The 2-Hour Fraud Audit Most Affiliate Managers Never Run

Do we have enough evidence to trust this traffic — raw rows and ratios, cohort quality, pattern and documentation checks, then keep, renegotiate, or cut

The questionDo you have enough evidence to trust this traffic?

1. Branch A · Raw rows

   Pull the clicks and IDs, not the dashboard

   Last 90 days of FTDs by affiliate ID, exported as raw rows — dashboards hide outliers. Rank by FTD-to-click ratio. The record flags above 8 percent against a 1.5-4 percent baseline for cold paid traffic, reading the excess as incentivised, bot-driven or self-referred. Its numbers, not universal thresholds.

2. Branch B · Cohorts

   Compare geography, retention and lifetime value

   If 80 percent of a partner's deposits land in one tier-3 country while they claim SEO, the channel story doesn't match the pattern. Sort 30-day LTV ascending — the record puts the fraud in the bottom decile, because real traders don't deposit, lose most of it in two weeks and vanish.

3. Branch C · Patterns

   Check device clusters and account documentation

   Look for users sharing IP ranges, device IDs or carrier patterns beyond statistical noise — one filter in the attribution stack. Then run name and email pattern detection: sequential addresses, repeated surnames, phone numbers from one exchange prefix. Five minutes in a sheet finds what dashboards never surface.

4. Decision · Act

   Keep, renegotiate, or cut on the evidence

   The record's own call is to cut the top three offenders — not pause, not warn — and reallocate to partners in your top quartile for 90-day LTV. The trap it names: running the audit, finding the fraud, and then negotiating. That's how the same partners drain the budget for years.

Stated in the record — 90 days of FTD data; FTD-to-click above 8 percent flagged against a 1.5 to 4 percent baseline for cold paid traffic; 80 percent geographic concentration as a mismatch signal; 30-day LTV bottom decile; 90-day LTV top quartile for reallocation; a 12 percent FTD rate used as the flattering example.

The record frames one decision: whether the evidence in front of you is enough to keep paying a partner. Its argument is that most managers audit conversion rate, which tells you nothing on its own — a 12 percent first-deposit rate looks excellent until the users behind it churn before week three — and that the fraud is three columns over. Every figure below is the record's own; none is a universal threshold. Branch one, start from raw rows and ratios. Pull the last 90 days of first-time deposits by affiliate ID and export them, because aggregated dashboard views hide outliers. Rank partners by deposit-to-click ratio: the record flags anything above 8 percent, against a baseline it puts at 1.5 to 4 percent for cold paid traffic in CFD or iGaming, and reads a figure above that as incentivised, bot-driven or self-referred. Branch two, compare cohorts rather than headline conversion. Cross-check geographic concentration — if 80 percent of one partner's deposits come from a single tier-three country while the partner claims search traffic, the claimed channel does not match the pattern. Then pull 30-day lifetime value by cohort and sort ascending: the record's read is that the bottom decile is where the fraud sits, because real traders do not deposit, lose most of it in two weeks and disappear, while bonus abusers do. It names three signals overall — velocity spikes that do not match the claimed channel, conversion rates that defy the geography, and lifetime value that collapses inside 30 days — and says these three catch the bulk of the bleed. Branch three, check patterns and documentation. Compare device fingerprint clusters through the attribution stack and look for partners whose users share IP ranges, device identifiers or carrier patterns beyond statistical noise. Run name and email pattern detection for sequential addresses, repeated surnames, and phone numbers from the same exchange prefix — the record says five minutes in a sheet surfaces what dashboards never do. Branch four, act on the evidence. The record's own instruction is to cut the top three offenders rather than pause or warn, and to reallocate that budget to partners in the top quartile for 90-day lifetime value. It names the trap directly: managers who run the audit, find the fraud, and then negotiate — which is how the same partners drain a budget for years. Its closing line is that this is a fraud problem dressed up as a CAC problem.