Affiliate Fraud in iGaming: Catching Fake Depositors and Self-Referrals

You pay affiliates to bring you players. What you sometimes get instead are accounts engineered to look like players just long enough to trigger the payout, then vanish. The affiliate walks away with the acquisition fee and you are left with a dead account.

iGaming runs on affiliate marketing, and CPA (cost-per-acquisition) deals create an obvious incentive to manufacture qualifying players rather than find real ones. Understanding the fraud is the first step to protecting the marketing budget.

How iGaming affiliate fraud works

The common schemes all exploit the gap between “an account that qualifies for CPA” and “an actual customer”:

• Fake depositors. The affiliate opens accounts, deposits the exact minimum needed to trigger the CPA, and lets them die. If the CPA exceeds the deposit, the affiliate profits on the spread.
• Self-referrals. The affiliate refers themselves through cutouts — friends, family, or purchased identities — collecting acquisition fees on players they control.
• Incentivized traffic. Users are paid a small kickback to sign up and deposit, generating volume that qualifies for CPA but has no intent to play.
• Cookie stuffing and attribution theft. The affiliate claims credit for players who would have arrived organically, stealing attribution rather than manufacturing accounts.

The through-line is that the affiliate is optimizing for the payout trigger, not for a real customer relationship. So the accounts look qualified and behave nothing like players.

Signals that expose manufactured traffic

The tell of manufactured affiliate traffic is clustering — many “customers” that are really one operator:

• Device concentration. A stable visitorId that recurs across many “referred” accounts reveals that one person or small group is behind traffic billed as distinct users.
• Deposit pinned to threshold. Legitimate players deposit varied amounts; fraud rings deposit exactly enough to trigger CPA and no more.
• Near-zero engagement. Accounts that qualify and then never meaningfully play are the classic fake-depositor footprint.
• Registration bunching. Signups clustered tightly in time — right when an offer is live — from a narrow set of devices and networks.

Prynt gives you the persistent device identity to attribute traffic accurately, so an affiliate sending fifty accounts from three devices stops looking like fifty acquisitions. Feeding that linkage into your affiliate reconciliation turns CPA fraud from invisible to obvious.

The network dimension

Affiliate fraud at scale needs infrastructure — many accounts means many sessions someone would rather not have connected. Registrations arriving through datacenter IPs, residential proxies, or rotating VPN exits are common in manufactured traffic. Because a fraudulent affiliate frequently reuses the same infrastructure across the accounts they control, our reputation network surfaces devices and IPs already linked to multi-accounting on other sites, so suspicious affiliate traffic arrives pre-flagged rather than clean.

As always, connectivity alone is not proof — real players use VPNs too. But anonymized connections combined with device clustering and threshold-pinned deposits form a pattern honest acquisition does not.

Protecting the CPA budget

Affiliate fraud is a reconciliation problem as much as a detection one, so build the controls into how you pay:

1. Attribute by device, not just cookie. A persistent visitorId resists the cookie-clearing and re-attribution tricks that inflate affiliate counts.
2. Hold CPA against real activity. Delay or claw back payouts for accounts that qualify but never genuinely play.
3. Score affiliates, not just accounts. An affiliate whose traffic consistently clusters on shared devices and dies after qualifying is the unit to act on.
4. Tier your offers. Move proven affiliates to richer deals and keep unproven sources on revenue-share or delayed CPA.

Handled this way, you keep the affiliates who deliver players and starve the ones who deliver accounts.

Affiliate marketing is too valuable to abandon over fraud — but too expensive to run blind. Persistent device identity gives you honest attribution, so your acquisition budget buys customers instead of qualifying triggers. Explore the signals in our playground or see plans on our pricing page.