Fraud review: what gets held and why

Every new commission is checked automatically. If something looks wrong it is held: it stays off Payouts until you decide.

• Self-referral: the customer's email matches the affiliate's own email (needs customer_email_hash in your events).
• Click burst: 20 or more clicks from the same device in the hour before the sale. IP addresses are stored only as a one-way hash.
• High refunds: 30% or more of the affiliate's sales in the last 90 days were refunded (at least 5 sales).
• Instant sale: paid less than 10 seconds after the click.

Open Fraud review: Release lets the commission continue; Reject commission cancels it so it is never paid. Every decision is in the audit log.