Fraud rules for rewards sites: 15 examples you can copy

Short answer

Start in shadow mode, send users on hosting networks and disposable emails to review, block Tor and wallets shared by several accounts, set a stricter block threshold on cashouts than on signups, add velocity limits for offers and cashouts, and keep allow lists for your own test accounts.

Four rule types

Switch a signal off, change its weight, always review, always block.

Per event type

Different review and block thresholds for signups, offers and cashouts.

Lists

Allow or block by IP, device, account, email domain, payout address or country.

Safe testing

Shadow mode shows what a rule would change before anyone is blocked.

How rules sit on top of the score

Every event gets a score from 0 to 100 built from the signals that fired, each with a weight. The score is compared with two thresholds: at the review threshold the event is held for a person to look at, at the block threshold it is refused. Rules change that picture for your site without touching code.

• Off: the signal is ignored on your site.
• Custom weight: the signal counts more or less than the default.
• Always review: whenever it fires, the event goes to review at least.
• Always block: whenever it fires, the event is blocked.

Next to the rules there are thresholds (site-wide and per event type), velocity limits, which events enforcement applies to, and allow and block lists. Each rule on the Rules page shows how often its signal fired in the last seven days, so you can see the effect before saving.

Rules for networks and VPNs

1. `ip_tor` → always block. Tor exit nodes are almost never genuine rewards users, and offerwalls do not pay for them.
2. `ip_datacenter` → always review. Real users rarely browse from servers. Review rather than block, because some corporate networks and privacy tools route through hosting providers.
3. `timezone_mismatch` → lower weight if your users travel. If a large share of your audience are expats or travelers, a clock that disagrees with the IP country is weaker evidence for you. Lower it rather than switching it off: it still adds up with other signals.
4. Country list → block the countries you do not pay. Sites that only reward users in a few countries can block the others outright instead of scoring them. Do not allowlist a whole country: allowlisted traffic skips the score.

Rules for accounts, emails and wallets

1. `payout_address_shared` → always block (on cashouts). Several accounts withdrawing to the same wallet or PayPal is the clearest sign of one person running many accounts. Exchange deposit addresses without a memo are the main exception: send the address and memo together.
2. `email_disposable` → always review. A throwaway inbox is not proof of fraud, but on a rewards site it is worth a look before the first payout.
3. `device_shared_with_accounts` → keep it, raise the signup threshold. Families and shared phones are real. Leave the signal on and make signups harder to block (see the thresholds below) rather than switching it off.
4. `incognito` → off, if your audience browses privately. Private windows alone say little. If many of your honest users use them, switch the signal off.

The account map shows every account linked to a flagged one, with the date each was first seen. When a whole group turns out to be one person, block the group from there in one click.

Rules for offers, conversions and cashouts

1. `offer_completed_too_fast` → always review, minimum offer time 90 seconds. Set the minimum time to match your fastest real offers. Completions faster than any person could manage are bots or scripts.
2. Conversions per hour → 6. A person does not complete dozens of offers an hour. The default is 10; lower it if your offers are long.
3. Cashouts per day → 2. Most honest users cash out once. Several cashouts a day from one account is worth a review.
4. Thresholds per event type → cashouts block from 60, signups from 90. Money leaves at cashout, so that is where you want to be strict. At signup, a false block costs you a real user for nothing.

Where rules apply, and lists for the exceptions

1. Enforce only conversions and cashouts at first. When you leave shadow mode you can enforce only some event types, so signups and offer clicks keep being scored without blocking anyone.
2. Block postbacks, not accounts (offerwall networks). Choose to block only the fraudulent conversions: the user keeps their account, and the publisher is never paid for traffic an advertiser will reverse.
3. Allowlist your own test accounts and office IP. QA accounts share devices and networks by design. Put them on the allow list so they never show up as a ring.

Block lists work the other way: a wallet, device or email domain you already know belongs to a farm is refused everywhere on your site, whatever the score says. Keep a short note on each entry so the team knows why it is there.

The order matters when several of these apply at once. A block list match always wins: the event scores 100 and is blocked. An allowlisted account or IP always stays below the review threshold, whatever the signals say, so a trusted user is never held or refused by the score. Rules and thresholds decide everything in between.

Keeping rules honest over time

Rules drift. A signal that was noisy last month may be your best one after a campaign brings a new audience. Check the Rules page once a week: it shows how often each signal fired, and when your team keeps allowlisting accounts flagged by the same signal, it suggests a lower weight for it.

If you report which conversions were later reversed, the Accuracy page shows which signals actually predict reversals on your own traffic. That is the best guide for weights: raise the ones that predict reversals, lower the ones that only annoy honest users.

Custom rules come with the Starter plan (three rules) and are unlimited on Growth and Pro; every plan, including the free one, gets every signal and shadow mode. You can check a single address before writing a rule with the free IP checker.