Glossary of rewards, GPT and offerwall fraud terms

Short answer

A GPT (get-paid-to) site pays users small rewards for completing offers, surveys, games or tasks, and an offerwall is the list of paid offers a network supplies to it. Fraud on these sites is mostly multi-accounting, VPN and residential proxy traffic, emulators, phone farms and bots, which advertisers take back weeks later as reversals.

Postback

The server-to-server call from the network that says a user completed an offer.

Reversal or chargeback

A conversion the advertiser or network takes back after validating it.

Shadow mode

Running the fraud checks without acting on them, to measure before blocking.

Strongest single signal

A payout address shared by several accounts.

The business

• GPT site. "Get paid to" site. A website or app that pays users small rewards for completing offers, surveys, games or tasks, and earns from the advertisers behind them.
• Rewards app. The mobile version of a GPT site: users earn points by playing games or trying apps and cash out to PayPal, gift cards or crypto.
• Offerwall. A list of paid offers supplied by a network and shown inside a rewards site or app. The network pays the site for each completed offer.
• Offerwall network. The company that sells offers to publishers and gets paid by advertisers. It sits between the two and absorbs reversals when fraud is found.
• Publisher. The site or app that shows an offerwall to its users. A network has many publishers.
• PTC site. "Paid to click." A site that pays users to view ads for a set number of seconds.
• Faucet. A site that pays tiny amounts of cryptocurrency for claims made at regular intervals.
• Playtime offer. An offer that pays users for reaching milestones or time played in a mobile game.
• Survey router. A service that sends users to market-research surveys and pays for completes that the panel accepts.
• Geo-targeting. Offers that pay only for users in certain countries. The main reason VPN and proxy traffic gets reversed: the advertiser paid for a country the user was never in.

How the money moves

• Postback. A server-to-server call from the network to the site saying that a user completed an offer and how much it pays. The site credits the user when it arrives.
• Click ID. A unique identifier attached to an offer click and returned in the postback, so the conversion can be matched to the click.
• Conversion. A completed offer confirmed by a postback.
• Reversal or chargeback. A conversion the advertiser or network takes back after validating it, usually because it was fraud or did not meet the offer rules. It arrives days or weeks later.
• Cashout or withdrawal. The moment a user converts points into money or a gift card. The last point where the site can stop paying a fraudster.
• Hold. Keeping a reward or a withdrawal pending until it is reviewed, instead of paying it immediately.
• Payout address. Where the user is paid: a PayPal email, a crypto wallet, a gift card email. Shared payout addresses are one of the strongest fraud signals.

Types of fraud

• Multi-accounting. One person running many accounts to collect bonuses, referral rewards or offers several times.
• Farm. An organised operation that runs many accounts at once, on real phones, emulators or scripts, to extract rewards at scale.
• Phone farm. A rack of real mobile devices used to complete app installs and offers for many accounts.
• Bonus abuse. Creating accounts to claim sign-up or referral bonuses without any intention of using the service.
• Self-referral. Referring your own accounts to collect referral commissions.
• Incentive abuse. Completing offers only as far as needed to get paid, such as installing and immediately uninstalling an app.
• Forged postback. A fake conversion call sent to the site, pretending to come from the network.

Signals and techniques

• Device fingerprint. A set of characteristics of a browser or phone (screen, graphics, fonts, audio and more) combined into an identifier that survives cookie deletion.
• Persistent device ID. An identifier stored on the device so the same browser is recognised on the next visit. Clearing it and coming back is itself a signal.
• Linked accounts. Accounts connected by a shared device, payout address, email or network pattern. The basis of catching multi-accounting.
• VPN. A service that routes traffic through another server, hiding the real IP and country.
• Residential proxy. A proxy that uses real home connections, so the IP looks like an ordinary user. Invisible to IP blocklists; exposed by timezone, language and WebRTC mismatches.
• Datacenter IP. An address that belongs to a hosting provider rather than a home or mobile network. Real users rarely browse from one.
• Tor. An anonymity network. Traffic exits from known Tor exit nodes.
• WebRTC leak. A browser feature that can reveal the real IP behind a VPN or proxy.
• Emulator. Software that imitates a phone on a computer. Used to run many app accounts without physical devices.
• Automation. Scripts and headless browsers that click, tap and fill forms without a human.
• Offer speed. The time between an offer click and its conversion. Much faster than the offer allows means a bot or a shortcut.

Metrics

• Points per dollar. How many site points equal one dollar of network revenue. It sets how much of each payout the site shares with its users.
• eCPM. Effective revenue per thousand users or impressions. The usual way to compare offerwalls and ad formats.
• Validation window. The period during which an advertiser can still reverse a conversion. Holding rewards until it closes removes most chargeback risk.
• Reversal rate. The share of conversions taken back after validation. Networks watch it per publisher; advertisers watch it per network.
• Flagged share. The share of events or accounts a fraud check marks for review or block. Useful to compare publishers, countries or traffic sources.
• Monthly active users. Distinct accounts seen in a month. Fraud tools usually price by it.
• Velocity. How many actions an account or device performs in a short time: sign-ups per hour from one network, conversions per hour, cashouts per day.

Decisions and modes

• Risk score. A number, usually 0 to 100, that sums the weight of the fraud signals found on an event or account.
• Allow, review, block. The three decisions a fraud check returns: pay normally, hold for a person to look, or stop.
• Shadow mode. Running the fraud checks without acting on them, to measure the problem and tune the rules before blocking anyone.
• Enforce mode. Acting on the decisions: refusing, holding or stopping what the check flags.
• Fail-open. When the fraud check is slow or unreachable, letting the user through instead of blocking everyone.
• False positive. An honest user flagged as fraud. The cost that makes aggressive rules expensive.
• Allowlist and blocklist. Lists of accounts, devices, IPs or payout addresses that are always allowed or always blocked, whatever the score.

Where to go next

The multi-accounts guide and the VPN guide go deeper into the signals, the chargebacks guide explains reversals, and the fraud cost calculator puts a number on what it costs your site.