Why a partner was flagged. You can now see the reasons behind a flag, including fraud signals PartnerStack checks in your program. See Managing fraud to learn more.
Who is this article for? Program managers who want to understand how fraud is detected and what the Fraud Management tab shows.
Looking for step-by-step instructions? See Managing fraud.
PartnerStack works with Sift, an industry-leading fraud detection network trusted by brands like Box, X (formerly Twitter), Doordash, Zipcar, Zillow, and Yelp, to protect your program from fraudulent partner activity. In this article, you'll learn who can access the Fraud Management tab, how fraud is detected, which signals PartnerStack checks, and what data is monitored.
Who has access to fraud management?
All programs have the Fraud Management tab. It's in the left-hand menu under Performance.
You need Admin-level access, or Fraud permissions turned on by an Admin. See Configuring teammate permissions to learn how.
How is fraud detected?
When key events happen in your programs, Sift checks them for signs of fraud. PartnerStack also runs its own fraud signals on your program every day and sends the results to Sift as evidence. A signal never flags a partner on its own. Sift makes the final call.
Sift then builds a risk assessment for each partner and notifies the PartnerStack fraud team and your program manager when a decision is needed. For security reasons, we can't fully detail the threat model.
Some elements depend on your integration. For example, anonymizing your email records affects detection performance.
What happens to commissions?
When a partner is flagged, their commissions change to On hold. If you mark a partner as trustworthy, their commissions come off hold automatically.
What fraud signals does PartnerStack check?
Sift looks at general risk across its network. PartnerStack's signals look at patterns specific to partner programs, such as how customers sign up and how partners get paid.
- Self-referral: the partner used their own referral link to sign up as a customer. This includes look-alike emails, such as plus-tags and Gmail dot variations.
- Shared network activity: customers signed up from an IP address that someone on the partner's team also logs in from.
- Duplicate payout account: the partner's bank, Stripe, or PayPal details are shared with other, unrelated partners.
- Unusual conversion velocity: customers go from click to paid, or signup to paid, much faster than is normal in your program.
- Fraud reported from other programs: other programs have reported the same partner team for fraud.
A signal only appears when it fired in your program. One signal doesn't mean a partner is committing fraud.
How is fraud displayed in my dashboard?
You can see fraud flags in Fraud Management, in Applications > Flagged, and in All Partners.
In Fraud Management, partners are split into Active cases, Marked as trustworthy, and Removed partners. New flags appear in Active cases. Review the flag, then mark the partner as trustworthy or remove them. In Applications, you see the flagged applicant and the reason. See Managing fraud for the steps.
What is monitored?
PartnerStack monitors:
- A partner joins your program (partnership created)
- A referred customer purchases your product (transaction created)
- Ongoing user behavior across the PartnerStack network (account updates)
- PartnerStack's own fraud signals
Fraud logic by event
| Event | Data Monitored | Incidents that may raise an alert |
| Partnership created |
|
|
| User behaviour |
|
|
| Fraud signals |
|
|