Referral fraud detection: separate self-referrals from genuine advocates

Referral fraud detection connects the referrer, invitee, qualifying action and reward. It looks for ineligible repeat claims and coordinated relationships before paying incentives. A prolific advocate is not automatically a referral farm, and two accounts using one device are not automatically one person.

Map the reward lifecycle

A referral program has at least two identities and often two benefits. Record which account sent the invitation, which account accepted it, the campaign version, the qualifying event and each reward’s state. Avoid collapsing the invite into the payout: a click is not a completed registration, and a registration is not always a qualified referral.

Define what self-referral means in your terms. It might prohibit an account inviting itself, one person controlling both accounts or a specific household relationship. Those rules require different evidence. Make the definition available before people participate rather than changing it during a dispute.

OWASP API6 includes a referral-credit scenario to illustrate sensitive business flows. The practical lesson is to protect the complete value-producing flow, including APIs called outside the visible registration interface.

Examine relationships, not just counts

A shared edge helps an investigator ask a better question. Several independent relationships and repeated ineligible behavior can strengthen a case. One edge alone should not silently override the campaign’s eligibility unit.

Check before each irreversible benefit

A two-sided program needs separate checks for the invitee benefit and referrer payout. Keep each reward pending until its stated conditions are met. If the terms include a cancellation window or completed service, preserve that state explicitly rather than treating a successful signup as final qualification.

Use a stable reward identifier and an authoritative ledger so the same qualifying event cannot issue the same benefit twice. Reconcile the outcome when downstream payment or service events change. These controls complement identity risk; they are not substitutes for knowing whether related accounts are allowed to participate.

Compare tools against the referral problem

ShieldLabs adds live device/network intelligence and ready-made multi-accounting context. Risk score and Trusted, Suspicious, Dangerous verdicts cover visitors, users, devices and IP. This is useful when invitees change exits or account details while connected activity persists.

Ravelin describes account graphs and referral circulation. SHIELD connects devices, users and referral-code relationships. Sift’s ecommerce guide explains an event and business-decision feedback workflow. Verify the exact relationship evidence and decision timing rather than comparing a generic “fraud score” label.

Preserve legitimate advocacy

A successful ambassador can produce an unusually large number of genuine invitees. Review whether the invitees meet the program terms, whether the qualifying events are genuine and whether a relationship is prohibited. A high referral count alone answers none of those questions.

Build an evaluation set from cases with independently established eligibility and ownership facts. Include shared homes, workplace devices, public networks and legitimate creator campaigns. Keep cases that cannot be resolved in a separate group. Do not label every declined referral as fraud and then use those labels to claim the detector was accurate.

Measure the actual reward outcome

Report attempted referrals, qualified referrals, rewards granted, confirmed ineligible rewards prevented and legitimate rewards incorrectly withheld. State the denominator for each rate. Track pending cases separately from decided cases and compare cohorts over an agreed observation period.

Do not call the entire face value of every held reward “savings.” Some holds will be released, some users would not qualify anyway, and review costs can exceed a small incentive. The cost and evaluation guide explains a usable economic comparison.

FAQ

Sources

Checked October 21, 2026: OWASP API6, ShieldLabs, Ravelin, SHIELD, Sift integration. Read the complete deployment guide for related controls.