How to Prevent Referral Fraud on a Rewards Site

How do you prevent referral fraud on a rewards site?

You prevent referral fraud by making it unprofitable: pay referral rewards only from the referred user’s earnings after they are confirmed and past your hold period, link accounts that share devices, networks, and payout destinations, cap and review the patterns farms rely on, and keep the right to take back rewards in your terms. Most referral fraud on rewards sites is one person, or one small group, posing as many users. When a fake referral cannot earn anything until real, confirmed activity happens, most schemes stop being worth the effort.

This guide is for owners of rewards websites, GPT sites, and apps with an offerwall that run a refer-a-friend program. It is not legal advice. For how to design the program itself (rates, tiers, and promotion), see How to design a referral program for a rewards site.

Why referral programs attract fraud

A referral program pays one user for activity by other users. If one person can create the “other users” themselves, every bonus and commission goes to the same pocket, on top of the rewards those accounts already collected.

On a rewards site the cost often doubles. Fake accounts that complete offers create results advertisers later reject. When a result is reversed, you lose the payout, and if you already paid the user and the referrer, that money is gone too. Repeated reversals also raise your reversal rate, which is how your offer partners judge your traffic. OWASP lists bulk account creation as its own automated threat, OAT-019 Account Creation, defined as creating multiple accounts for subsequent misuse. Referral farming is one of the most common reasons to do it on a rewards site.

Common referral fraud schemes

Most cases fall into a handful of patterns, and each has a signal that tends to expose it.

Paid incentive groups are the hardest to judge, because the people are real. But they have no interest in the offers, and advertisers often reverse that activity, so your terms should forbid paying people to sign up.

Detection signals that expose referral farms

A fake referral is usually the referrer again, so the most useful checks compare the referrer with the accounts they referred, not each account on its own.

Shared devices and fingerprints

Store a device identifier with every account and compare the referrer’s devices with those of the people they referred. On the web, a device fingerprint links browsers that share a setup, but popular phones and browsers produce many identical fingerprints, so treat a match as a reason to look, not as proof.

In Android apps, Google’s Play Integrity API overview describes checking that requests come from your genuine app, installed by Google Play, running on a genuine and certified Android device, and lists emulated environments among the risks it helps you detect. Its optional recent device activity verdict tells you how many integrity tokens your app requested on one device in the last hour, which Google says helps protect against “unexpected, hyperactive devices” (see the Play Integrity verdicts page, checked on October 22, 2026). A device farm pushing many accounts through one phone tends to stand out there.

IP, network, and ASN clusters

Many referred accounts signing up from the same IP address, the same small range, or the same network provider (ASN) within a short time is a classic farm pattern. So is a referral tree where every account uses a data center or proxy network. Mobile carriers and campuses put many honest users behind shared IPs, so weight a network match lower than a device or payout match.

Sign-up bursts

Real referrals trickle in after a link is shared. Farms arrive in batches: ten or twenty accounts within an hour, often with similar usernames or email patterns.

Identical behavior timing

Look at what referred accounts do after sign-up. When several of them open the wall, start the same offers in the same order, and finish them minutes apart, one person is usually working through a list. Completion times faster than a person could manage point to automation; Ad fraud and bot traffic covers bot patterns in more depth.

Offer completion patterns

Farmed accounts chase high-paying offers that finish quickly, do just enough to trigger the referral payout, and then go silent. Genuine referred users have a more varied history and come back.

Shared payout destinations

This is often the strongest link of all, because the money has to go somewhere. Two accounts in one referral tree that cash out to the same payment account, gift card email, or wallet address deserve a hold and a review, whatever the other signals say.

No one signal is enough. Uber’s engineering team, in a 2021 case study on using relational graph learning to detect collusion, notes that fraudulent users are often connected and clustered through shared information, which is why it modeled users as a graph. Uber says that model is not used in its production platform, but the lesson carries to any rewards site: review the cluster, not the single account.

Pay referral rewards only on confirmed earnings

This one rule removes most of the profit from referral fraud. If the referrer earns nothing until the referred user’s own earnings are confirmed and released, a fake account that only creates reversed results pays the referrer nothing.

• No referral bonus for sign-up alone. A bonus paid when an account is created is the easiest money a farm can collect. Tie any one-time bonus to a milestone, such as the referred user’s first earnings that cleared your hold.
• Commission from released earnings, not credited earnings. When a referred user’s reward moves from on hold to available, create the referrer’s commission at that moment. Reward hold periods explains how to set the hold length from your reversal data.
• Link every commission to its source. Store the transaction ID of the reward that produced each commission. When that reward is reversed, the commission linked to it is reversed too.
• Reverse in one step. On a status 2 reversal postback for a transaction ID you credited, cancel the user’s reward and every referral commission created from it, once. Postback security covers signature checks and duplicate handling.

Controls that make farming unprofitable

With pay-on-confirmed in place, add limits that cap the damage from anything that still slips through.

• Caps on daily repeats. Limit how many new referrals per referrer can earn commission in a day, and how many times the same offer pattern can repeat inside one referral tree. Honest referrers rarely hit a sensible cap; farms hit it on day one.
• Commission ceilings for new referrers. Cap referral earnings until the referrer has a clean history of their own, then raise the cap.
• Network checks. Block earning from VPN, proxy, Tor, and data center connections, and run the check at sign-up, when the wall opens, and at cashout. Stop multi-accounting and VPN abuse covers the full layer.
• One payout destination per account. Flag any destination already used by another account, and hold cashouts from both.
• KYC thresholds at cashout. Ask for stronger verification when lifetime referral earnings or a single cashout passes a set amount. Farms rely on many small, anonymous accounts; one verified identity per cashout breaks that. KYC for rewards sites covers when and how to ask.
• Manual review queue. Send first cashouts, large referral payouts, and clusters with two or more strong signals to a person before money leaves.
• Clawback rules in your terms. State one account per person, no self-referrals, no paying people to sign up, that referral rewards depend on confirmed earnings, and that you may cancel or take back rewards from activity that breaks the rules. Rewards site terms of service walks through the wording.

How advertisers and networks flag farms

Advertisers check what happens after a conversion: whether the install opens again, whether the account is real, whether the purchase is refunded. When they find farmed results, they reject them, and you receive reversals. A wave of reversals from one referral tree is often the first outside sign of a farm.

Use that feedback on purpose:

1. Pass a stable user identifier in the sub ID of every wall link, so each credit and reversal maps back to one account. Click IDs and sub IDs explains the parameters.
2. Track reversal rate per user and per referral tree, not only for your whole site. A tree whose reversal rate is far above your site average deserves a review.
3. When one account in a tree is confirmed as fake, re-check the referrer and every sibling account.

For the full path a reversal takes and what it does to your balance, see Publisher earnings, settlement, and reversals.

How to review a referral cluster

When signals fire, review the referrer and their whole tree as one case. A simple, repeatable process:

1. Freeze, do not ban. Hold pending cashouts and referral commissions in the cluster. Let users keep browsing.
2. List the links. Which accounts share a device, network, payout destination, or sign-up window with the referrer?
3. Compare behavior. Same offers, same order, same minutes? Activity only until the referral payout, then silence?
4. Check outcomes. How many results in the tree were reversed, compared with your site average?
5. Decide per account. Real referred users keep their rewards even if the referrer was cheating. Fake accounts lose rewards from rule-breaking activity, and the referrer loses commission from them.
6. Record why. Keep a short note of the signals and the decision, so appeals and repeat cases are quick to handle.

Handling false positives

Referral programs bring in exactly the people who trigger fraud signals by accident. Siblings refer each other from the family computer, roommates share Wi-Fi, and a streamer posts a link and a hundred real viewers join within an hour.

• Score, do not guess. Combine signals into a risk score and act on the total. A shared network alone is weak; a shared network, device, and payout destination together is strong.
• Use soft actions first. Hold a cashout, ask for verification, or pause commission before you close an account.
• Separate the referrer from the referred. A cheating referrer does not make every person they invited a fraudster, and an honest referrer should not lose commission because one invitee cheated.
• Explain and offer an appeal. Tell the user what rule applies in plain words, and let a person review the appeal. If appeals keep overturning one rule, fix the rule.
• Mind privacy. Device and network data can be personal data. Collect only what you need for fraud prevention and say so in your privacy policy.

Frequently asked questions