Investigate unusual affiliate sales by checking the order records, the attribution record and the program rule that applied at purchase. Give the creator a specific question and a chance to respond before deciding commission eligibility. Treat a risk flag as a reason for human review. Keep customer details inside your restricted commerce tools and offer a second review of disputed decisions.
This affiliate fraud review procedure is an operational recommendation. Your platform settings, agreed terms and applicable law determine what actions you can take.
Separate the questions before opening a case
An order can raise several different questions:
- Payment risk. Was the purchase authorized, and should the store fulfill it?
- Commission eligibility. Does the transaction qualify under the program's rules, including any self-purchase restriction?
- Attribution accuracy. Did the tracking system assign the right creator?
Assign payment verification to your commerce or payments team. The affiliate manager should decide commission eligibility using that team's findings. A legitimate purchase might be excluded from commission under a self-referral rule. An unauthorized purchase might involve a creator who had no role in the abuse.
Start with the terms that were in force. Do they prohibit the creator's own purchases, household purchases, resale purchases or all three? Do they address approved test orders? Avoid expanding a vague self-referral clause after a sale. Escalate ambiguous terms to the person responsible for the agreement.
For attribution disputes, decide how links and discount codes share credit before treating a conflicting record as misconduct.
Build a small, restricted case record
Use one case per related set of orders. Record the following before contacting the creator:
| Record | What to save |
|---|---|
| Scope | Internal order references, dates, currency and creator ID |
| Trigger | The observed signal, its source and when it appeared |
| Attribution | Link or code assignment and applicable tracking rule |
| Order state | Payment, fulfillment, cancellation, refund and dispute status |
| Eligibility | Relevant terms version and any approved exception |
| Review | Reviewer, alternative explanation, next action and due date |
| Money | Commission under review and unaffected commission |
Use neutral language such as "delivery-address match requires review." Avoid putting "fraudster" in the creator's record. Record what would disprove your initial concern as well as what supports it.
Shopify's fraud-analysis documentation describes address and card checks, unusual device or network activity, and attempts using multiple cards. Available indicators differ between orders. Its overall recommendation concerns chargeback risk due to fraud. Shopify also warns against making fulfillment decisions from one indicator or the number of indicators.
An IP address alone does not establish wrongdoing. Nor does a delivery-address match establish who placed an order. Ask your authorized reviewer to check the relevant records together, without collecting extra customer information to make the file look complete.
Test a benign explanation before drawing a conclusion
These examples are hypothetical. They illustrate review decisions, not measured fraud patterns or automatic rejection rules.
| Observed signal | Benign explanation to test | Evidence that merits further review | Next action |
|---|---|---|---|
| Creator and buyer share a delivery address | An independent household purchase | Creator confirms buying for personal use under a rule excluding that purchase | Apply the stated eligibility rule; assess intent separately |
| Several orders share a network address | Shared workplace or household connection | Payment team finds additional payment-risk signals | Refer payment verification to that team |
| Orders arrive close together | A creator has published a time-sensitive offer | Records suggest repeated attempts tied to an unresolved payment concern | Compare content timing and order records |
| A sale is refunded | Product fit, damage or a normal return | A repeated pattern warrants a documented eligibility review | Reconcile the refund first; investigate separately |
| Code use appears outside creator content | Someone else reposted a public code | Evidence suggests the creator placed it somewhere the agreement prohibits | Ask about the placement; preserve its URL and date |
A shared address and a shared network may describe the same household. Counting them as two independent proofs exaggerates the evidence. Likewise, code leakage does not by itself identify who leaked the code. Use the code-leak review process when distribution is the actual concern.
Calculate the amount under review
Keep the pending amount visible. Avoid describing the creator's entire sales total as suspicious when the concern involves specific orders.
The following hypothetical case assumes a flat 10% commission on merchandise value after discounts, excluding tax and shipping. There are no tier bonuses. Amounts use USD, and commission rounds to the nearest cent per order. These are example program terms, not Shopify defaults.
| Order | Merchandise base | Provisional commission | Finding | Commission decision |
|---|---|---|---|---|
| H101 | $80.00 | $8.00 | Household match; independent buyer verified and allowed by terms | Pay $8.00 |
| H102 | $120.00 | $12.00 | Creator confirms own purchase; terms exclude it | Exclude $12.00 |
| H103 | $60.00 | $6.00 | Payment review still open | Pending $6.00 |
| H104 | $90.00 | $9.00 | Full refund; terms exclude refunded sales | Exclude $9.00 |
For each order, provisional commission = merchandise base × 0.10, rounded to cents. The provisional total is $35.00. The decisions allocate $8.00 to payment, $21.00 to exclusions and $6.00 to pending review. They still sum to $35.00.
The refunded order needs no allegation of misconduct to explain its commission adjustment. For partial refunds and later changes, use commission reconciliation after returns.
Ask a narrow question and protect customer details
Modash's program-management article emphasizes accurate tracking, clear payments and ongoing communication. Apply that communication discipline when a payment question becomes uncomfortable.
Contact the creator privately. State the affected commission, the applicable rule, the question you need answered and a dated response window. Explain whether anything is temporarily pending and what happens next. Avoid language that assumes the outcome.
For H102, a hypothetical initial message could read:
We are reviewing $12.00 in commission associated with order reference H102. Our records suggest it may be a personal purchase. The program terms exclude personal purchases from commission. Can you confirm whether you placed it, or explain any approved test-order arrangement? Please reply by October 5, 2026. We will review your response before deciding eligibility. Unaffected commission remains on its normal schedule.
Send a creator-safe reference that does not grant order access. Do not include customer names, full addresses, payment details or unredacted checkout screenshots. Ask the payments team to contact a customer through its approved verification process when necessary. Do not ask the creator to investigate their audience.
The US FTC's business data-security guide recommends limiting sensitive information to a legitimate business need, restricting access and setting a retention policy. Keep detailed evidence in an access-controlled system. Set retention with your privacy or legal owner, including any requirement to preserve dispute records. These safeguards do not replace a jurisdiction-specific privacy review.
Close the case with a reason and a review path
Platform deadlines matter. Shopify Collabs tracks commissions through affiliate links and codes. Merchants can dispute suspicious commission during the holding period, discuss it with the creator, and resolve it by paying some, all or none of the pending commission. Canceled and fully refunded orders automatically lose their commission during that period.
Collabs also describes automatically opened high-risk-creator disputes with consequences if unresolved within 30 days. Check the case type and deadline. An internal appeal process must fit those limits; it cannot promise to override them.
Use these closing checks:
- Name the evidence and rule supporting each order-level decision.
- Record whether the concern was confirmed, cleared or remains unresolved.
- State the payment amount, adjustment and expected timing.
- Give a contact and deadline for submitting corrections or new evidence.
- Where possible, assign an appeal to someone other than the first reviewer.
- Correct the commission ledger and creator record if the decision changes.
Keep disclosure compliance separate. For endorsements affecting US consumers, FTC guidance calls for visible, understandable disclosure of material brand connections. A missing disclosure calls for its own correction process; it does not establish that an order was fabricated.
Before changing the next payout, open the case record and write the exact question the evidence leaves unanswered. Assign a reviewer and a decision date that fits the platform deadline.
