What if a big chunk of your cashback growth wasn’t real cashback users at all?

Most affiliate managers would see “cashback number go up” and call it a win. But according to Ben Edelman, that number could be hiding affiliate fraud from rogue affiliates you already kicked out of your program.

I recently sat down with Ben on the Affiliate Nerd Out Lunch and Learn edition to talk about something I’d never heard of until I read his blog post: cashback hijacking. Ben tests software for problems, and these days, he’s spending a lot of time on affiliate software. “There are a lot of problems, so I’ve been busy,” he told me.

Key Takeaways

• Cashback hijacking is a form of affiliate fraud that lets rogue affiliates get paid through ordinary cashback accounts, even after you’ve removed them from your program.
• The red flag is a “double mismatch”: the click and the purchase come from different IP addresses and different user agents.
• Affiliate managers can’t catch this on their own. They don’t have access to the IP or device data.
• Cashback services should share a salted, hashed user ID with networks so purchases can be grouped by user.
• Longer locking periods with real enforcement make this fraud far more expensive for the people doing it.

---

• Facebook
• X
• LinkedIn

Share this Episode

Meet Ben Edelman

---

---

What Is Cashback Hijacking?

A lot of merchants already know the risks of sub affiliate networks. You want some control over who promotes your program, and letting anyone in gives that up.

Cashback hijacking is a worse kind of affiliate fraud. Ben calls it “an unlimited backdoor.” Even if you supervise your sub affiliate networks closely, or don’t use them at all, strangers can still get in, “do what they want and take your money.”

Here’s how it works. A rogue affiliate gets kicked out of your program. Instead of moving on, they join a bunch of cashback programs and grab those cashback links. Then they send third party users through them, often found through brand bidding, adware, or some other shady tactic. The purchases get credited as if the fraudster bought the product in a cashback context.

Do that across a large number of cashback accounts, and it causes chaos for any merchant who’s paying attention. For the merchants who aren’t, it just looks like healthy cashback growth.

How a Hijacked Sale Flows

Want the full technical breakdown? Read Ben’s original research: Cashback Hijacking on benedelman.org

Why Nobody Catches It

“Honestly, this is kind of hard to catch,” Ben said.

Cashback users are supposed to join programs and buy things. That’s the whole point. And cashback services don’t vet their users. There’s no tax compliance or know your customer check just to sign up. On top of that, cashback services don’t share user details with merchants or networks, since that would be viewed as a privacy violation.

So when I asked Ben how the average affiliate manager could spot this, his answer was blunt: “I think you can’t.”

That’s what makes this one different from the other fraud he’s worked on over the last two decades. There’s no amount of testing or sweat equity an affiliate manager can put in to fix it. It has to be solved by the cashback service, the network, or both working together.

I will say the industry is getting better here. Platforms like Everflow are making it more visible who affiliate managers are actually working with. There’s progress, but it’s not perfect.

Affiliate Fraud Detection: Look for the Double Mismatch

Ben’s recommended method for networks and cashback services is to look for a “double mismatch.”

A cashback click and purchase should come from the same person, probably in a single session. So if the click has one IP address and user agent, and the purchase has a different IP address and a different user agent, how much do we really believe it was the same user?

“Probably don’t believe it,” Ben said.

One mismatch is weird. Two is weirder. “By the time you get above two, I think it’s implausible.” And if a cashback user has 10 purchases with a double mismatch on every single one, it’s pretty clear what they’re up to.

That’s why networks need to look at patterns by cashback user, not just sale by sale.

Affiliate Fraud Prevention: What Networks and Cashback Services Need to Do

Ben has never seen a network offer this as a report to merchants. It can be done through SQL by a fraud analyst at the network, but that’s about it. A report could easily be built, using hashed IP addresses since raw IPs are considered sensitive.

The most important piece, though, has to come from cashback services. They need to reveal which purchase comes from which user. Not a name or email, but “a salted hashed version of user ID one two three.” That lets the network group purchases by user for fraud detection without exposing anything sensitive.

What about networks who say this is too much work? Ben’s take: it’s important work, networks are uniquely positioned to do it, and affiliate managers literally can’t do it themselves. Protecting merchants from fraud is a big reason merchants pay networks in the first place.

I pushed back a bit here. Networks make money on transactions, including fraudulent ones. Ben agreed the skepticism is fair, but he thinks the smarter networks take the long view. “If we make this short term money now, how many merchants are gonna wanna keep their affiliate programs in the long run?” Programs get shut down when the CFO and head of legal start asking questions no one can answer.

My own take is that the newer challenger networks are the ones most open to building this out. ClickGo, for example, has some strong fraud protection for merchants, so take a look if this is a big concern for you.

Sponsor: Recruiting affiliates shouldn’t eat your whole week. Alfie, the affiliate manager tool by XPFlow, handles the outreach grind so you can focus on partner relationships.

Use Delay to Make Fraud Expensive

Here’s a clever angle Ben shared. Cashback users already expect to wait 30 days for their cashback, sometimes 45 or more for travel. Fraudsters don’t have that luxury. If they’re buying brand keywords on Google Ads, they have to pay Google fast.

“If you get discovered sixty days later and you don’t get paid, you’re out sixty days of Google Ads expense,” Ben said. That turns a significant profit into an even bigger loss.

For high risk users showing double mismatches, Ben would put them on a 60 day lock, then zero out the commissions. The key is delay with enforcement. The delay alone doesn’t hurt them. Following through does.

Conclusion: Ask the Hard Questions

Can brands hire Ben to investigate? “I can’t do it either,” he said. He doesn’t have access to IP address data any more than you do.

What brands can do is ask their cashback services and networks one question: what are you doing to prevent cashback hijacking? If you don’t get a good answer, you have to worry that fraudsters are masquerading as cashback users in your program. Affiliate fraud you can’t see is still affiliate fraud.

That might not sound like much, but as Ben put it, asking the hard questions “could be enough to get folks moving.”

For the full research behind this episode, read Ben Edelman’s write-up on cashback hijacking.

---

FAQs