Subnetwork affiliate fraud: the publisher you approved isn’t the one sending the traffic

Affiliate fraud happens at two levels. There’s the obvious kind — the partner whose numbers are so implausible that anyone looking at the report for five minutes can see something is wrong. And there’s the kind that survives inspection: it passes the eye test, the website looks legitimate, the numbers look reasonable, and it keeps collecting commission for years.

Subnetworks are the second kind — and the hardest affiliate fraud to detect from standard network reporting.

What a subnetwork is in affiliate marketing

A subnetwork is a network inside your network. Rather than one publisher with one website, it’s an aggregator with many publishers underneath it — sometimes dozens, sometimes thousands — all promoting your brand across different sites, all reporting through a single publisher ID in your affiliate programme.

That single ID is the problem. You see one line on your report. Behind it there might be a hundred sources you’ve never seen.

Why subnetwork fraud passes inspection

Here’s how it usually goes. You’re reviewing the publisher list, you see a name driving decent volume, you click through to their website. It’s a real site. Clean design, plausible content, nothing alarming. You think: fine, that’s a decent publisher, and you move on.

But the website you just checked may be responsible for almost none of the traffic. The rest is coming from sites you never looked at — because you were never shown them. Some of it might be in verticals you’d never have approved: gambling, adult, cashback stacking, brands you’re deliberately not associated with. Some of it might be outright fraudulent — cookie stuffing, brand bidding on your own name, coupon extension activity of the kind that only fires at checkout.

You approved a website. You didn’t approve the hundred behind it.

Why standard affiliate reports never show this

Network reporting is built around the publisher ID. Clicks, conversions, and commission all aggregate to that one row, and that’s where the reporting stops. There is no column for which of this partner’s sources actually drove the sale.

So the aggregate looks healthy. Conversion rate sits in a normal range, because genuine traffic and fraudulent traffic average out into something unremarkable. The exact patterns that expose a single bad publisher — implausibly high conversion, implausibly low conversion — get smoothed away by volume. That’s what makes subnetworks harder to catch than any individual fraudster: the averaging hides them.

Transparency is the dividing line

Not all subnetworks are a problem. Plenty of them are legitimate businesses doing real work, and the good ones share one characteristic: they will tell you where the traffic comes from. Ask for a source-level breakdown and you get one — URLs, sites, placements, per-source performance.

The opaque ones won’t. And in my experience the correlation is close to absolute: the subnetworks that resist showing you their sources are the ones with the most to hide. Opacity isn’t a reporting limitation. It’s the product.

So the single most useful thing you can do with any subnetwork in your programme is ask for the URLs actually driving your traffic — and treat the quality of the answer as data in itself.

Signs of subnetwork fraud in your programme

A few signals, in rough order of how worried to be:

• Click volume inflates out of nowhere. No campaign, no seasonal reason, no new placement — just a step change in traffic from one partner.

• You can’t explain how they’re making sales. You look at their site, you look at the numbers, and there’s no mechanism that connects the two.

• They don’t reply. A legitimate partner driving real revenue for you answers emails about that revenue.

• They reply, but can’t produce stats. Vague answers, general descriptions of their “network,” nothing you can check.

• They send screenshots instead of reports. Screenshots of placements, dashboards, or sites — images rather than exportable data. Images are easy to fabricate and impossible to audit.

• They can’t tell you which publishers are driving your traffic. This is the one that matters most. If a partner genuinely cannot produce a source-level report on their own activity, either they don’t control what’s happening underneath them, or they don’t want you to see it. Both are reasons to remove them.

How to detect and deal with subnetwork fraud

For a small programme, this is a person’s job: someone reviewing the publisher list properly, asking for source-level data, and being willing to remove partners who look productive on the report. It isn’t complicated work. It’s just work that nobody does, because everything appears to be fine.

For medium and large programmes, manual review stops being enough — there are too many partners and too much volume to read line by line. That’s where third-party affiliate monitoring tools earn their cost: they surface source URLs, flag brand bidding, and catch the patterns that aggregate reporting hides.

Either way, the argument for doing it is not really about fraud. It’s about what the money is doing instead. Commission leaking to opaque subnetworks is budget that could be buying exposure with publishers who genuinely introduce your brand to people who haven’t heard of it. That’s the actual cost: not just the spend you’re wasting, but the growth you’re not buying with it.

Three questions to ask about any subnetwork

• Can they tell you, in one sentence, where the traffic comes from?

• Will they give you a source-level report — URLs, not screenshots?

• If you removed them tomorrow, what would you lose? For a genuine partner, the answer is real reach. For an opaque one, it’s usually sales you were going to get anyway.

See this work in practice: $25,000 saved in commissions — a fraud audit case study.