How to Stop Affiliate Self-Referral Fraud on Shopify

You cannot detect your way out of this one.

Every other guide on self-referral starts with detection, and most of them open with a signal our data on Shopify programs says is meaningless.

Detection is the second step anyway.

The first step is to decide where your line sits, because self-referral is not a single behaviour and the blunt rules merchants reach for catch their best customers along with the people they were aimed at.

Skip the policy step and you end up in one of two places.

• Either you fund a permanent discount for someone who would never have promoted you,
• Or you close the account of a genuine advocate who bought their mother a birthday present with their own code.

So this article does the policy first, the signals second, and the automatic block third, in that order.

If you have not written your program terms yet, the decisions underneath them are in our guide to affiliate program settings, and self-referral is the policy most terms leave out entirely.

1. What is self-referral

Self-referral is when an affiliate puts their own link or code on an order they placed themselves, and so earns commission on a sale they never actually referred.

Personally, I think of self-referral as a spectrum rather than a single behaviour, and the difficulty sits in the middle, where two orders can look identical while only one of them deserves a commission.

Here are some examples of what is generally considered self-referral:

1. The affiliate buys for themselves with their own referral link: most programs ban this, and it is the case the definition above describes, where the order was always going to happen and the commission buys you nothing.
2. The affiliate buys a gift for a parent with their own code: this is harder to call, because the order goes to a different address and a different person, and yet the affiliate still gains from it.
3. The affiliate's partner orders from the same house, on the same network, with their own card: the hardest one on the list, because every signal available to you says this is case one, and yet the order is entirely above board, with nothing in the data to tell the two apart.
4. The affiliate tells fifty friends and relatives to use their code: this is the program working exactly as designed, and it is what you recruited them for.
5. The affiliate opens accounts to buy at a discount and resell: this is unambiguous fraud, and the only case on this list where the word fraud does honest work.

Block hard enough to catch case one and you will catch case three, and sometimes case four.

Your best affiliates are very often already your customers, which means a blunt rule is aimed squarely at the people with the most reason to promote you.

But that doesn't mean this isn't still a real issue to solve.

I have seen merchants call out self-referral issues on our support chat.

Especially self-referral fraud where an affiliate buys a product using their own referral link so they get the product and earn a commission from bringing in no new customer.

Now, we do have a solution for this on Affilitrak and I'll guide you on exactly how to use it.

But before that, I'd like you to better understand what self-referrals actually cost you as a merchant.

2. What it costs you

• The direct cost: commission paid on an order with zero acquisition value. You gave away margin and you gained nothing, because the customer was already yours.
• The compounding cost: an affiliate who self-refers once has found a personal discount that never expires, so the single order quietly becomes a monthly one, and because that affiliate is a real customer with real repeat intent, the person who costs you the most margin is often one of your best ones.

Now that you understand what self-referrals cost your business, you'll need to define the exact policy that clarifies what self-referral is for your program.

3. Decide the policy before you go looking for offenders

Four decisions. Each one is a line you can paste into your terms today.

1. Self-purchase: allowed or not?

I would ban it unless you have a specific reason not to, and this is the wording I would use, because affiliates understand it and do not resent it:

You may not use your own affiliate link or code on your own orders. If you want to buy from us, use the standard customer discount available to everyone.

Give affiliates a small standing customer discount as well, because that is what makes the rule stick: it removes the incentive instead of merely banning the behaviour.

2. The household rule: how far does "your own orders" reach?

This is the decision merchants skip, and it is the one that produces the unfair outcome later. Pick one and write it down:

Orders placed by members of your household are not eligible for commission.

Or, the version I would pick for most programs:

Orders placed by other people are eligible for commission, including people you know, as long as the order is theirs and paid for by them.

The second is more generous, and it is also the only one you can enforce consistently, because you cannot distinguish a partner's own order from a disguised self-purchase, and you should not pretend otherwise.

3. Void, or claw back?

It is easy to void an unpaid commission, but to recover one you have already paid takes a conversation nobody enjoys, so say which you will do:

Commission on ineligible orders will be removed before payout. Where a payment has already been made, the amount will be deducted from your next payout.

Section 5 has the setting that keeps you on the easy side of this line.

4. Is a first offence forgiven?

Decide now, in writing, because if you decide in the moment you will make an example of someone:

The first ineligible order will be removed and we will let you know why. Repeated ineligible orders will close your account.

Most first offences are ignorance rather than intent, and a program that bans on first contact loses someone who might have become a genuine affiliate.

These four lines belong alongside the other decisions you make at setup, next to your approval bar and your payout rules.

4. How to detect self-referral

A fast purchase is not evidence of anything.

Nearly every article on this topic lists "customer bought within minutes of clicking" as a red flag.

Across Shopify stores in our data, the median time from an affiliate click to the resulting order is about nine and a half minutes, and the distribution is bimodal: a large group buys almost immediately, and a much smaller group takes days.

A purchase within minutes is not suspicious behaviour, it is the most common behaviour there is.

So if you flag on speed you will flag your best affiliates, which is precisely backwards, and I would leave speed out of your checks altogether.

The easiest way to detect a self-referral is to check if the customer's email matches the affiliate's email.

Every time a user has reached out to me about a self-referral, it's never been about noticing a fast purchase.

It was always when they noticed the customer and affiliate emails matched, which is as close to proof of a self-referral as you will get.

The signals that do hold up, in order of how much weight to give them:

1. The customer's email matches the affiliate's registered email: the strongest signal available, and the only one clear enough to act on automatically, which is what section 5 covers.
2. The billing details match the affiliate's registered details: name, billing address, or card ending. Check these by hand against the orders credited to that affiliate, and weigh them far above shipping address, since gifts ship anywhere.
3. The same customer appears again and again under one affiliate: one affiliate, one customer, repeated orders over months is a personal discount arrangement rather than a referral channel. This is the pattern that catches the compounding case in section 2, and it is invisible to any single-order check.
4. Code redemptions with no matching click traffic: if orders carry an affiliate's code but their link has almost no click history, then nobody promotes that code anywhere, and someone who already has it simply types it in.

Treat one signal as a question and two as an answer.

None of these on its own proves intent, and if you get it wrong you lose an advocate.

5. How to block self-referral automatically

The signals above are checks you run. The first one you can stop at the door.

Automatic self-referral prevention

Affilitrak's self-referral prevention compares the customer's email on the order against the email registered to the affiliate whose link or code was used.

When they match, the order is not credited.

It takes one toggle to turn on, under Settings → Extra features → Prevent self-referrals, and it costs you nothing in false positives, because an exact email match between the referrer and the buyer is not a coincidence that occurs in normal trading.

It also runs at the point of attribution rather than at payout, so a blocked order never becomes a pending commission at all.

Hold the commission while you look

The email check settles case one, but it cannot read intent, so cases two, three and four from section 1 stay policy questions.

What you can do is stop them becoming irreversible while you answer them.

Affilitrak lets you decide when a commission is approved rather than leaving every one of them to approve itself. You can:

• Approve each commission by hand
• Set them to approve automatically after a number of days you choose

I haven't received a question regarding this from our merchants but I believe the second option is the one most merchants would want, because manual approval on every order becomes a job, while a delay costs nothing and runs by itself.

This is what decision three in your terms rests on.

• A commission still held is one you simply do not approve, and nobody has to be told anything.
• A commission already paid has to be chased, and you may not get it back.

It is also the practical answer when you suspect one specific affiliate.

Switch approval to manual, or lengthen the delay, and then open that affiliate's profile and look at their orders against the four signals above before anything is approved.

Set the delay to your returns window rather than a round number, so a commission is never approved on an order that can still come back.

Run the manual checks from section 4 as a monthly review of your top affiliates rather than a per-order habit, and you will catch the patterns that no single-order rule can see.

6. What to do when you catch one

Assume ignorance first, because most of the time you will be right.

A large share of self-referral is someone who joined a program, was told they earn commission on orders through their link, and never thought of their own order as a special case. Nobody told them otherwise, and if your terms did not say it plainly, then nobody really did.

Send this before you send anything else:

Hi [name],

A quick note about order [number]. Our program terms do not allow commission on your own orders, so I have removed the commission on that one.

This is not a problem and nothing has changed with your account. I should have made it clearer when you joined.

If you want to order from us yourself, use [customer discount code] instead, which is the standard discount and better than the commission would have been anyway.

[Your name]

Three things that message does:

• It removes the accusation: you corrected an order, not a person.
• It gives them somewhere to go: a standing customer discount redirects the incentive instead of merely banning it.
• It takes some of the blame: if your terms were vague, then to say so costs you nothing and keeps an advocate.

Escalate only when it repeats after that message, and when it does, apply exactly what decision four in your terms says, which is why you wrote it down in advance.

The related but separate problem is a code that has escaped into the wild, so that strangers use it rather than the affiliate.

That is a different failure with a different fix, and we covered it in how to stop affiliate coupon code leaks.

Conclusion

Do these in order.

1. Draw the line: decide where on the five-case spectrum your program stops paying, and accept that cases two and three are judgement calls rather than detection problems.
2. Write the four lines into your terms: do it before you look for anyone, so that you apply a policy rather than improvise a decision.
3. Give affiliates a customer discount of their own: this removes more self-referral than any rule.
4. Turn on the email-match block: the clear-cut case then never becomes a commission you have to claw back.
5. Set commissions to approve on a delay: match it to your returns window, so nothing locks in before you can look at it, and switch to manual approval on any affiliate you have started to doubt.
6. Review your top affiliates monthly: look for the repeat-customer and no-click-traffic patterns, because no per-order check will surface them.
7. Assume ignorance on first contact: escalate only on repetition.

And stop treating speed as a signal.

The affiliate whose referrals buy within ten minutes has not gamed you, they have done the job better than the rest of your program.

You can install Affilitrak free and set the self-referral rule before your first commission is due.