How fraud is handled without punishing everyone
Referral fraud is real, mostly small, and much less expensive than the standard response to it. The interesting design question is not how to catch more of it; it is how to catch it without making honest referrers feel accused.
Key takeaways
- Three patterns are worth catching: self-referral rings, bulk signups, and stolen codes.
- A false positive costs a referrer permanently. Weight it accordingly.
- A hold is always shown to the person, with the reason, and with a way to respond.
- Never suspend an account on an automated signal alone.
- Track the false-positive rate as a headline number, not the catch rate.
What is worth catching
| Pattern | What it looks like | Worth catching? |
|---|---|---|
| Self-referral | Same person, second account | Yes — caught at recording |
| Referral ring | A small group referring each other in a loop | Yes — clear and rare |
| Bulk fake signups | 40 referrals in an hour, no orders | Yes — and obvious |
| Stolen or scraped codes | One code used from many countries at once | Yes |
| Incentivised sharing | Posting the link on a deals forum | Usually not fraud |
| Referring family | Same surname, same address | Almost never fraud |
The bottom two rows are where programmes go wrong. Same-address referrals are overwhelmingly people recommending things to the people they live with, which is the most natural referral there is, and a rule that blocks them is blocking the intended behaviour of the programme.
The asymmetry
The reason the aggressive setting keeps getting chosen is that the red bar is measured and the orange one is not. Fraud paid out appears in a report; referrers who quietly stopped referring after being told their referral was under review do not appear anywhere at all.
Making the orange bar visible requires only counting held referrals that were later released, and tracking whether those people ever referred again. It is a small piece of instrumentation that changes which setting people choose.
A hold is a conversation
- App integration
- Machine learning
- Management
- People
Say what triggered it
“Your referral is under review” is the message that makes people angry, because it reads as an accusation with no content. “We hold referrals when several accounts sign up from one address in a short period — this happens legitimately with families and shared houses, and a person will look at it this week” is the same hold and a completely different experience.
The second version is longer, it is a template, and writing it once removes most of the support load that fraud holds generate.
Five working days, and it means it
A review queue with no service level becomes a place referrals go to be forgotten, which is functionally identical to not paying. The deadline needs to be stated to the referrer and monitored, and a queue older than the deadline should be an alert somebody sees.
The rules that quietly kill a programme
Four prudent-sounding rules to avoid
- “Hold anything from a shared IP address.” That is every office, every student house, and most mobile networks.
- “Hold same-surname referrals.” Recommending something to your family is the programme working.
- “Suspend the code after any signal.” The referrer finds out when their next recommendation silently fails to register.
- “Require the referred customer to confirm.” Adds friction to the one moment the programme depends on, to prevent a rare problem.
- Each of these gets proposed after a single incident, and each costs more every quarter than the incident cost once.
The pattern is that fraud incidents are memorable and specific, while the cost of over-blocking is diffuse and invisible. Writing the four rules down as known bad ideas, before the incident happens, is a cheap way of having the argument in advance.
Next: what happens when somebody disagrees.
All posts