Referral and bonus abuse on rewards sites: how to spot self-referrals

Short answer

Self-referrals show up as a referrer and referrals on the same device or cashing out to the same payout address. Make abuse unprofitable: pay commission only on confirmed earnings, delay fixed bonuses, cap commission per referral, claw back on reversals and review your top referrers.

Very strong sign

Referrer and referral cash out to the same PayPal or wallet.

Strong sign

Referrer and referral on the same device, or many referrals from one device family or small IP range.

When to pay the bonus

After the referred account completes its first reviewed cashout.

Real referrers

Bring users from many devices, countries and networks who complete different offers.

How referral abuse works

A typical GPT referral program pays the referrer a share of everything their referrals earn, often 5 to 20 percent for life, sometimes plus a fixed bonus when a referral reaches a threshold. Abusers exploit it in three ways.

• Self-referral. One person opens a second account with their own referral link. They earn on the second account and collect the commission on the first.
• Referral rings. A farm runs dozens of accounts under one referrer. The fake accounts do the offers; the commission flows up to one account that looks clean.
• Bonus harvesting. Accounts are created only to reach the referral or signup bonus threshold and are abandoned once it is paid.

Patterns that give self-referrals away

As with multi-accounts, the IP address alone is weak evidence. Friends and family who refer each other often share a home network. What separates a family from a farm is scale and the stronger links: the same device, the same payout address, the same email pattern.

-- Referrers whose referrals cash out to the referrer's own payout address
SELECT r.id AS referrer_id,
       COUNT(DISTINCT u.id) AS referrals_paid_to_same_address
FROM users r
JOIN users u     ON u.referred_by = r.id
JOIN cashouts c  ON c.user_id = u.id
JOIN cashouts rc ON rc.user_id = r.id AND rc.payout_address = c.payout_address
GROUP BY r.id
ORDER BY referrals_paid_to_same_address DESC;

Program rules that make abuse unprofitable

Detection matters, but program design removes most of the incentive before you need it.

1. Pay commission only on confirmed earnings. Pay on conversions after the network's reversal window, not on the moment of credit. Reversed conversions then never produce commission.
2. Delay fixed bonuses. Release a referral bonus only after the referred account has cashed out once and passed review, not when it signs up.
3. Cap commission per referral. A lifetime percentage with no cap is where rings make their money. A cap per referral or a time limit, for example 12 months, keeps it fair for real referrers.
4. Claw back. When a referral is confirmed as fraud, take back the commission it produced. Write this in your terms so users know.
5. Review top referrers. A handful of referrers usually produce most commissions. Look at their referral trees by hand every month.

Signup bonuses, promo codes and daily rewards

Referral programs are not the only bonus that attracts abuse. A signup bonus, a promo code shared on social media or a daily login reward all pay out for simply having an account, which is exactly what a farm can produce in bulk.

• Signup bonuses are the easiest to farm. Make them non-withdrawable until the account has earned a minimum amount from offers, so the bonus alone never reaches a cashout.
• Promo codes posted publicly get redeemed by every account a farmer controls. Limit each code to one redemption per device and payout address, not just per account.
• Daily and streak rewards reward accounts that log in, not people. Small amounts add up fast across fifty accounts. Tie larger streak rewards to real activity such as a completed offer.
• Contests and leaderboards can be won by a ring pooling activity into a few accounts. Review the winners' linked accounts before paying prizes.

The common thread is to pay bonuses on activity that costs the user something, such as time spent on real offers, and to check the account before the money leaves, not when the bonus is granted.

What to do when you confirm a referral ring

Once you are sure a referrer is running a ring, act on the whole group at once. Banning one account warns the farmer and leaves the rest earning.

1. Freeze pending cashouts for the referrer and every linked referral before you ban anyone.
2. Reverse the commissions the ring produced, and the bonuses its accounts collected, as your terms allow.
3. Block the shared devices and payout addresses so the same person cannot rebuild the ring with fresh accounts.
4. Keep the evidence: the shared device, the shared payout address and the signup timing. You will need it if the user disputes the ban or writes about it on a forum.
5. Tell the offerwall networks about the accounts if their conversions are still inside the reversal window. Networks value publishers who report their own bad traffic.

How CashoutGuard helps

CashoutGuard links accounts on every event you send, so self-referrals show up without a special referral rule. When the referrer and the referral share a device, a payout address or an email pattern, the evaluation returns device_shared_with_accounts, payout_address_shared or email_shared, and the linked-accounts graph shows the whole group.

• Check the referred account at signup and again at its first cashout, and hold the referral bonus until it passes.
• Open the referrer in the accounts view to see every account linked to it and why.
• Block a whole fraud ring in one click from the rings view, instead of one account at a time.

New sites start in shadow mode, so you can see how many of your current referrals are linked before you change any rule. See the multi-account guide for the signals in detail, or the docs to integrate.