Investigate before holding: Treat an iGaming affiliate fraud alert as a case to investigate, not a verdict. Preserve the click, player-event, sub-ID and commission records; compare the signal with a relevant baseline; ask the affiliate for context; then make a documented payout decision under the agreement. Keep the original event and any later adjustment visible so finance and the partner can trace what changed.
This article focuses on the investigation after a signal appears. The platform-control guide explains where checks can run, while the fraud report covers broader patterns. A control that catches an anomaly is useful only if the operator can explain the case and its payout treatment.
1. Preserve the event trail
Freeze the relevant click IDs, timestamps, redirect chain, affiliate and sub-ID, offer and market rules, player registration, KYC and deposit events, commission calculation and later reversals. Keep the raw record as well as the current status. If a payout was already approved, record any change as a linked adjustment rather than replacing the original line.
| Signal | Evidence to preserve | Alternative to check |
|---|---|---|
| Conversion spike | Click-to-registration times, source placements, campaign dates | A legitimate promotion or event-driven surge |
| Shared device or identity attributes | Account links, KYC status, device and payment records | Household or shared-device use |
| Bonus and withdrawal clustering | Bonus terms, wager sequence, withdrawal time, cohort NGR | A promoted offer attracting similar legitimate play |
| Last-click capture | Earlier touchpoints, redirect logs, click time and conversion time | An approved retargeting or cross-device journey |
| Geo mismatch | Click country, player country, offer permissions, VPN or proxy flags | Travel, network routing or a data-quality error |
2. Test the pattern against the right baseline
Compare the flagged partner with its own earlier traffic and with similar partners in the same brand, market, offer and period. A single high conversion rate, VPN signal or repeated device attribute is not proof of fraud. The pattern becomes more useful when it aligns with downstream outcomes: rejected KYC, duplicate accounts, chargebacks, rapid withdrawals or a missing source explanation.
Use more than one signal before escalation. Check whether the operator changed tracking, bonus terms, landing pages or event definitions during the period. A postback error can produce a conversion anomaly that looks like a partner problem. The software comparison outlines the export and review capabilities worth testing in a platform demo.
3. Ask the affiliate for a specific explanation
Describe the observed change and the period, not an accusation. For example: “Registrations from this sub-ID rose sharply after Tuesday while qualified FTDs did not. Did you change placement, creative or traffic source?” Give a response window proportionate to the active risk and the agreement. Attach the evidence and the reply to the case. A plausible explanation should be tested against event records, not accepted or rejected on tone alone.
4. Decide the payout treatment
| Finding | Possible action | Record to keep |
|---|---|---|
| Benign explanation supported | Close the case or continue ordinary monitoring. | Explanation and supporting events. |
| Unresolved anomaly | Review more events or apply a contractual temporary hold. | Scope, reason, reviewer and review date. |
| Traffic violates a specific rule | Reject or adjust affected commissions under the agreement. | Rule version, affected lines and calculation. |
| System or attribution error | Correct tracking and recompute the statement. | Original and corrected event trail. |
Choose the narrowest action supported by the evidence and contract. A suspicious cohort should not automatically invalidate all traffic from a partner. Separate pending, approved and paid commissions, and identify which lines are affected. If negative revenue or carryover is part of the dispute, use the agreed negative carryover policy rather than an improvised offset.
5. Allow review and close the case
Tell the affiliate what was decided, which events and rule were used, how the amount changed and how to challenge the result. A second reviewer should be able to reproduce the calculation without relying on a verbal summary. Record the appeal, any reversal of the decision and the control change that would prevent the same error or abuse.
Avoid sharing personal player or payment details beyond the people and systems authorized to handle them. Fraud intelligence can be useful, but a case file contains sensitive records and unproven allegations until review is complete.
FAQ
What should an operator do first after a fraud alert?
Preserve the underlying click, player-event, source and commission records, then check whether a campaign or tracking change explains the anomaly.
Does one suspicious signal justify withholding commission?
No. Apply the agreement’s review and hold rules, compare multiple relevant signals, and document the reason and reviewer for any temporary action.
How should an affiliate be contacted?
Present the specific traffic pattern, period and requested context without declaring fraud in advance. Keep the reply in the case record.
What if the anomaly was caused by tracking?
Correct the technical issue, recompute affected events and show the original and adjusted commission lines.
What makes a fraud decision auditable?
A reviewer can trace the source events, applicable rule, affiliate response, decision, statement impact and any appeal or reversal.
