← All docs

Fraud protection

Affiliate programs attract a few kinds of abuse: affiliates buying through their own link to earn commission on their own orders, orders paid with stolen cards that come back as chargebacks, and discount codes that leak to coupon sites. Sprout Affiliate has a rule for each. They are in the app under Settings > Fraud detection, and they are on every plan, Free included.

This page describes each rule: what it checks, when it flags an order, what you see, and how it is set when you install.

Every rule flags, nothing is rejected for you

Every order rule on this page works the same way. When an order matches, Sprout Affiliate flags it for you to decide. A flagged order is never approved automatically, even when auto-approve is on. It is never rejected for you either. You open it and choose Approve or Reject.

The reason is shown as a badge next to the order on the Referral orders page and the Payouts page, and in the merchant phone app. If an order matches more than one rule, the badge shows the first that applies, in this order: test, canceled or unpaid, then self-referral, then Shopify risk, then an order burst, then a new affiliate's first orders.

A flagged order waits in its own Flagged orders section at the top of the Payouts page, and under a Flagged tab on that affiliate's own payout page. Both appear only while something is flagged. Each order there is listed on its own with its own Approve and Reject. Approve all, and the Approve button beside an affiliate in Pending, never include a flagged order, so every one is decided by itself.

The order's own page has a Fraud checks card with a row for every rule you have on, each showing what that rule found for this order. The rules run while an order waits for approval. They are not run again on an order that has been paid.

No usage fee is charged on an order while it is flagged. The fee is billed when an order is approved, and never on an order you reject.

Self-referral by name

Switch: Flag orders where the buyer's name matches the affiliate.

Sprout Affiliate compares the customer's name on the Shopify order with the affiliate's name. It compares the whole name and ignores upper and lower case, so "Jane Smith" matches "jane smith". It does not match "Jane A. Smith" or "J. Smith". A match holds the order with the reason Possible self-referral.

The name comes from Shopify, through the Customers permission you approve at install. If an order has no customer name, nothing is compared and the order is not held by this rule.

On the order's Fraud checks card this rule shows whether the names match, differ, or the customer's name is not available.

Default: on for new stores.

Self-referral by IP address

Switch: Flag orders placed from the affiliate's own IP address.

An IP address is the address a device's internet connection is identified by. Sprout Affiliate records the address each affiliate applied from. It compares that address with two others:

• the address of the referral link visit that led to the order, and
• the address of the browser the buyer checked out from, which Shopify records on the order.

Because the second comparison uses the order itself, it covers orders placed with the affiliate's discount code as well as orders that came through their link. A match holds the order with the reason Possible self-referral (same address).

An unknown address is never treated as a match. An affiliate with no signup address on file is never matched: for example one who joined before Sprout Affiliate recorded addresses, or one you added or imported yourself. The same goes for a visit or an order with no address. Shopify gives the app the checkout address together with the customer's name, so if Shopify withholds customer details, only the link visit is compared.

People in one household, office, or public Wi-Fi network can share an address, and so can customers of some mobile networks. That is why this rule holds rather than rejects. Look at the order before you decide. It also works the other way: an affiliate who orders over mobile data instead of their home connection will not match.

Sprout Affiliate does not show IP addresses anywhere in the app. It uses them only for these checks. The privacy policy says how long they are kept.

Default: on for new stores.

The warning tag in Shopify

Referred orders already get a tag in your Shopify admin: Sprout_order by default, plus the affiliate's name. You can change both in Settings > Links, in the Order tags card.

When an order matches either self-referral rule, Sprout Affiliate also adds the tag Sprout_possible_self_referral. It is added when the order is placed, whatever your other tag settings say, so you can see the warning in Shopify's order list and review the order before you ship it. Filter your Shopify orders by that tag to find them.

Three limits. The tag is only added when the order arrives already credited to an affiliate, so an order credited later, through the Web Pixel's report, does not get it. If the check cannot run at that moment, no tag is added, but Sprout Affiliate still holds the order when it next reads your orders. And the tag is never removed: it stays on the order after you approve it.

The other rules on this page do not add a tag. Shopify already shows its own risk rating and any chargeback on the order in your Shopify admin.

Orders Shopify rates as risky

Switch: Flag orders Shopify rates medium or high risk.

Shopify runs its own fraud analysis on many orders, and shows the result on the order in your Shopify admin. With this switch on, an order Shopify rates medium or high risk is flagged with the reason Shopify rates this order medium risk or Shopify rates this order high risk. A low-risk order is not flagged.

Shopify does not analyse every order. It mainly analyses orders paid through Shopify Payments. An order with no analysis is not flagged by this rule.

Sprout Affiliate only flags the commission. What to do about the order itself, including cancelling it if Shopify recommends that, is up to you in Shopify.

Default: on for new stores.

Chargebacks

There is no switch for chargebacks. A chargeback is a refund, so Sprout Affiliate always treats it as one, on every store and every plan.

A chargeback is when a buyer's bank reverses a card payment. The money leaves your account as soon as the chargeback is opened, so:

• While it is open, and if you lose it or accept it, the order counts as fully refunded. If the commission has not been paid yet, it drops to $0. If it has been paid, Sprout Affiliate raises a clawback: a row named "order name chargeback" with a negative commission. Once approved, it comes off that affiliate's next payout, the same way a refund does. See Refunds and clawbacks. The usage fee on that sale is credited back, as it is for a refund.
• If you win it, the commission comes back. An order that has not been paid earns its commission again and goes through your normal approval settings. If the clawback was already taken from a payout, a row named "order name chargeback won" gives the commission back on the affiliate's next payout. If the clawback had not been paid out yet, it simply goes away.

A chargeback does not flag the order, because there is nothing to decide: the commission follows the money. The order's page shows where the chargeback stands in its Fraud checks card.

A bank inquiry, a question from the bank that comes before a chargeback, changes nothing until it becomes a chargeback.

Sprout Affiliate reads the chargebacks Shopify records on the order, which means chargebacks on orders paid through Shopify Payments. A chargeback handled only by another payment provider is not seen. For those, refund the order in Shopify or reject the referral to take the commission back.

Shopify lets apps read an order for 60 days after it is placed, so a chargeback opened or decided after that is not seen. If you win one after that, you can give the commission back with Give a bonus on the affiliate's page.

A new affiliate's first orders

Number field: Orders to review manually for each new affiliate. It takes 0 to 100. 0 is off, and that is the default.

Set it to 3, for example, and each affiliate's first 3 referral orders wait for you with the reason One of this affiliate's first orders, even with auto-approve on. After that, their orders follow your normal approval settings. It is a way to look at a new affiliate's first sales before you trust them.

Order bursts

Number field: Flag an affiliate's orders beyond this many in 24 hours. It takes 0 to 1000. 0 is off, and that is the default.

Sprout Affiliate counts each affiliate's referral orders over any 24 hours. Orders up to your number go through as normal. Orders beyond it are flagged with the reason Many orders from this affiliate in 24 hours. A sudden flood of orders from one affiliate is a common sign of card testing or fake orders.

Set it above what your busiest honest affiliate brings in on a good day, so a real launch or a sale does not park every order.

Repeat orders from one IP address

Switch: Flag when one IP address places more than one order through the same affiliate, in the same card. It is off by default.

Shopify records the IP address of the browser each order is placed from. With the switch on, when one IP address places more than one order through the same affiliate, the first goes through as normal and every order after it is flagged with the reason Repeat order from one IP address. Orders from the last 180 days count, the ones already paid included. An order with no recorded IP address is never flagged by this rule. A household or an office shares one address, so a flag here is a reason to look, not proof.

Waiting before automatic approval

Field: Days to wait before approving orders automatically, in Settings > General, in the Affiliate approvals card. It takes 0 to 365, and the default is 0.

When automatic approval is on, each referral order waits that many days after it was placed before it is approved. Until then it shows Approves automatically on YYYY-MM-DD, a date in your store's timezone. Refunds and chargebacks that arrive in that time are applied before any commission is owed, so you are not paying out and then taking it back.

The wait applies wherever automatic approval is on: the store switch, or a program or an affiliate set to approve automatically. With automatic approval off you approve every order yourself, and the wait does nothing. Your own Approve click never waits, so you can let one order through early. The usage fee is billed when the order is approved, so it waits too.

IP address rules for applications

The second card on Settings > Fraud detection, IP address rules, is about affiliate applications rather than orders. Sprout Affiliate records the IP address each application is submitted from.

Affiliate accounts allowed per IP address takes 0 to 100. 0 is off, and that is the default. When an application would go over the limit for its address, it is held for you instead of being approved automatically. It is never rejected. The reason is written into your private note on that affiliate, for example: "Sprout Affiliate held this application for review: 3 affiliate accounts share the address it came from, and the limit on Settings > Fraud detection is 2." This applies to customer referral programs too, which otherwise approve everyone at once. Affiliates with no recorded address are not counted.

Blocked IP addresses takes up to 200 addresses, one per line. Each must be a single IPv4 or IPv6 address; ranges and host names are refused when you save. A blocked address:

• cannot apply. The applicant sees "We can't accept this application." and is not told why.
• earns no referral through the Web Pixel. When a checkout from a blocked address reports a referral, it is not recorded.

One limit: an order credited through a discount code, or through the referral saved on the cart, is still credited, because that route does not check the blocklist. The self-referral rules and your own review cover those orders.

Signup rules

The third card on Settings > Fraud detection, Signup rules, is also about applications. It has one Save button for everything in it.

Blocked email addresses takes up to 500 entries, one per line. An entry is a whole address, such as name@example.com, or a whole domain written with an @ in front, such as @example.com, which also covers its subdomains. Anything else is refused when you save. An application from a blocked address is refused with "We can't accept this application." and nothing is saved. An affiliate already signed in at another Sprout Affiliate store who tries to join with a blocked address is refused the same way.

Detect spam signups is on for every store. A signup counts as spam when:

• a bot filled in a field people can't see,
• the form was sent within seconds of opening, or without opening the signup form at all,
• it used a throwaway email address from a known service such as Mailinator or 10 Minute Mail, or
• a link was typed as the name.

Under the switch, What happens to a spam signup is one of two choices:

• Hold it for review, the default. The application is saved and is never approved automatically, even with auto-approve on. In your list of pending applications it carries a Looks like spam badge that says why, and the reason is written into your private note on the affiliate.
• Refuse it. Nothing is saved. The applicant sees "We can't accept this application."

Email me about spam signups is off by default. With it on, each spam signup sends your notification email address a message saying who applied, to which program, why it looks like spam, and whether it was held or refused. Nothing is capped. The first one is emailed right away, and any more in the next 15 minutes arrive together in one report that lists every signup, so a flood of bots is one email, not hundreds. An affiliate who joins with one click from another Sprout Affiliate store is signed in already, so the spam rule never asks about them.

Countries accepted and Countries excluded decide where applications are taken from. With nothing picked, every country is accepted. Pick countries to accept, and only applications from those countries are taken; a country you exclude is refused whatever else is accepted. The country is the one the applicant's IP address is registered in, read on Sprout Affiliate's own server, so the address is never sent anywhere. An address that can't be placed in a country is let through. A refused applicant sees "We can't accept this application." Someone connecting through a VPN appears to be wherever the VPN is.

Bot check on signup

A Cloudflare Turnstile check on your affiliate signup pages, with your own Cloudflare keys. Turnstile is free and sets no tracking cookies. It is on every plan, Free included, and it is off by default. It is set up at Settings > Integrations > Signup protection > Cloudflare Turnstile, on the web.

1. In your Cloudflare dashboard, open Turnstile and add a widget. Add each hostname your signup pages are on: app.sproutaffiliate.com, your store's own domain (for the signup page on your store and the signup form you put on a page you built), and your own affiliate domain if you set one up under URL Branding.
2. Copy the widget's Site key and Secret key.
3. In Sprout Affiliate, press Set up beside Cloudflare Turnstile, turn on Check affiliate signups for bots, paste both keys, and press Save.

The secret key is checked with Cloudflare when you save it. One Cloudflare does not recognize is refused. It is stored encrypted and never shown again; the box stays blank, and leaving it blank keeps the saved key. The secret box has an eye to show what you typed.

With the check on, the widget appears above the signup button on every signup page: the signup link, the signup page on your store, and the signup form on a page you built. An application whose check fails, or that arrives without one, is refused with "The security check didn't pass. Complete it above the button and try again." in the applicant's language, and nothing is saved. An affiliate who joins with one click from another Sprout Affiliate store is signed in already and is not asked.

Send code is checked too. Where your signup page texts a code to confirm a phone number, Send code waits for the check above the button, and no code is texted to a number until the check passes, so a script cannot run up texts to numbers it does not own. The widget then gets a fresh check for the application itself. If Cloudflare cannot be reached, the code is sent anyway, as the signup is let through.

When most checks fail. If at least 5 checks in the last 24 hours failed and they are more than 80% of that day's checks, the Cloudflare Turnstile row shows Needs attention with how many failed. That is what a wrong site key, or a hostname missing from the widget in Cloudflare, looks like, since then nobody passes. It clears as soon as somebody passes the check, and saving a different key starts the count again.

When the check cannot run, the signup goes through. If Cloudflare does not answer, or Cloudflare refuses your secret key, or the saved key cannot be read, the application is let through unchecked rather than refused, so a Cloudflare outage never closes your program to new affiliates. Your other signup rules still apply to it, and it still waits for your approval unless you approve automatically. Each one is logged, and the Cloudflare Turnstile row shows Needs attention, when it happened, and how many signups went through unchecked, until Cloudflare next answers a check. Only applications that were saved are counted; one another signup rule refused is not. The row shows it only while the check is on.

The marketplace signup belongs to no store, so it uses Sprout Affiliate's own Turnstile keys, when they are set, the same way.

Anti-leak discount protection

Switch: Anti-leak discount protection, in the same card as the order rules. It is on every plan, Free included, and it is off by default.

With it on, a discount code alone earns nothing. The buyer must also have arrived through an affiliate's link. If the click names a different affiliate from the code, that affiliate is credited. If there is no click at all, nobody is paid and the order does not appear in Referral orders. This is what stops a code posted to a coupon site from paying commission on sales the affiliate did not send. Expect fewer credited orders once you turn it on. How anti-leak affects tracking.

It matters most for programs whose discount is auto-applied from the affiliate's link. There the code shows in the link itself, so it is easy to copy to a coupon site, and anti-leak costs those affiliates almost nothing, because their real customers all click. While the switch is off, the Coupon codes section of such a program says so, with a link to the switch. The switch covers the whole store, so with it on, affiliates in "Discount code" programs are no longer paid for a code a customer typed without clicking, such as one read out in a video.

Protections that are always on

These need no setting:

• Unsettled orders are never approved for you. Test orders, canceled orders, and orders whose payment has not gone through (pending, voided, or expired) wait in Pending with the reason Test order, Order canceled, or Payment pending and the like. You can still approve one by hand.
• Refunds reduce or take back commission. An unpaid order's commission follows the refund down, to $0 for a full refund. If the commission was already paid, a clawback comes off the affiliate's next payout. See Refunds and clawbacks.
• Applications wait for you. "Auto-approve new affiliates" in Settings > General is off by default, so every application needs your approval.
• Visits a script makes are not counted. A person who clicks an affiliate link starts one visit. When one internet address has started 6 visits at your store within 10 minutes, or 20 in a day, Sprout Affiliate stops recording new visits from it for as long as it keeps trying. A bot loading a link over and over cannot inflate an affiliate's clicks or your conversion rates. An order from that address still earns commission. See What counts as one click.
• You can pull any order back. Move back to pending on an approved order keeps it pending, whatever your auto-approve settings say.

What Sprout Affiliate does not do

• It never rejects or cancels an order on its own. Every rule flags the order for you to decide.
• It does not touch the Shopify order. It does not cancel, refund, or stop fulfilment of the order. Whether to ship is your decision. The warning tag and Shopify's own risk rating are there to help you make it.
• It does not stop anyone buying. An affiliate's discount code keeps working at checkout, and a blocked IP address can still place orders.
• It does not match buyers by email address. Reading a buyer's email address needs Shopify's Protected Customer Data access for email, which Sprout Affiliate does not request.
• It cannot catch everything. An affiliate who uses a different name and a different internet connection passes both self-referral rules. The wait before approval, the review of new affiliates' first orders, and chargebacks counting as refunds are there for what gets through.

A stricter setup

If your store has had trouble with fake orders or chargebacks before, this is a reasonable place to start:

1. Keep both self-referral switches and the Shopify risk switch on.
2. Set Orders to review manually for each new affiliate to a small number, such as 3.
3. Set Flag an affiliate's orders beyond this many in 24 hours a little above what your busiest affiliate normally sells in a day.
4. Set Days to wait before approving orders automatically to at least your return window.
5. Turn on Anti-leak discount protection if your codes have turned up on coupon sites.
6. Leave Auto-approve new affiliates off, or set Affiliate accounts allowed per IP address to 1 or 2.
7. Keep Detect spam signups on, and turn on Flag when one IP address places more than one order through the same affiliate.
8. Before you ship, check your Shopify orders for the Sprout_possible_self_referral tag.

On the phone

The merchant side of the phone app (free on every plan) has four of these switches under Settings, Fraud protection: self-referral by name, self-referral by IP address, anti-leak, and repeat orders from one IP address. Everything else on this page is set on the web only: the Shopify risk switch, the two number fields, the wait before automatic approval, the IP address rules, and the signup rules. A flagged order shows its reason in the phone's order list, and you can approve or reject it there.