Our First Affiliate Fraud Attempt Was Adorably Bad

There's a rite of passage for any affiliate program: the first time someone tries to cheat it. You brace for a sophisticated adversary, botnets, click farms, a hooded figure backlit by six monitors. What you usually get is a guy named (let's say) Greg, who tried to pay himself a commission for buying his own product, using the same browser, the same card, and an email that was his real email with a +1 stuck in the middle.

This is the story of Greg. It is not a cautionary tale of cybercrime. It is closer to watching someone try to shoplift a security camera.

The "scheme"

A customer of ours runs an affiliate program on Sled, 30% recurring commission, perfectly normal. Greg signed up as an affiliate. So far, an honest day.

Then Greg had An Idea. The Idea was this:

1. Grab his own affiliate link.
2. Click his own affiliate link.
3. Buy the product through his own link.
4. Collect 30% commission on his own purchase.
5. Retire.

In Greg's mind, this was a money printer: pay $19, get $5.70 back, repeat until wealthy. (We will gently note that "spend $19 to earn $5.70" is not, traditionally, how printers work. Greg was going to lose $13.30 every cycle on his way to the yacht.)

But the economics weren't even the problem. The execution was.

Why it fell apart in approximately one millisecond

Greg did all of this:

• On the same device that created the affiliate account.
• From the same IP address.
• With the same browser session that was, at that very moment, logged into the affiliate dashboard.
• Using a payment email of greg+1@gmail.com while his affiliate email was greg@gmail.com, i.e., he signed his own confession and notarized it.

This is self-referral, the most common and most easily caught flavor of affiliate fraud. The affiliate and the buyer are the same person, and they did almost nothing to hide it. It's the fraud equivalent of robbing a bank while wearing your work name tag.

The conversion got flagged before Greg finished his victory sip of coffee.

The genuinely useful part (sorry, Greg)

Underneath the comedy, Greg accidentally ran a free penetration test, and there are real lessons, the same ones that catch the fraudsters who aren't adorable:

• Self-referral is the #1 thing to detect first. Match affiliate identity against buyer identity: device, IP, email root (greg+1@ and greg@ are the same mailbox), payment fingerprint. Most fraud is this, dressed slightly better.
• Make it economically pointless. Greg's plan lost money because commission < price. If your commission ever exceeds the customer's first payment (aggressive bounties, high one-time payouts), you've built an actual money printer for the Gregs of the world. Structure payouts so self-buying is always a loss.
• Hold commissions through the refund window. The slightly-smarter Greg buys, collects commission, then refunds the purchase. Pay out after the refund window closes and that whole genre of fraud evaporates.
• A little friction at approval beats clawbacks later. Reversing a paid commission is awkward and sometimes impossible. Catching it before payout is free.

We wrote the grown-up version of all this (the fraud tactics that actually require effort to stop) in the 2026 affiliate fraud field guide. Greg is not in it. Greg did not make the cut.

In memoriam

Greg's account was suspended. The conversion was voided. The yacht remains unpurchased. We'd like to thank him for his service: he proved the fraud checks work, taught us nothing we didn't already guard against, and gave us this blog post.

If you're building an affiliate program, here's the takeaway with the jokes removed: the boring, common fraud (self-referral, refund-after-payout) is 90% of what you'll see, and it's all preventable with identity matching and a refund hold. The sophisticated stuff is real but rare. Build for Greg first.

For the full taxonomy of cheats (and the controls that block each one), read 10 Affiliate Fraud Tactics (And How to Block Them).

Sled has self-referral detection and refund-window holds baked in, so your Gregs get caught before payout, not clawed back after. Flat $19/mo at usesled.com.