Affiliate payouts: paying partners per install without paying for manufactured ones

An affiliate programme is a payout formula, and a payout formula is something people optimise against. The honest partners send real traffic. The others fire a click at every impression they can buy, hoping to claim organic installs that would have happened anyway, or run installs through device farms until the bonus tier clears. Raw install counts can't tell the two apart.

What problem does this solve?

You need per-partner attribution that is specific enough to pay on and specific enough to dispute. 'We deducted 300 installs' starts an argument; 'these 300 installs had a click-to-install time under ten seconds and came from eleven devices' ends one.

How do you set the links up?

One link per partner, one per partner-placement if they run several. The partner identifier lives in the payload, and the source tag carries the placement so you can see which of a partner's channels is doing the work.

{
  "deepLinkPath": "/",
  "customData": {"partner": "aff-2291", "placement": "comparison-site", "sub": "top-10-list"}
}

How does click flooding show up?

Click flooding is the affiliate fraud that looks most like success. The partner fires clicks at scale; some fraction of those users install organically later; the flood claims them. The signature is in the timing — installs landing at the far end of the attribution window, long after the click, in numbers that real intent doesn't produce.

• Click flooding and click injection are opposite ends of the same axis: the install lands too late, or too soon, to be a person.
• Device repeat and IP velocity catch the farm variant: the same device or address producing installs at a rate no audience does.
• Each flagged install records which rule fired, so a deduction comes with a reason a partner can check.

What do you actually pay on?

Pay on the post-install event, and settle from the webhook rather than the partner's report. The install event carries the match type and any fraud flags; the activation event says whether the user did the thing you actually value. Settling on a nightly webhook feed into your own ledger means the payout is computed from data you hold, not from a number the partner emailed.

Which metric should you watch?

Flagged share by partner, tracked over time. A partner whose flagged share climbs from two percent to twenty in a month has changed something, and you want to know before the invoice, not after.