Cookie Stuffing, Fake Ads, and the FTC
A pay-for-performance model is efficient by design — and that's exactly what makes it a target. Here's how affiliate fraud actually works, and what regulators now require in return.
Pay-for-performance is efficient — and exploitable
Affiliate marketing runs on a simple promise: pay a partner only when they deliver a result. That's exactly what makes the channel so efficient for advertisers — and exactly what makes it a target for fraud. When money follows a click, a lead, or a sale, the incentive isn't to do the work; it's to fake the result.
Estimates of how much affiliate traffic is fraudulent vary by source and vertical, but the direction is consistent: fraud has been rising, and networks now invest heavily in detection rather than treating it as a rare edge case.
How affiliate fraud actually works
- COOKIE STUFFINGPassive attribution theftA fraudster drops a tracking cookie in a visitor's browser through hidden iframes or scripts — without the visitor ever clicking a real affiliate link. If that visitor later buys anything, the fraudster's cookie claims the commission, stealing credit from whoever actually earned it, or from the retailer's own organic traffic.
- TRADEMARK BIDDINGBidding on the brand's own nameAn affiliate buys paid search ads on the advertiser's own branded keywords, intercepting customers who were already searching for the brand directly — paying for a sale that would have happened anyway.
- COUPON HIJACKINGBrowser-extension code injectionExtensions that auto-apply "discount codes" at checkout can silently insert an affiliate's tracking ID at the last second, intercepting a sale that had nothing to do with that affiliate's actual marketing.
- CLICK FRAUDBots and fake engagementAutomated traffic or incentivized clicking generates fake conversions or leads with no real buyer behind them — increasingly aided by AI tooling and cheap residential proxy networks.
Disclosure isn't optional — and brands share the liability
The foundation of US compliance is the FTC's Endorsement Guides, which require affiliates to clearly disclose any material connection to the brands they promote — cash payment, free product, or commission. Critically, the FTC has pursued brands themselves, not just individual affiliates, for their partners' non-disclosure. You cannot contract your way out of that liability.
The rules keep expanding to match new formats: 2026 updates extend disclosure requirements to live streams and short-form video, with stricter oversight of micro-influencers and harsher penalties for repeat violations. In the UK, only unambiguous labels like "#ad" satisfy the ASA's standard — vaguer phrasing doesn't count.
What fraud actually costs the industry
Trust is the actual product being sold here
Every fraud tactic in this post — cookie stuffing, trademark bidding, coupon hijacking, click fraud — attacks the same thing: the attribution system that decides who gets paid. And every regulatory rule — FTC disclosure, ASA labeling, GDPR consent — exists to protect the other side of that same trust: the shopper's ability to tell a genuine recommendation from a paid one. A program that only polices fraud but skips disclosure compliance is, as one compliance guide put it, "one FTC letter away from a crisis" — the two problems are really one problem wearing two hats.
Fraud and compliance figures reflect 2026 industry reporting from affiliate fraud-detection vendors, compliance guides, and FTC/ASA public enforcement data; specific penalty amounts and disclosure requirements should be confirmed against current regulatory guidance for your jurisdiction.
Read More: This article also appears at ScienceAffiliate.com.
