processing disputes costs them money. You cannot fix an incentive problem by hoping the counterparty rediscovers their ethics. You can only fix it by making the detection and the disputes your own responsibility.

That is the thesis of this Playbook, and it is not a comfortable thesis. But it is the one that matches reality.

"I once proved that nine of a large client's top ten biggest affiliates were breaking its rules."

— Ben Edelman, Harvard Business School

04How the math destroys the brand

Here is the part every CFO needs to read.

The direct cost of affiliate brand-bidding fraud — the commissions you pay to fraudsters — is only the tip of the iceberg. The hidden costs compound across at least four different line items, and in aggregate they are larger than the commission leakage by a factor of three to five.

Let me walk through a worked example. This is a generic $30M ARR DTC brand scenario, not a specific customer, but the shape of the math holds for any program in the $10M–$500M range.

This is why I cannot take "affiliate is only a small part of our spend" seriously as an argument for not auditing. The impact is not proportional to the affiliate budget. It is proportional to the fraction of your organic and branded revenue the fraudster is inserting themselves into. A fraudster can extract more money from a brand that spends $0 on affiliate than the brand spends on the affiliate channel itself.

Multiply by the typical infection rate — eight to twelve active infringing affiliates on a mid-market program — and the seven-figure annual loss becomes the median case, not the worst case.

$408,000 — Estimated annualized cost to a $30M ARR brand from a single infringing affiliate, fully loaded

05Detection: the evidentiary fingerprint

Every fraud pattern in Section 2 leaves a signature in data you already have access to. You do not need a specialized tool to start — you need to know where to look. This section is the translation key.

• A paid ad on your exact brand query that is not yours
• Destination URL contains an affiliate tracking parameter
• Auction Insights shows an unfamiliar domain consistently in the top five
• Your own branded CPC has drifted upward over the last 60 days with no explanatory change in your bid strategy

• Branded queries with "review," "coupon," "discount," "alternative," "vs" modifiers show affiliate ads
• One affiliate is driving disproportionate commissions from queries that imply late-funnel intent
• Conversion rate for that affiliate is 3–5x your program average

• WHOIS lookup on any unfamiliar domain shows recent registration
• archive.org/wayback returns no history
• Redirect chain goes lookalike domain → your real domain → affiliate cookie set
• The lookalike domain runs ads on the same queries as Pattern 1 or 2

• You cannot reproduce the fraudulent ad from your own IP, but your customers are reporting seeing it
• SERP scans from different geographic regions return inconsistent results
• The landing page you see from a headquarters IP looks clean; the landing page a customer reports seeing is a coupon hard-sell or a branded-lookalike page

• One or two affiliate publishers have conversion rates above 25%
• Click-to-conversion windows are suspiciously short (under 2 minutes for a considered purchase)
• These same publishers overlap heavily with customers who also touched your brand through non-affiliate channels in the same session
• Commissions from these publishers spike after you run any non-affiliate brand campaign

The single most powerful detection signal across all five patterns is geographic inconsistency. A clean SERP from your home country combined with fraud hits from other countries means you have cloaking or geo-targeted bidding. If you only scan from one region you will never see the pattern. At AdCrime we operate a global scanner network spanning the Americas, Europe, and Asia-Pacific, with the ability to reach into any specific market a client cares about — if 40% of your revenue comes from Canada or Australia, that is where your next scan runs from. You can replicate the approach manually with VPN rotation if you have the discipline to do it every week. Most teams do not have the discipline. That is fine — it is a thing I built software to solve because it was the thing I kept seeing teams fail at.

06The 30-day detection playbook

You have read enough theory. Here is the runbook.

This playbook assumes you run a mid-market program with three to six affiliate networks and that you have not done a serious audit in the last quarter. Execute it over 30 days. Do it once as a cleanup exercise, then fold the weekly cadence into your prevention program in Section 9.

Week 1 — Define the rules

Week 2 — Map the evidence

Week 3 — Enforcement

Week 4 — Close the loop

Everything after Day 20 is maintenance. The audit is done. You know who was stealing from you, you have filed the disputes, you have updated the terms, and you have the weekly cadence running. This is the state every affiliate program should be in and almost none of them are.

07The legal landscape in 2026

A short tour of the rules you can lean on. This is not legal advice and you should talk to real counsel before you file anything. But it is the context you need to decide when to escalate.

Federal trademark law — the Lanham Act

The Lanham Act (15 U.S.C. § 1125) is the main federal vehicle for trademark enforcement in the United States. Under the Act, a trademark owner can sue for infringement if another party's use of the mark is likely to cause consumer confusion. This is the legal theory underneath most affiliate brand-bidding cases.

The FTC and the Endorsement Guides

The Federal Trade Commission updated its Endorsement Guides in July 2023 to require clearer disclosure of material connections between promoters and merchants. The Guides are not a private right of action — you cannot sue an affiliate under them — but they create an enforcement lever the FTC can pull, and they create a documentation standard you can use in your disputes and demand letters.

State-level consumer protection

Most U.S. states have unfair and deceptive practices statutes that reach further than federal trademark law. California's Business and Professions Code § 17200 is the most well-known, and it is explicitly broad — "any unlawful, unfair, or fraudulent business act or practice" is actionable. Illinois, New York, Florida, and Washington all have analogous statutes. State claims are often more useful than federal claims for brand-bidding fraud because the bar for "deceptive" is lower than the bar for "likelihood of confusion."

State claims also open the door to small claims court for modest amounts — typically $5,000 to $15,000 depending on the state. If the affiliate is a U.S. LLC or individual and the amount they stole is under the small claims limit, you can file yourself without a lawyer. Most affiliates do not show up for small claims hearings and you win by default. (Limits range from $2,500 to $25,000 depending on the state.)

The Honey / PayPal litigation as a bellwether

The In Re PayPal Honey class action (5:24-cv-09470, N.D. Cal.) is the case everyone in the affiliate space is watching. The core allegation is that Honey systematically replaced last-click attribution on merchant sites where Honey held an affiliate relationship, collecting commissions on sales the user had already decided to make through other channels. Judge Beth Labson Freeman dismissed the first amended complaint in late 2025, and a second amended complaint was filed in January 2026 with merchant contracts and specific commission examples. As of April 2026, the case remains active.

Why it matters: if the second amended complaint survives and the case moves into discovery, the factual record it produces will reshape how every brand negotiates with browser-extension affiliates for the next decade. Watch it closely.

WIPO and UDRP for domain disputes

If the fraudster has registered a typosquat domain, you do not need federal court. The World Intellectual Property Organization (WIPO) and the National Arbitration Forum both run domain dispute procedures under the UDRP (Uniform Domain-Name Dispute-Resolution Policy). A UDRP filing costs roughly $1,500, takes 45–60 days, and almost always succeeds when the domain is objectively a typosquat or a lookalike of a registered trademark. This is the single best legal tool in the affiliate fraud toolkit because it is fast, cheap, and targeted.

The offshore problem

If the affiliate is registered in Russia, Belize, the Seychelles, or any jurisdiction where civil judgments are unenforceable, none of the above applies. You cannot sue them. You cannot collect from them. Mutual Legal Assistance Treaty (MLAT) requests take 6–18 months and are reserved for criminal matters.

The tactic that actually works in this scenario is attacking the network layer instead of the fraudster layer. Every offshore fraudster needs a U.S.- or EU-accessible affiliate network to monetize the fraud — CJ, Impact, Awin, ShareASale, PartnerStack. Those networks sit inside jurisdictions where your legal options are real. File a formal notice to the network identifying the affiliate, the scheme, and your evidence. Make clear that continued monetization constitutes knowing facilitation. Request termination and refund. If the network refuses, the network is now the defendant. In practice, they will not refuse at that point, because no reputable network wants to be the CJ Affiliate or Impact.com headline in a trademark lawsuit. They will terminate the partner and refund you to make the problem go away.

08Recovery and clawback

The recovery window is shorter than you think

Most brands discover brand-bidding fraud the same way. Somebody in finance asks why branded search CPM jumped 22%. Somebody in affiliate asks why one partner is suddenly closing 40% of the program's revenue. Somebody in legal forwards a cease-and-desist from a competitor whose ads now show up on your own brand terms.

By the time any of those questions get asked, the money is already in motion. And the money does not wait.

Every affiliate network you work with has a commission locking window — the period between when a sale is recorded and when the commission becomes legally owed to the affiliate, after which the network's willingness to reverse it drops from "routine" to "impossible." Understanding these windows is the entire game. Everything else in this section is downstream of knowing when your clock stops.

Read the numbers carefully. The best-case scenario is you catch the fraud the same month it happened and reverse the commission before month-end. The worst-case scenario is you catch it 45 days later and the commission is locked, paid out, and in a bank account you cannot touch.

This is also why the prevention program in Section 9 matters more than the recovery playbook in this one. The cheapest commission to claw back is the one you never paid. But assuming you are reading this because you already paid some you should not have, here is how to get them back.

The four layers of recovery

Recovery is not one action. It is four layers that you work through in order, escalating only when the previous layer fails. Skipping layers wastes leverage and signals to the network that you do not understand their process.

What you need to submit:

1. Transaction ID from the network's own reporting
2. Affiliate publisher ID (not the display name — the numeric or alphanumeric ID)
3. Time window of the violation (not just the one transaction — show the pattern)
4. Evidence screenshots from at least three geographic regions, timestamped, with the full SERP visible, showing the affiliate's ad on your branded query
5. Destination URL with the redirect chain back to your site and the affiliate tracking parameters
6. The relevant clause of your program terms that this affiliate just violated, quoted verbatim, with a clause number
7. Requested action stated plainly — "reverse this transaction, close this partnership, and confirm in writing"

Network operators who handle dispute queues see hundreds of partial submissions a week. A complete submission with seven items in order moves to the front of the queue because it is easy to process. A "hey I think this affiliate is cheating us" email goes to the bottom and stays there. The template is below. Copy it, fill the variables, do not rewrite the structure.

Use them for three things: processing speed (a rep can move a disputed transaction from "under review" to "reversed" in 48 hours versus 2–3 weeks in the normal queue); pattern escalation (if you have caught the same affiliate across 15 transactions in three weeks, frame it as a systemic violation, not a single dispute — "We have identified a systemic violation. We need this partnership terminated and all commissions in the disputed time window frozen pending review" triggers a different internal process); and policy precedent (if the network refuses to reverse, ask them to document why in writing — nine times out of ten they will reverse rather than create a paper trail, and the tenth time you have a written denial you can use in Layer 4).

Do not let them pull you into a debate about whether the affiliate's bidding technically violated the program terms. Do not debate. Your program terms are your contract. If your terms say "no bidding on brand-name variations," the affiliate's defense is irrelevant — your job is to enforce your contract, not prosecute theirs.

This is the first point in the escalation ladder where the legal tone shifts. Everything before this was a compliance dispute. Everything from here is a pre-litigation communication and should be written like one.

What goes in a direct demand letter: identification of the affiliate's publisher ID, business entity if known, and the specific partnerships affected; a summary of the violation with specific dates and transaction IDs; a statement that the affiliate is in breach of your program terms, with the clause quoted; a demand for immediate cessation of all bidding on your brand terms, return of specific commission amounts, and a signed attestation that they will not resume; a deadline (10 business days is standard); a statement that failure to comply will result in escalation to their network, potential trademark enforcement under the Lanham Act, and pursuit of any other remedies available. (Have counsel review before sending.)

Send it two ways: email to the affiliate's contact on file with the network, and physical mail to any business address you can find. Document both. Do not send this letter yourself from a personal Gmail. Use your legal department, use outside counsel on letterhead, or use a service like LegalZoom to generate a formal cease-and-desist under your business entity. The letter's power comes from looking like a lawyer wrote it.

The enforcement options — Lanham Act, FTC complaint, state consumer protection claims, small claims court, WIPO/UDRP for domain disputes — are all covered in Section 7. Pick the tool that fits the evidence. Typosquat? WIPO. U.S. LLC under $10K of damages? Small claims. Cloaked landing pages impersonating your site? Lanham Act in federal court with real counsel. Offshore ring? Attack the network layer.

The evidence package

Every dispute, every escalation, every demand letter draws from the same evidence package. Build it once, use it everywhere. Save everything in a single folder per incident, named with the date and the affiliate publisher ID.

``

1. Business entity and jurisdiction. LLC, corporation, individual? Where is the business located? Partners registered in the British Virgin Islands, Belize, Seychelles, or any jurisdiction where civil judgments are unenforceable go into a "high-risk, low-trust" bucket — not automatically rejected, but required to clear a higher bar on the remaining checks.
2. Traffic source stated on the application. Red flags: "SEO" with no site listed, "paid search" as the primary source, "social" without naming platforms, or blank. A legitimate affiliate will tell you they run a coupon site, a comparison site, a newsletter, a YouTube channel, or a niche forum. A fraudulent affiliate will be vague.
3. Claimed website. Check the WHOIS — is the domain registered in the last 60 days? Is it a parked page, a coupon aggregator, or a spam site? Run the domain through archive.org/wayback` — does it have any history, or did it appear fully formed last week?
4. Prior network history. Ask the network. Every affiliate network knows which publishers have been terminated from other programs for compliance issues. Some networks may share termination history if you ask — most merchants never do.
5. Named contact. Is there a real human name attached to the application? Does that name exist on LinkedIn in a role consistent with affiliate marketing?
6. Communication style. Did they send a generic one-line "let me know if approved" message, or did they send a two-paragraph message explaining their traffic and why they want to promote your brand? Legitimate affiliates pitch you. Fraudsters want in fast and quiet.

Give each applicant a 1–5 score on each of the six checks. Approve 5+ applicants with no flags. Manually interview any applicant with 3–4 flags over video call before approving. Reject anyone scoring below 3. Document the reasoning for every rejection.

Component 3 — The monitoring cadence

Prevention is not a one-time setup. It is a weekly rhythm. New affiliates join, existing affiliates change behavior, and Google's ad ecosystem shifts around you.

Component 4 — Organizational workflow

Every broken affiliate program has the same root cause. Nobody owns the problem. Affiliate sits under marketing. Marketing assumes the network is monitoring compliance. The network assumes the brand has its own watch. Finance sees the commissions go out and assumes they are legitimate. Legal only gets involved when there is a lawsuit.

Name an owner. One person is accountable for the prevention program. Name a backup. Name an escalation path — head of marketing, head of legal, CFO — so the owner knows who to call without a meeting when something material happens. All three should know in advance that they are in the escalation path and what the criteria are for pulling them in.

Document the playbook. Write down the exact steps from "SERP violation detected" through "commission recovered." The document is not for the current affiliate manager — the affiliate manager knows the steps. The document is for whoever replaces them in six months. Review it quarterly. Things change.

Component 5 — The quarterly audit

Every 90 days you audit the full program. Not a spot-check. Not a review of the weekly summaries. A clean-sheet audit that assumes the program is broken and looks for the evidence.

1. Full affiliate roster review. Pull the complete list of active affiliates from every network. Deactivate anyone who drove zero commissions last quarter. Dormant affiliates are a free attack surface and a fraudster's favorite place to hide.
2. Program terms review. Read them again. Has anything changed in the ecosystem that makes your clauses weaker? Update if needed.
3. Network terms review. Re-read each network's publisher agreement. Awin, CJ, and Impact all update their terms multiple times per year; most merchants never read the updates.
4. Top partner audit. Pull the top 20 affiliates by commission volume. Verify (a) they are still operating a legitimate traffic source, (b) their conversion rate is consistent with the program baseline, (c) no SERP scans in the last quarter caught them bidding on your terms.
5. Bottom partner audit. Pull the bottom 50 affiliates. Are any of them spikes of activity that dropped back down? A spike followed by silence is sometimes a fraudster who got caught and quietly moved on, leaving a trail you missed.
6. Dispute history review. How many disputes did you file this quarter? How many resolved in your favor? What was the average resolution time? What patterns show up repeatedly? The patterns you see in disputes this quarter are the monitoring signals you should build into next quarter's cadence.
7. Commission leakage estimate. Based on the disputes you won, extrapolate how much you probably lost to fraud you did not catch. This is your ROI case for investing more in prevention next quarter.
8. Tool evaluation. Is your toolchain keeping up?
9. Budget review. What did the prevention program cost this quarter in time, tools, and recovered-versus-lost dollars? For a mid-market brand the answer should be "yes, by 10–50x."

When automation pays off

Everything in this section can be done manually. The question is whether it should be.

The rule of thumb: if your affiliate program is driving more than $50K per month in commissions across all networks combined, manual prevention is no longer the right call. At that scale, the labor cost of the Monday-through-Friday cadence exceeds the cost of a scanner that does it in minutes — and the scanner catches things the manual process will miss (cloaked ads that only show up in certain countries, ads that only run during specific hours, typosquat domains that never touch a SERP you thought to check).

Below $50K per month, manual prevention is economically correct. Above $50K per month, you are losing more to undetected fraud each week than a tool costs per month.

This is the gap I built AdCrime for. Every tool in the existing market is either enterprise-priced at $40K+ per year or enterprise-scoped in ways that do not fit a founder-led or mid-market team. So I built the thing I would have wanted to buy when I was running an affiliate program myself: six-country coverage, continuous scanning, case files you can actually send to your network's compliance team, priced for people who do not have a six-figure tooling budget. If the math in this section matches your situation, come find me at adcrime.com. If it does not, use this Playbook to build it manually. Either way, the goal is the same — fewer fraudsters getting away with it.

The one-page prevention checklist

• Monday: SERP scan across 3 regions on top branded keywords
• Tuesday: Auction Insights review on top 5 branded campaigns
• Wednesday: Transaction anomaly check — top 10 affiliates per network
• Thursday: Dispute queue status review
• Friday: One-page summary to finance

• First Monday: Full SERP scan across 6 regions
• Mid-month: Program terms re-read
• Last business day: Finance reconciliation

• Full affiliate roster review (deactivate dormants)
• Program terms update
• Network terms review
• Top 20 and bottom 50 partner audit
• Dispute history pattern review
• Commission leakage estimate
• Tool evaluation and budget review
• File the Prevention Program Review

• Manual review, six-point scorecard
• Approve 5+, interview 3–4, reject below 3
• Document every rejection

• Build the evidence package (ten items)
• File dispute within 48 hours
• Escalate to network rep if stalled after 10 days
• Escalate to direct contact if network refuses
• Escalate to legal if direct contact fails
• Close the loop with finance

10The tooling landscape

A short honest survey of what exists. I run one of these companies, so read this section with that in mind. I have tried to be fair.

11Ten warning signs your program is compromised

Print this. Share it with your team. If you can check three or more of these, you almost certainly have active fraud.

1. Your branded search CPC has drifted up 20% or more in the last 90 days with no explanatory change in your own bid strategy
2. Your top affiliate's commission volume grew more than 50% in one month without a corresponding campaign push
3. One or more affiliates in your top 10 have conversion rates above 25% on branded queries
4. Your click-to-conversion windows for certain affiliates are under 2 minutes on considered purchases
5. Your Auction Insights shows unfamiliar domains consistently in the top five on your brand terms
6. You cannot reproduce ads from your office IP that customers report seeing
7. Your finance team has flagged a disproportionate share of affiliate commissions on otherwise-organic-looking orders
8. Your program terms do not contain a specific "no brand-bidding" clause with enumerated modifier terms
9. You have not updated your affiliate program terms in over 12 months
10. You have not scanned your SERPs from more than one country in the last 90 days

Three or more checked means you should run the Week 1–Week 4 playbook from Section 6 starting Monday.

—Sources and source quality flags

• CHEQ × University of Baltimore, The Economic Cost of Bad Actors on the Internet: Affiliate Fraud, 2020 and 2022 editions
• 1-800 Contacts v. JAND, Inc. d/b/a Warby Parker, 2d Cir. (October 8, 2024)
• Lerner & Rowe P.C. v. Brown Engstrand & Shelly, LLC, 9th Cir. (October 22, 2024)
• In re PayPal Honey Extension Litigation, Case No. 5:24-cv-09470, N.D. Cal.
• FTC Endorsement Guides, revised July 2023
• FTC Fake Reviews Rule, August 2024
• FTC v. Traffic and Funnels LLC, June 2024 settlement
• FTC v. Total Wealth Academy, August 2024
• Google Ads Trademark Policy update, July 24, 2023
• Google Chrome Web Store policy update on affiliate disclosure, March 2025
• WIPO UDRP procedure documentation

• Juniper Research ad fraud forecasts, 2023 and 2024
• QuoIntelligence, NordVPN affiliate fraud ring report, March 2025
• MegaLag YouTube investigation of Honey/PayPal, December 2024
• Search Engine Land coverage of Google policy changes
• Ben Edelman's published research on affiliate compliance
• Affiverse Media reporting on affiliate enforcement cases

• BforeAI 33,000-ad sample analysis, March 2025 (vendor-produced)
• mFilterIt cloaking prevalence figures (vendor-produced)
• BluePear case studies (vendor-published)
• Kevin Frisch's $100M Uber claim (self-reported, unverified by independent audit)
• Sage Financial Software case details (industry trade press)
• Nordstrom $1.4M loss figure (industry reporting, not audited)

—Closing note

The Playbook you just read is version 1.0. If you catch something wrong in here, email me at mario@adcrime.com and I will fix it in the next version. If you use this Playbook to recover commissions from an affiliate who was stealing from you, I want to hear about it. If you have a case study you are willing to share — anonymized or not — I will credit you and build it into a future edition.

This is a living document. The fraud is not holding still. Neither is this.

— Mario Vaher