Referral fraud: how to detect and prevent referral abuse

Updated

Referral fraud is when someone collects referral rewards by inviting themselves, using a second browser, a private window or a fake email, or by running a ring of accounts that invite each other. Prevent it by recording the devices each user logs in from and comparing an invitee's device with the inviter's before you pay the reward: the same device or the same machine is strong evidence, a shared network alone is not.

Common types of referral fraud

  • Self-referral: the inviter opens their own link in a private window or another browser and signs up with a second email.
  • Account farms: one person creates many accounts on one device to collect the reward for each.
  • Referral rings: a small group of devices invite each other in turn.
  • Paid sign-ups: invites posted to coupon sites and completed by people who never use the product.

Signals that reveal a self-referral

Compare the invitee with the inviter, not with everyone. Useful signals, from strongest to weakest:

  • Same device: the invitee's visitor ID matches one the inviter logged in from.
  • Same browser profile: a shared first-party identifier survives even if the fingerprint changed.
  • Same machine: a different browser on the same computer, linked by hardware signals.
  • Same network: the same IP address or subnet. Weak on its own, because families, offices and mobile carriers share networks.

See which signals your own browser exposes →

Where to put the check

Bind each user to the devices they log in from, starting at sign-up. When an invitee completes the action that earns the reward, compare their device with the inviter's and decide before paying. Allow clear cases automatically, deny exact device matches, and send unclear cases to a review queue rather than rejecting a real friend.

Referral fraud prevention with FingerPrint Checker

FingerPrint Checker binds your user IDs to the devices they use (up to 20 devices per user, kept for 180 days, user IDs stored only as keyed hashes). The relation check returns sameDevice, sameBrowserProfile, sameMachine and sameNetwork for an invitee, plus a suggestion of allow, review or deny. Every account starts with 2,000 free checks.

Frequently asked questions

How do I detect self-referrals?

Compare the invitee's device with the devices the inviter has logged in from. A match on the same device or the same machine across two browsers is a self-referral in most cases.

Should I block referrals from the same IP address?

Not on that alone. People in the same household, office or mobile network share IP addresses. Treat a shared network as a reason to review, and a shared device as a reason to deny.

When should the referral reward be paid?

After the invitee has completed a meaningful action, such as a first payment, and after the device check. Paying on sign-up alone invites account farms.

Try FingerPrint Checker free

Every new account gets 2,000 free checks. No card required to start.

Create a free account