How to Prevent Affiliate Fraud in SaaS

I caught my first fraud attempt three weeks after Referralful launched. A beta customer's co-founder had signed up for his own product through his own affiliate link, hoping to grab the 30% commission and the new-customer discount at the same time. It wasn't clever. It was someone testing whether the system would notice.

It noticed, because the check was built into how the commission got calculated, not bolted on after the fact. That's the part most people get backwards. Fraud prevention in affiliate software can't be a review queue you get to eventually. By the time a human notices the pattern, the commission has usually already gone out.

SaaS programs see less fraud volume than a $10 CPA network buying junk leads, but each incident costs more, since commissions often run 20-30% of a subscription's value and can repeat every month the customer stays. Here are the four patterns that actually show up, and what stops each one at the source instead of after the payout.

Self-referrals

This is the one every affiliate program manager runs into eventually. An affiliate signs up for their own product using their own link, either to pocket the commission or to stack it with a signup discount. Sometimes it's not even the affiliate directly. It's a spouse or a second account they control.

The fix isn't a monthly spreadsheet review. It's checking identity signals at the moment a referred customer converts: does the new Stripe customer's email or account trace back to the affiliate who's about to get credit for it? Referralful runs this match automatically and blocks the commission before it's generated, so there's nothing to claw back later because nothing was paid in the first place.

Cookie stuffing

Cookie stuffing means planting your affiliate cookie in someone's browser without them clicking your link or knowing you exist, usually through a hidden iframe or a malicious ad slot. The visitor then buys something completely unrelated to you, and the stuffed cookie claims credit anyway.

It shows up less against SaaS specifically than against high-volume retail, but any program with loose attribution rules is exposed to it. The defense is a click-based cookie, not an impression-based one, paired with server-side attribution against the actual Stripe checkout session rather than a client-side value a browser extension can overwrite. If there's no verified click event tied to that checkout, there's no commission, regardless of what cookie shows up in the request headers.

Fake or trial-only signups

Any program has to decide, explicitly, when a referral counts. Pay a commission on signup instead of on payment and you've built an incentive to generate disposable-email signups just to hit a bonus threshold, especially under tiered or volume-based bonus structures. This is usually the fraud pattern founders find latest, a few months in, once someone notices one affiliate's signups converting to paid customers at close to zero percent.

Referralful's answer is structural, not a filter you configure. Commissions calculate off real Stripe payment events, not account creation. A free trial earns an affiliate nothing until a card is actually charged. That one decision removes most of the incentive to fake volume, because fake accounts rarely have a real card attached to them.

Refund and chargeback gaming

An affiliate refers a customer, collects the commission, and the customer refunds shortly after, sometimes because the affiliate coached them to buy and cancel, sometimes because the affiliate is the customer, refunding themselves after already getting paid. This one is harder to spot at a glance because it can look like a normal, honest refund until you check the timing and the pattern across everything that affiliate has referred.

Two things stop it. Commissions calculate directly from Stripe's payment record, so when Stripe processes a refund, Referralful reverses the linked commission automatically instead of depending on someone to catch it during a manual payout run. And a holding period, 30 days by default, sits between a sale and when its commission actually becomes payable, so a fast refund-and-rebuy cycle never reaches a payout to begin with.

Fraud type vs. defense

Fraud type	How it happens	What stops it
Self-referral	Affiliate buys through their own link, or via a proxy account	Identity match between affiliate and referred customer blocks the commission before it's created
Cookie stuffing	Cookie planted without a real click, via hidden iframe or ad	Click-based cookie plus server-side attribution against the Stripe checkout session; no click, no commission
Fake or trial-only signups	Disposable-email signups to hit a bonus threshold	Commission triggers on an actual Stripe payment, not account creation
Refund gaming	Affiliate or customer refunds after the commission is paid	Stripe refund automatically reverses the linked commission; 30-day holding period before payout

Where you still need a human

No system catches everything on its own, and I'd be lying if I said otherwise. An affiliate slowly building a pattern of referred customers who convert, stick around for two months, then all cancel around the same date needs a person looking at the data, not just a rule engine. Referralful surfaces the signals, per-affiliate churn rate, refund rate, time-to-cancel, so the pattern is visible in the dashboard. Deciding whether to pause that affiliate's account is still a judgment call I'd rather leave to a founder than an algorithm.

If you're setting up a program for the first time, decide these rules before your first affiliate joins, not after you notice a problem. I walked through the actual setup steps, including where commission triggers and holding periods fit, in how to set up a SaaS affiliate program.

FAQ

What counts as affiliate fraud in a SaaS program?

Any action that generates a commission without a real, organic customer behind it. That includes self-referrals, cookie stuffing, fake or disposable-email signups gamed against a bonus, and refund cycles where someone walks back the purchase after the commission is already paid.

Does cookie stuffing still work in 2026?

Less than it used to, but only because more platforms closed the gap. If a program accepts any cookie regardless of whether a real click happened, stuffing still works. Click-based, server-side attribution tied to the payment processor removes the opening.

What happens if a referred customer gets a refund?

The linked commission should reverse automatically the moment Stripe processes the refund, not sit as a manual adjustment someone has to remember weeks later. A holding period before payout gives this time to happen before money goes out the door.

Should I pay affiliate commissions on signup or on payment?

On payment. Paying on signup, even a qualified trial signup, creates a direct incentive to fabricate volume. Tying commissions to an actual Stripe charge removes most of the motivation to fake anything.

Any affiliate program software you use should handle these checks by default, not as an upsell; if you want to see how Referralful runs them against your own Stripe account, it's free until your first affiliate joins, and the pricing page has the rest.