Affiliate fraud in a Shopify program: what it looks like and how to catch it

By the RecruitAffiliates.ai team · Published 26 October 2026 · Checked on 27 October 2026 · 10 min read

Facts about other tools come from their own sites, with the date we checked. Our editorial policy · About us.

Affiliate fraud is when someone is paid a commission for a sale they did not earn. The commission was meant for sending you a new buyer. In a small Shopify store the loss per order is small but easy to miss. A short monthly check finds self-referrals and leaked codes. A wait before you pay cuts the risk of paying on refunded orders.

An affiliate is anyone with an audience who sends you buyers and earns a commission, a cut of each sale. This guide names six kinds of fraud, shows what each looks like in your orders, and gives a monthly check that uses Shopify admin and your affiliate app. Not every odd order is fraud. Some are honest mistakes, so ask before you accuse.

Six kinds of affiliate fraud hit a Shopify store

Before the list, some terms. A cookie is a small file a site saves in a visitor's browser. It remembers which affiliate sent them. Cookie stuffing means setting that file without the visitor clicking a real link. Brand-term bidding means buying search ads on your own brand name. A chargeback is when a buyer's bank takes the money back. A return window is the number of days a buyer has to send something back.

Here is each kind, with the sign to look for.

Fraud is not a reason to avoid affiliates. A few clear rules and a short monthly check keep a program clean. Our guide on how to stop coupon sites joining your affiliate program covers coupon sites and leaked codes in more depth.

A monthly check catches most of it in six steps

You need your affiliate app's list of referred orders and your Shopify orders page. Here are six steps.

1. Export last month's referred orders from your affiliate app. You want the order number, the customer email and the affiliate.
2. Match emails. Search Shopify orders by customer email, or compare the two lists. An order where the customer email is the affiliate's email is a self-referral. Do the same for a shared shipping address.
3. Filter orders by fraud risk. Shopify's orders page has a "Fraud risk" filter (High, Medium, Low) (filtering orders, checked 27 October 2026). Shopify flags Medium and High risk orders with a warning symbol. Fraud recommendations are available on the Grow plan or higher, or when you use Shopify Payments (Shopify Help Center, fraud analysis, checked 27 October 2026). They cover only online card orders Shopify can verify, so test, free and point-of-sale orders get none. If you have neither, skip this step.
4. Filter by discount code. The same page filters by discount code. Open one code and look at how many orders it brought in, and when (Shopify Help Center, filtering orders, checked 27 October 2026).
5. Filter the discounts list by "Times used". Shopify lists this as a filter (Shopify Help Center, managing discount codes, checked 27 October 2026). A code used far more than its owner's reach explains may have leaked.
6. Look at refunds. Count how many referred orders were refunded or cancelled, and compare it with your store's normal rate.

The check suits a small program, up to a few dozen referred orders a month. Here is a worked example with made-up numbers, not real data. Let's say an affiliate brought 40 orders last month. Six used that affiliate's own email. Another five were rated High fraud risk and refunded. That is 11 of 40, or 28%. Write to the affiliate first, because the six may be an honest mistake, such as a gift order. Look at the order details of the other five.

What can't Shopify admin show?

Shopify admin can't show cookie stuffing, brand-term bidding or coupon grabbing. Here is what to do instead. These steps are our suggestions.

• Cookie stuffing: Ask the affiliate how they promote. Check whether your affiliate app records the page a click came from. Sales from an affiliate with no content or audience are a warning sign.
• Brand-term bidding: Search your own brand name in Google and look for ads that are not yours. Ban it in your terms.
• Coupon grabbing: In your affiliate app, look at referred orders from a deal or coupon site. A warning sign is a sale with their code from a buyer who never visited their page, or a click seconds before checkout. To confirm, place a test order with the site's browser extension on, or ask the buyer where they found the code. If it is a grab, point to your terms and ask the site to stop. Add a rule that pays no commission when a code is applied at checkout without a real visit. A code posted on a coupon page is a separate problem: search your brand plus "coupon" and "promo code", and ask the page to remove it.

What can your affiliate app block for you?

Several apps block self-referral. Two show a wait before commission is final, and some controls sit on higher plans. These facts come from each tool's own help pages, read on 27 October 2026. Shopify Collabs is Shopify's own affiliate app.

A match on email only catches a self-referral that uses the same address. Someone with a second email slips past it. So the monthly check above still matters, and so does the wait before you pay.

That wait is a holding period: the number of days before a commission becomes payable. Set yours to at least as long as your return window, and know that chargebacks can still arrive later. Our guide on what commission a Shopify affiliate program should pay shows where the hold fits in your offer.

What should you do when you find fraud?

Go up in steps. Keep a note of each.

1. Ask. Write to the affiliate with the order numbers. Some cases are mistakes, such as a gift order.
2. Withhold. Hold or reverse the commission on the orders in question, if your terms say you may.
3. Warn in writing. Quote the rule they broke.
4. Remove. Take them out of the program and cancel the unpaid commission.
5. Keep the record. Save the order numbers and your messages.

The rules must be in your terms before you use them. A short list is enough. No buying through your own link. No posting codes on coupon sites. No paid ads on the brand name. No fake or paid-for orders. The US Federal Trade Commission says your company is "ultimately responsible for what others do on your behalf", so it also pays to tell affiliates how to disclose and to check what they post (FTC Endorsement Guides Q&A, checked 27 October 2026). This is not legal advice.

How do you stop fraud before it starts?

Choose affiliates with care. Fraud is cheaper to prevent at the door than to chase later.

Check who they are. Before you approve someone, look at their page. A real audience, a real site and recent posts are the signs you want.

Start with a hold. A hold delays an honest affiliate's pay a little. Make it at least as long as your return window. It keeps you from paying on orders that come back. Chargebacks can arrive later still, so keep the right to reverse commission in your terms.

Start small. Give a new affiliate a code with a modest limit, then raise it once they show real sales.

Recruit from rivals' pages. People who already write about brands like yours are easier to judge. Our guide on finding affiliates for a Shopify store shows how. RecruitAffiliates.ai shows the page where it found each person, so you can read that page before you write. It looks up their email and shows whether each address was checked (what each result means). The 7-day free trial needs no card.

Frequently asked questions

What is affiliate fraud?

Paid commission on a sale the affiliate did not earn. The common cases are a self-referral and a leaked code. Written rules, a monthly check and a holding period guard against both.

How common is self-referral on Shopify?

No reliable public rate exists, because every store's affiliates differ. Measure your own. Once a month, count referred orders where the customer email matches the affiliate's, then divide by all referred orders. Anything above zero is worth a conversation.

Is a 30-day hold long enough?

Only if your return window is 30 days or less. Shopify Collabs holds commission for 30 days unless you change it, and Refersion waits 90. Set yours to at least your return window. That keeps most returned orders from becoming payable. A chargeback can still arrive later, often after the return window has closed.

Can I take back commission I already paid?

Maybe. It depends on your terms and your app. Refersion says approved sales can't be changed, so decide before you approve a sale. Put a clawback rule in your terms. A clawback is money you take back after you have paid it.

Should I remove an affiliate after one bad order?

Not always. Ask first. A gift order and a fake order look alike in the data. Remove someone who breaks a written rule after a warning.

Sources

• Shopify Help Center, fraud analysis, filtering orders, managing discount codes and Collabs payments
• UpPromote docs, exclude self-referrals and fraud protection
• Refersion help, conversion approval; FirstPromoter help, fraud and approvals; Tolt help, block same-email referrals
• US Federal Trade Commission, FTC's Endorsement Guides: What People Are Asking