A referral program can create revenue, or it can become a discount machine for people buying from themselves. Rewardful self referral fraud happens when an affiliate uses their own link to create a commission or customer credit they didn’t earn.
The loss is larger than one commission. Bad referrals distort CAC, retention data, affiliate reporting, and payout forecasts. You need a review process that catches abuse without rejecting legitimate households, teams, or shared workspaces.
Know What Counts as a Self-Referral
A self-referral is not limited to an affiliate signing up with the same email address. That is the obvious version.
The harder cases use a second email, a different browser, a new card, or a separate company account. The affiliate still controls the purchase or receives the benefit. They may be trying to collect an affiliate commission, activate a customer credit, or unlock a promotion.
Separate abuse from valid shared usage
A matching IP address is not proof of fraud. A family can share a home connection. A 30-person company may sign up through one office network. A co-working space can put hundreds of people behind the same public IP.
The same rule applies to surnames, domains, locations, and devices. Each signal can create a reason to review. It should not trigger an automatic punishment.
Look for a pattern that shows common ownership or control. For example, an affiliate and referred customer may have a similar email structure, the same payment method, the same device, and a purchase minutes after the affiliate created a link. That combination needs review.
Define your program boundary first
Write a clear rule before you review records. State whether affiliates can refer a business they own, an employer, a household member, or another account under their control.
Most SaaS programs should use a simple standard:
A commission is not payable when the affiliate directly or indirectly owns, controls, pays for, or receives the main benefit from the referred account.
Customer referral programs need the same rule. A customer credit should not apply when a person opens a second account to buy their own product through their personal link.
Put this language in your affiliate terms, referral FAQ, and signup flow. Ambiguous rules create long disputes later.
Build a Referral Review Record
Rewardful links attribution to your payment system. Rewardful supports Stripe and Paddle, and Stripe events can create the customer, invoice, refund, and commission records needed for a review.
Do not judge a referral from one dashboard field. Create a restricted review record that connects the affiliate, referred customer, payment, and timing data.
Compare identity and account signals
Start with information you already collect for normal account, billing, and referral operations:
- Affiliate name, affiliate email, referral link, signup date, and payout details.
- Customer name, email, company name, account domain, plan, and signup date.
- Stripe or Paddle customer reference, payment outcome, refund status, and available payment-method indicators.
- Referral click time, account creation time, first payment time, coupon use, and commission status.
A same-email match is a strong signal. A similar email pattern may be weak. For example, alex@company.com and billing@company.com could be two valid employees. Compare that with billing ownership, account access, timing, and other records before you decide.
If you need to correct attribution after a verified error, use a documented process. Rewardful’s guide to manually attributing a referred customer starts from the referral record and Stripe customer email. Log why the change happened and who approved it.
Use network and device data carefully
Your application or fraud provider may record IP addresses, device fingerprints, login history, or browser data. Rewardful does not publicly disclose every method it uses to detect potential self-referrals. Don’t assume every signal is visible inside Rewardful.
Use these records only when they are relevant to fraud review and allowed by your privacy notice. Retain less data, restrict access, and set a deletion schedule. The European Commission’s GDPR overview is a useful baseline when you process EU personal data.
Never collect raw card data to solve affiliate fraud. Use the payment processor’s approved identifiers, fraud tools, and event records instead.
Set Up Rewardful Self Referral Fraud Controls
Rewardful can identify potential self-referrals and notify the merchant for review. Its workflow gives you a practical decision point before you pay a questionable commission.
Review alerts before payout
Set an owner for self-referral alerts. This can be a partnership manager, growth lead, or finance operator. The owner needs access to Rewardful, the payment platform, and the review log.
Rewardful lets you assess a flagged case as “Looks Good” or “Looks Suspicious.” Its official guidance on dealing with self-referrals states that marking a referral suspicious deactivates it and stops the commission from being paid.
Use “Looks Good” when the evidence supports a legitimate referral. Record the reason, such as a confirmed employee referral or a household purchase that program terms allow.
Use “Looks Suspicious” when multiple records show common control. Do not delete a record during the first review. Deactivation preserves a safer holding state while you confirm facts.
Delay when commissions become due
Instant commissions make fraud cheaper to attempt. A delay gives you time to see refunds, chargebacks, failed renewals, and support disputes.
Set commission timing around your refund policy and sales cycle. A 14-day trial may need a longer delay than a product with immediate payment and no refunds. The goal is simple: pay for collected, retained revenue, not a temporary checkout event.
If you run customer rewards, review the timing as well. Rewardful’s custom customer referral setup explains how programs can issue credits through a payout.due workflow. Do not treat a payout-due event as a reason to skip fraud review.
Score Multiple Signals, Not One Match
A basic score keeps reviews consistent. It also stops your team from reacting differently to similar cases.
Use a short scorecard. The score decides whether a human looks at the record. It does not decide guilt.
| Signal group | Example | Review weight |
|---|---|---|
| Identity | Same email or clear account-owner overlap | High |
| Payment | Same processor-level payment indicator | High |
| Timing | Click, signup, and payment happen within minutes | Medium |
| Network | Same IP or device record | Low alone |
| Behavior | Similar login path, coupon use, or repeated account pattern | Medium |
Look for linked evidence
One shared network can be normal. One fast signup can be normal. A personal email used by an employee can also be normal.
The risk rises when the records connect. Consider an affiliate who creates three accounts, all pay with a matching payment method, all start after clicking the affiliate’s own link, and all cancel before a commission delay ends. That is a pattern.
Set a review threshold that reflects your business. High-ticket annual plans can justify more manual checks. A low-value monthly product may need simpler controls and a shorter queue.
Protect legitimate customers
Ask for clarification only when the review needs it. Keep the request narrow.
You might ask an affiliate to confirm whether they own or control the referred company. You might ask a customer to confirm that the referrer is not an owner, employee, or household member if that violates your published terms.
Don’t ask for screenshots of bank accounts, government IDs, or unrelated personal data unless a legal or payment-risk process requires it. Affiliate fraud review is not a reason to collect everything.
Investigate Suspicious Referrals in a Fixed Order
An investigation needs a clear record. Otherwise, an affiliate can receive different answers depending on who opens the ticket.
Use this process for every referral that reaches your review threshold:
- Hold the commission or credit. Do not pay, reverse, or delete anything before you check the data. Note the date, reviewer, and current payout status.
- Confirm attribution. Review the affiliate link, click time, cookie or referral value, customer record, and payment event. Check for manual attribution changes or checkout changes that could explain the match.
- Compare the evidence. Review identity, billing, payment, IP, device, login, and timing signals together. Mark each signal as confirmed, unclear, or not available.
- Check legitimate explanations. Look for shared offices, family plans, agency-managed client accounts, team purchases, and authorized reseller arrangements. Read the affiliate’s prior history before you decide.
- Make and document the decision. Clear the referral, withhold the commission, deactivate the referral, or escalate the account. Include the rule applied and the evidence that supported it.
- Send a concise notice. Explain the decision, the relevant program term, and the appeal path. Don’t reveal internal fraud thresholds, device methods, or another customer’s data.
Reverse commissions only when the record supports it
A suspicious record can justify withholding a pending commission. A confirmed fraudulent record can justify a reversal or deactivation under your terms.
Permanent deletion is different. Rewardful notes that deleting a referral cannot be undone. Use its referral deletion process only after you have preserved the relevant evidence and no longer need the record for reconciliation or dispute handling.
For repeated, confirmed abuse, restrict or remove the affiliate. For a first unclear case, a temporary hold and a direct question may be the fairer choice.
Make Prevention Part of Program Operations
Fraud controls fail when they sit outside the program. Put them into campaign setup, payout approval, and monthly reporting.
Publish terms affiliates can use
Your terms should state the commission basis, refund window, payment schedule, prohibited self-referrals, related-account rule, investigation process, and reversal policy.
Affiliates need to know what they can price into their work. A vague line about “fraud at our discretion” is not enough. State that you may withhold or reverse rewards connected to self-referrals, duplicate accounts, false information, or artificial transactions.
Give affiliates a support route before enforcement. Legitimate partners will use it when they are unsure about referring a client, family member, or employer.
Track accepted results, not volume
Clicks are not program health. Neither are raw commission records.
Track approved referred customers, cleared commissions, refunds, reversals, affiliate removals, disputed cases, review time, and retained referred revenue. Keep original referral data, the decision date, decision reason, and reviewer name. Store corrections as new records instead of overwriting the first decision.
A referral system that creates more commissions but also creates hours of review work is not working better.
If self-referrals keep appearing, inspect the signup and checkout path. Check coupon stacking, account creation rules, referral-link placement, and campaign terms before you recruit more affiliates.
A Short Prevention Checklist
Run these checks before you scale a campaign:
- Publish a plain-language rule that bans referrals to accounts an affiliate controls or pays for.
- Turn on Rewardful’s self-referral alerts and assign one review owner.
- Delay commission due dates until the refund or cancellation risk has passed.
- Combine identity, payment, timing, network, and behavior data in one restricted review record.
- Treat IP and device matches as prompts for review, not automatic proof.
- Keep a decision log with evidence, outcome, reviewer, and notification date.
- Withhold, reverse, or deactivate only when your terms and evidence support the action.
- Review reversal rate and accepted commission quality every month.
Keep the Program Fair and Defensible
Rewardful self referral fraud is easier to control when your rules, records, and payout timing agree. The goal is not to reject every unusual referral. The goal is to stop transactions where the affiliate created the customer benefit for themselves.
Review patterns, document decisions, and protect valid customers who share homes, offices, or devices. A fair process keeps genuine partners active and makes fraudulent commissions harder to collect.
