Affiliate fraud: stolen cards, fake sales and why commissions are not paid out straight away
On this page · 8
An affiliate programme pays for a sale. This means that anyone able to stage a sale can try to collect the commission – even though there was no real buyer, or the buyer paid with someone else's card. This kind of deception is called affiliate fraud, and everyone suffers from it: the seller, the cardholder and the honest affiliates whose payouts are delayed as a result.
This article covers how such schemes work, why commissions are not paid out on the same day anywhere, and what measures programmes use to defend themselves. If you are an affiliate, you will understand why your earnings are “pending” for a while. If you sell through affiliates – what is worth writing into the programme rules.
In short
- The most dangerous scheme is purchases with stolen cards through one's own affiliate link: the commission is received now, and the payment is reversed weeks or months later.
- A cardholder can usually dispute a payment within 120 days, so a 30-day hold alone is not always enough.
- Programmes defend themselves with a hold period, a longer period for new affiliates, cancellation of the commission after a refund and suspension of payouts when disputes arise.
- For an honest affiliate this means one thing: you have to wait for the first payout.
How the stolen-card scam works
- The scammer signs up to an affiliate programme and gets a personal link.
- Through it they buy goods or services themselves, paying with stolen card details. They usually pick digital goods and subscriptions – these do not have to be shipped anywhere.
- The programme records the sale and credits the commission.
- The real cardholder notices the charge and contacts their bank. The bank reverses the payment (a chargeback).
- The seller loses the money for the sale, pays a dispute fee and, if the commission has already been paid out, loses that too.
The whole scheme relies on a time gap: the commission is credited immediately, while the payment reversal comes later. The payments platform Stripe states that card networks usually allow the cardholder to initiate a dispute within 120 days of the payment, and when the payment is for a future event or service, the period is counted from the date of the event. The dispute itself can take 2–3 months from start to final decision.
Where stolen cards come from
Most often from the same schemes we see every day in the police daily incident reports: a person clicks a link in a message about a fine or a parcel and enters card or bank details on a fake website. Later they notice that money has been debited from the account. This is the other side of the same chain.
Other forms of affiliate fraud
| Scheme | What it looks like | Who suffers |
|---|---|---|
| Self-purchases | The affiliate buys through their own link to get a “discount” in the form of a commission | The seller: pays a commission for a buyer it had anyway |
| Buy and return | A purchase is made, the commission is collected, then the product is returned | The seller, if the commission was paid out before the return period ended |
| Cookie stuffing | An affiliate cookie is set for the visitor without their knowledge – the sale is attributed to someone who recommended nothing | The seller and other affiliates whose sales are “stolen” |
| Brand advertising in search | The affiliate buys ads on the seller's name and intercepts buyers who are already searching | The seller: pays for its own customers |
| Fake clicks and sign-ups | Bots or paid people click links and fill in forms | Programmes that pay per click or per sign-up |
| Discount code leaks | The affiliate's code is posted on coupon sites and everyone uses it | The seller: a commission is paid for buyers who were already at the basket |
Why commissions are not paid out straight away
A hold period is not distrust of the affiliate but the only way to wait until it becomes clear whether the sale is genuine. During it the product return period ends and most payment disputes have time to arrive.
This is standard across the market. For example, the Amazon Associates rules state that commissions are paid out approximately 60 days after the end of the calendar month in which they were earned. So if you earn at the start of a month, you wait about three months for the money.
On track.lt every programme has its own hold period – you can see it on the programme page and the product page. For tickets and events the commission is held until the date of the event. Once the period ends, the commission is checked once more and only then confirmed for payout.
How programmes protect themselves
No single measure stops all schemes, so they are combined. Below are the measures recommended by developers of affiliate systems, and what each is for.
| Measure | What it does | What it protects against |
|---|---|---|
| Hold period | The commission becomes payable no earlier than after 30 days | Returns, some payment disputes |
| Longer period for new affiliates | In the first months it is held for 45–60 days | “Signed up, bought a lot, vanished” |
| Commission cancellation | When the buyer is refunded or the payment is reversed, the commission is cancelled; if already paid out, it is deducted from the next payout | Buy and return, stolen cards |
| Reserve | Part of the commissions (10–15 %) is held longer and paid out if there were no disputes | Late payment disputes |
| Automatic suspension | When the share of disputes among an affiliate's sales exceeds a threshold, payouts are suspended until a check is made | Systematic fraud |
| Ban on self-purchases | No commission is paid when the buyer is the affiliate themselves | Self-purchases |
| Manual review | Before the payout a person reviews unusual sales | Everything the rules do not catch |
The figures in the table are recommendations from developers of affiliate systems, not a legal requirement. Every programme sets its own periods, and they must be written in its rules.
Signs looked at during a review
- A sale within a few seconds of the click – a real buyer does not shop that fast.
- Many sales from the same device or address, but with different cards.
- A new affiliate with no audience at all who brings many expensive purchases in the first week.
- The buyer's email matches the affiliate's or differs by only one letter.
- An unusually high number of returns compared with other affiliates.
- Payment system warnings about possible fraud – according to Stripe, about 40 % of such Visa and Mastercard warnings turn into disputes if the payment is not refunded.
What this means for an honest affiliate
- Plan your cash flow. The first payout will come no earlier than after the hold period and the next payout date. This applies in all programmes.
- Do not buy through your own link. Even if you only want to “try it out”, such a sale will be rejected, and repeated ones can end in suspension of the account.
- Do not post your code on coupon sites and do not advertise on the seller's name if the rules do not allow it.
- Keep an eye on returns. If there are many, it means you are promising more than the product delivers. That harms you too.
- Read the rules before signing up: the hold period, the minimum payout, what happens after a return.
If money has been debited from your card for a purchase you did not make
What to do
- Call your bank immediately – block the card and dispute the payment.
- Report it to the police via epolicija.lt or by phone on 112.
- Write to the seller whose name appears on the statement: an honest seller will refund the money itself and stop the order.
- Change your passwords wherever the card is saved.
Frequently asked questions
Why is the commission shown but I cannot withdraw it?
It is held until the period specified by the programme ends. During that time the product may be returned or the payment disputed. Once the period ends, the commission is checked and confirmed.
Can I buy through my own affiliate link?
No. Such a sale is not considered a recommendation, and no commission is paid for it.
What happens if the buyer returns the product after I have received the payout?
The commission is deducted from the next payout. This must be written in the programme rules.
How long does a buyer have to dispute a card payment?
Stripe states that card networks usually allow this within 120 days of the payment, and in some cases later.
Is there liability for fraud in an affiliate programme?
Yes. Acquiring another person's property by deception is fraud under Article 182 of the Criminal Code, and the unlawful use of another person's payment card or its data is a separate criminal offence under Article 215.
Sources
- Stripe. How disputes work
https://docs.stripe.com/disputes/how-disputes-work - Amazon. Associates Program Policies
https://affiliate-program.amazon.com/help/operating/policies - Track360. Chargeback Fraud and Payout Protection
https://track360.io/learn/prop-trading-fraud-prevention/chargeback-fraud-payout-protection - Lietuvos Respublikos baudžiamasis kodeksas, 215 straipsnis. Neteisėtas elektroninės mokėjimo priemonės ar jos duomenų panaudojimas
https://www.infolex.lt/ta/66150:str215 - Lietuvos policija. Paros įvykių suvestinės
https://policija.lrv.lt/lt/ivykiu-suvestines/