Affiliate and Lead Generation Fraud

Two different disputes arrive under one heading

Two problems get filed as affiliate fraud, and separating them is the first useful thing to do with the file.

Affiliate fraud is attribution theft: a party that contributed nothing to a sale manipulates the tracking so it is paid anyway. The canonical mechanism is cookie stuffing — dropping an affiliate tracking cookie into a browser with no click, so that if the person later buys from the merchant on their own, the affiliate collects the commission.

Lead-generation fraud is misrepresentation. The ads, the landing pages, or the source labels on the leads misstate who is behind the offer, what the consumer is signing up for, where the data goes, or where the traffic came from.

They share a proof method, and it is not the ads. Both are established from the tracking and traffic record.

The merchant's own logs carry part of this. The rest — who wrote the code, who approved the creative, what the network told the affiliate — arrives through discovery.

What cookie stuffing is, in the words of a prosecution that succeeded

This is one of the few corners of paid media that has produced federal criminal convictions, which means there is a prosecutor's description of the mechanism attached to a guilty plea rather than a vendor's description attached to a sales page. The indictment issued June 24, 2010 and charged wire fraud under 18 U.S.C. § 1343, plus criminal forfeiture. One defendant pleaded guilty on April 15, 2013 to roughly $5.2 million in fraudulent commissions taken between May 2006 and June 2007, and was sentenced in August 2014 to fifteen months in prison.

The Department of Justice described the mechanism this way:

when a user visited a website that had installed the application, the code would cause the user's browser to receive a cookie with KFC's ID number, even though the user did not click on an eBay ad or link, did not see any content from eBay's website, and did not realize that his or her browser had been redirected to eBay's tracking server

Four separately observable facts are packed into that sentence, and each is a field in a log: the cookie was set, no click occurred, no merchant content was displayed, and the browser was redirected without the user's knowledge. The delivery method varies — a widget a publisher installs, an invisible iframe, a chained redirect, a browser extension — but those four facts do not.

The Media Rating Council classifies cookie stuffing as sophisticated invalid traffic, the category its standards define as requiring advanced analytics, multi-point corroboration and significant human intervention to detect. That is not a list-based filter question, and the work should be scoped accordingly.

The signatures that show up in a click record

What an examiner produces is a set of distributions and joins the other side can re-run. The recurring signatures:

• Click-to-conversion times that are implausibly short. Legitimate referral traffic produces a long-tailed distribution. Stuffed traffic produces a spike near zero, or a curve matching the merchant's own organic purchase timing rather than a referral pattern.
• Impossible arithmetic. A publisher generating conversions at a rate requiring several times the traffic its own pages received.
• Referrer fields that do not support the hit. A load of the merchant's tracking URL whose referrer is a page containing no affiliate link is the direct signature of an invisible redirect.
• Conversion rates far outside the population for the same offer and traffic.
• Geographic and device distributions that look like general web traffic rather than the publisher's stated audience.
• Sub-ID patterns that are uniform, sequential or machine-generated across what is presented as a diverse publisher base — one source wearing many names.
• Attribution sensitivity. Where the allegation is that a cookie was written last, over someone else's, re-running the conversion set under alternative rules shows how much credit depends entirely on being last.

None is dispositive alone. Together they support a finding about a share of an affiliate's traffic, and that share is what the analysis defends.

Where lead-generation disputes have actually been decided

The enforcement record here is deep, recent and specific — the part of this subject with real authority behind it rather than practitioner folklore.

The governing appellate statement on intermediary liability is FTC v. LeadClick Media, LLC, 838 F.3d 158 (2d Cir. Sept. 23, 2016). LeadClick ran an affiliate network whose affiliates promoted a weight-loss seller through pages styled as independent news reporting. The Second Circuit held a defendant liable under Section 5 where, with knowledge of the deception, it “either directly participates in a deceptive scheme or has the authority to control the deceptive content at issue.” LeadClick met that standard by recruiting affiliates that used fake news sites, approving creative and requesting edits, and Section 230 immunity was denied on three independent grounds. The slip opinion is worth reading where the intermediary question is live.

The pattern repeats down the chain: a $104 million judgment in 2017 against a loan lead generator alleged to have sold applications to the first buyer willing to pay, and a $30 million settlement in August 2019 with an education company whose lead generators posed online as official military recruiters or as job-finding services. In August 2025 the FTC announced settlements totaling $145 million in which paid search advertisements and the ad's own domain were named as instruments of the deception; one defendant sold approximately 119 million leads in a single year, and the charges included the Telemarketing Sales Rule and the newer Impersonation Rule.

What that record establishes for an examiner is that both directions of the chain carry exposure, and that the evidence treated as probative is the evidence I would ask for: the creative as served, the pages as rendered, the source labels on the leads, and the network's own approval traffic.

Co-registration, incentivized traffic, and misrepresented sources

Three lead-quality complaints recur, and the terms are used loosely. Stated precisely:

Co-registration. A consumer submits a form for one offer and, through a checkbox, a pre-checked box, or an interstitial offers page, is simultaneously registered as a lead for unrelated advertisers. The dispute is about what the consumer saw at the moment of submission, which makes an archived capture of the form page and the timestamped consent language decisive — not the lead file.

Incentivized traffic. The user is paid, rewarded with points or given in-game currency to complete an action. The action happens; the intent behind it does not exist. Its signature is a mismatch between the ends of the funnel: strong front-end volume, essentially no downstream conversion.

Misrepresented sources. Traffic sold as coming from one channel and delivered from another — arbitraged traffic sold as owned inventory, incentivized traffic sold as organic, automated traffic sold as human. The most litigated of the three, because it reduces to a misrepresentation if the source can be shown.

The honest boundary: neither co-registration nor incentivized traffic is inherently unlawful. Both are disclosed, contracted-for models in parts of the industry, and they become a claim when they are misrepresented to the buyer or when the consumer-facing disclosure fails.

What the traffic record will not show

Every page here names what will not work. Here it is a list, because each item is a theory somebody has tried to build on a log file:

• That the publisher knew. Stuffing code can be injected by a downstream sub-affiliate or by an ad network the publisher used. The record shows the mechanism operating, not whose hand put it there. Intent comes from the code repository, the ad-tag chain, and the communications.
• That a consumer was deceived. A page capture shows what the page said. What a person understood is a survey or testimony question.
• That a lead was fake. A real name and a real number that never converts proves nothing. Fraud requires showing the consumer never took the action attributed to them, or that the stated source is false.
• Exactly which commissions were fraudulent. The share of an affiliate's credited conversions carrying the signature can be estimated and defended; a per-transaction split usually is not recoverable, which is one reason these matters resolve on aggregate figures.
• That the merchant's own attribution rules were right to begin with. Several disputes labeled affiliate fraud are disputes about the last-click rules the parties agreed to — contract territory.
• That a competitor was behind it. Commonly alleged, rarely provable from traffic data.

The clock on each record, and the artifact that vanishes first

The perishable evidence in an affiliate matter is not the platform data. It is the publisher's page. A live capture with a network trace — showing the tracking pixel or iframe firing with no user interaction — is the most persuasive artifact available, and the code can be removed the day a demand letter arrives. Capture first, theorize later.

The platform-side clocks are published and short. From Google's retention documentation, read August 14, 2026:

The reporting figures took effect June 1, 2026, and Google states data outside the window is “not accessible via the Google Ads interface or APIs.” For affiliate networks themselves I have found no published retention commitment at all. Treat the window as short and undocumented, take the row-level export while access exists, and do not assume a network's interface will still render a period it no longer holds. A preservation letter changes no retention setting anywhere in this stack.

What I would ask counsel to obtain, in order

1. The raw log, not the report. Network reports are aggregated and normalized. The dispute lives at the row level: timestamp, IP or its truncation, user agent, referrer, affiliate ID, sub-ID, landing page, order ID and order value.
2. The merchant's own server and CDN logs for the same period. These are the only records fully inside one party's control, and a hold on them is cheap and urgent.
3. Captures of the publisher pages with network traces, taken before any notice goes out that would prompt a change.
4. The affiliate agreement and the network's terms, including the attribution rule actually in force and any change to it.
5. The network's approval record — what creative was submitted, approved or edited, and by whom.
6. The lead files with source and sub-ID fields intact, and archived versions of the form pages that produced them.
7. The downstream outcome data from the buyer's own system, where incentivized traffic separates itself from real intent.

The first three degrade. The rest generally do not. If budget forces a sequence, that is it.

When this is not worth an expert

Three fact patterns arrive regularly and should not.

The leads were bad. Volume arrived, nothing closed, and the theory is fraud. Without a source misrepresentation, or evidence the consumer never took the attributed action, this is a quality dispute and probably a contract one.

The fight is about the attribution rule. If the disagreement is whether last-click credit should have gone to one party or another under terms both signed, the numbers are not in dispute; the meaning of the agreement is. Re-running the data under alternative models shows the size of the difference, which sometimes helps a settlement conversation, but it does not resolve the question.

Only aggregate reports exist. If the row-level records are gone and no captures were taken, the signatures above cannot be computed, and an opinion built on totals invites the response that totals were all the examiner saw.

Frequently Asked Questions

Published 2026-08-14 · Last reviewed 2026-08-15