What if your best converting partner is actually costing you money?

The orders are real. The cards are clear. Chargebacks look normal. Your affiliate fraud detection tools find nothing, and your affiliate team sees a star performer. The only thing wrong is whose name is on the commission.

That’s attribution theft, and I’d never seen it written down properly until James Nardell put out a 40-page paper on it. James is the founder of Affiliate Manager Experts, an agency that manages software and SaaS affiliate programs, and he’s been in affiliate marketing since 2002. I brought him on a three-part Affiliate Nerd Out Lunch and Learn edition to walk through the problem, the evidence, and what to do about it on Monday morning.

The funny part? He wasn’t looking for fraud. “I had a number in my programs reporting that I couldn’t explain, so I pulled the raw exports instead of the dashboard.”

Key Takeaways

• Attribution theft uses synthetic clicks to take last click credit for sales that came from other channels or other partners.
• It passes order quality, reversal, chargeback, and unit economics checks, because the orders are real.
• Watch for one partner’s conversions climbing while good partners send steady clicks and get fewer orders.
• Escalate only when signals converge. Shape alone is never enough.
• A holdout test is the only thing that settles whether a partner is originating or intercepting.
• Don’t accuse anyone. Ask partners to evidence their traffic sources.

---

---

• Facebook
• X
• LinkedIn

Share this Episode

---

What Is Attribution Theft?

Here’s how James described it. An operator account fires clicks, and each one creates an eligible tracking record. The customer buys through search, paid, email, or another affiliate. Under last click attribution, the most recent record wins. “The consumer sees nothing, they click nothing, and they buy.”

The brand pays an acquisition fee for demand it often already had. The partner who did the real work gets nothing and can’t prove it. So they throttle their campaigns, and the program loses demand it has to buy back later. “It’s the partner that feels it first, but it’s the brand that really pays for it eventually.”

James has a great phrase for this: eating your seed corn. You look great on sales volume in the short term, while the partners at the top of the funnel quietly give up.

Why Every Fraud Check Comes Back Clean

Most fraud has obvious tells. Here, the click is the only synthetic thing, and nobody audits clicks in a CPA program.

James walked through the standard checks. Order quality passes. Reversals are normal or better. Chargebacks look normal. Conversion rate is often the best in the program. Even blended CAC and LTV look good.

“A downstream metric asks whether the customer was worth having. It can’t ask whether you’d have had that customer anyway.” And the better your back end monetizes, the more room someone has to sit in front of it and clip acquisition fees.

For me, a conversion rate that’s way above your program’s normal range is always the biggest red flag.

Meet James Nardell

---

---

What It Looks Like in Your Reports

From the affiliate manager’s seat, you’re looking for a partner that’s your highest converting and least incremental at the same time. Then look at the other side. Good partners are sending steady or rising clicks while their orders fall, and they’re writing in to ask what’s wrong with your tracking.

“These aren’t two problems.” One partner’s conversion rate is climbing because another’s is collapsing. James saw one victim send 200,000 clicks in a month and get credited with one sale.

The trap is textbook management: scale the producer, cut the rest. You’ll get praised for it. But you end up feeding the bad accounts and starving the good ones. And as James put it, displaced partners “rarely complain twice.”

This usually runs for months before anyone catches it, and sometimes it never gets caught.

Affiliate Fraud Detection: The Signals in Your Click Data

James runs a daily screen that takes about 20 minutes with two exports and one prompt in Claude: the click file and the duplicate clicks file most programs never open. The prompt asks for measurements only. It specifically tells the model not to score anyone or call any account suspicious. His first version ended with “flag anything suspicious,” and it gave him conclusions when he needed numbers.

He groups signals into four classes:

1. Provenance. Can anyone verify where the click came from? A high share of empty referrers is a flag, though in-app traffic and privacy browsers cause them too.
2. Shape. Traffic that behaves differently, like five clicks on one IP inside 10 seconds. “A human being absolutely cannot do that.”
3. Structure. Separate accounts sharing a system, like the same random sub ID strings, throwaway domains, or unresolved macros.
4. Sequence. A credited click that follows an earlier touch from another partner.

Calibrate across your whole partner base for two weeks before flagging anyone. And watch your baseline. In his demo data, the program wide no referrer rate was 64%, but that number was dragged up by the two accounts under review. Remove them and the rest of the program sat around 40%. “If you build your baseline out of a population that includes the problem, you’ll talk yourself out of the finding.”

The Clean Partner That Looked Guilty

This was the part that stuck with me. One account had a duplicate rate identical, to one decimal place, to the worst account in the file. A threshold rule would have suspended it.

If you’d built a rule that said near zero duplicates on volume means cookie stuffing, you would have caught both. But this one was clean. Real referrers, varied user agents, no bursts, nothing shared. In fact, it was the largest single victim of displacement.

“Shape alone is never enough. That is the whole rule.”

James also walked back a signal he originally pitched me: click to conversion latency. Under last click, the credited click is by definition the one closest to the purchase, for fraudsters and legitimate late funnel partners alike. “Measuring that gap measures the attribution rule, not the traffic behind it.”

Building a Case: Finance Will Accept

What James puts in front of finance is a table. One row per transaction, with four things in every row: a legitimate partner clicked from the same consumer key earlier, the credited click had a provenance problem, the suspect took the commission, and the purchase address corroborates it.

Then he’s careful about what he claims. “Displacement occurred in these specific transactions. Here they are. Here’s the commission paid.” That’s very different from “a partner stole a lot of money,” which requires incrementality and recoverability that click data can’t prove.

On money, keep gross attributed commission, approved commission, strongest evidence, modeled exposure, recoverable amounts, and true incremental loss side by side. Never total them. Gross attributed commission is what the CFO will reach for, but it’s the scale of what’s at stake, not the size of the loss.

The Holdout Test and Your Monday Morning Plan

Everything above is observational. A holdout test, a form of incrementality testing, isn’t. Suspend a source for a set period and watch total program volume. If total demand drops by roughly their share, they are originating. If it holds while theirs goes to zero, they are intercepted.

Getting it approved is the hard part. Don’t ask to remove your top reported partner. Ask for “one sub ID, two weeks, a written trigger, a named owner.” And run it longer than your attribution window, or carryover will muddy the result.

James’s Monday morning order of operations:

1. Preserve exports, configuration, and account status before anything changes.
2. Reconcile exports against the platform’s own summary.
3. Identify the biggest attribution concentrations and the partners whose clicks held while orders fell.
4. Confirm you can join clicks to transactions on a consumer level key, like an IP or a salted hash of one.
5. Choose a control partner and write down alternative explanations before scoring anyone.
6. Define a reversible holdout with a success measure, duration, and named decision maker.

When you act, reactivate the displaced partners at the same time and tell them to scale again. And for your next network contract, get event level exports, stable identifiers, and a privacy approved join method written in as a right, not a favor.

Conclusion: Ask, Don’t Accuse

The one thing you can’t do first? Accuse anyone.

“When you put fraud in writing, it turns into a dispute about character.”

Ask partners to evidence their traffic sources instead. A legitimate partner answers inside a day, and evasion becomes part of the record.

My approach is similar. I ask partners to explain their traffic and give them 48 hours before commissions are frozen. How they respond tells me a lot.

James also uses Claude heavily for this analysis, and I’d be doing the same if I were running programs day to day. Just remember the caveat: AI finds correlations, but the judgment is still yours.

Watch the full video with James on Affiliate Nerd Out, and grab his full paper at dustinhowes.com/james. 

For more on affiliate fraud, check out my episode with Ben Edelman on cashback hijacking.

FAQs