Affiliate fraud case: fake players and EUR 21-23 deposits

This affiliate fraud case comes from two test launches in Spain that, according to the programs involved, drew the same simulated players. Deposits clustered at EUR 21-23, all by credit card, typically one to two hours after sign-up. Payment data then pointed to emulators, not real devices. Both affiliates were removed; one was told it would not be paid.

In short: the simulated players left a cluster of signals, not one smoking gun, and the payment layer confirmed them.

Results at a glance

There is no ROI line: this is a detection case, not a profit case.

Context

Representatives of two affiliate programs and the CEO of the casino product they promoted described the case anonymously in a February 2026 trade report. The programs, the product and the affiliates are not named, and none of the figures can be checked independently.

The test terms are where the story starts. Program X's trial with the product was built for speed: a quick read on whether a new source or Tier-1 GEO is worth a deal. Its weakness was the missing yardstick. Beyond a handful of ground rules (players in Spain, slot games, a funded account and genuine play), nobody had fixed a retention or deposit-value target, so the program had nothing in writing to reject traffic against. It is the same gap that shows up in KPI disputes between affiliates and programs.

In CPA deals, the payout trigger is usually a qualifying first-time deposit (FTD), so fake FTDs are a natural target for affiliate fraud in iGaming. The programs' working theory was that the traffic was built to stay unremarkable through the operator's early checks and the payout hold. Ad measurement calls the same problem invalid traffic: the Media Rating Council says traffic may be deemed invalid when it comes from bots or activity designed to produce it.

What they did

The scheme ran simulated players on emulated devices and took each fake account through sign-up and one small deposit. The programs saw only the traces it left in their data. They are grouped below the way a fraud reviewer would work through them: what to check, what it showed here, and why it was odd.

Timing signals

• Speed of a cold launch. The first check on any new source is how quickly it produces. This one, switched on late in the evening, had a wave of sign-ups and its first deposits inside about an hour. From a source with no track record, the programs read that pace as a warning, not a win.

• Sign-up rhythm. Plot registrations by the minute. Instead of a scattered line, the chart showed tall spikes, each holding dozens of accounts created at nearly the same instant. People arrive independently; accounts that arrive together suggest one trigger behind them, which is how the programs read it.

• Deposit delay. Measure the gap between registration and first deposit for each account. Across this source it held at one to two hours on average. In the programs' experience someone who means to play funds the account right away or within minutes, so a uniform multi-hour wait across a whole source stood out.

Payment signals

• Deposit methods. Split the source's deposits by payment method. The breakdown had a single row: credit cards, 100%. A real audience fills several rows, so a one-method source was a flag for the programs.

• Amount band. Chart deposit sizes. They clustered between EUR 21 and EUR 23. Live players, in the programs' experience, pick uneven amounts; a band this tight looked like a preset value rather than a choice.

• Life after the first deposit. Follow each depositor into the following sessions. The trail stopped at the payment: one near-minimum deposit, next to no spins and no return visits. In a slots-only test that required play, accounts that fund and then go quiet look like they exist to trigger an FTD rather than to play.

Behaviour signals

• Form completion. Compare how far accounts get through the registration form, optional fields included. Here every account filled every one of the four to six steps, with no hesitation between them. Real sign-ups often leave optional fields blank, so a 100% completion rate reads more like a script than a crowd (the programs' observation).

• Bonuses. Check whether new depositors open or claim the bonus offer. None did. For a casino audience that is closer to a missing signal than a quiet one.

• Click-to-reg. Compare click-to-registration with past live traffic. It ran far above anything the teams had seen; the figure was not disclosed.

Same pattern at two programs

Program Y also ran a fast test in Spain and saw the same behaviour. Its cohort matched Program X's on registration flow, deposit timing, amounts and post-deposit silence. Two unrelated sources do not normally produce the same cohort; the match is what moved the programs from a quality complaint to a fraud investigation.

Device data settled it. Payment systems record which device and environment each deposit came from, so the team checked there. The deposits traced back to emulated environments, not physical phones or ordinary browsers. That finding gave the earlier ad fraud signals one technical cause.

Results

How the programs reacted, as they described it:

• Traffic stopped. At Program X, the product manager halted the flow and warned the affiliate it would not be paid. In a work chat the instruction was to stop all traffic and not launch new flows; Program Y's manager later confirmed the decision.

• Emulators blocked. The product's technical team then limited emulator access, and by the account, the deposits from this traffic stopped going through at that point.

• Partners removed. Both affiliates were removed from their programs. As reported, the programs concluded that one scheme had been routed through both, not that a single publisher had made a mistake.

How the fraud was detected

The order of evidence is the useful part. The tracker showed the volume and an implausible click-to-reg. Behaviour data showed the clusters: bursts, a fixed delay, one payment method, a flat amount band. The payment layer supplied the technical proof. Detection worked because each layer was checked against the next, not because one metric crossed a line.

The programs published no dashboards, counts or amounts, so treat these thresholds as illustrations, not benchmarks.

The larger cost of missing it would have been bad data, not one payout. A product that kept this traffic would have counted FTDs from accounts that were never going to play, and its activation, bonus and second-deposit numbers would have looked broken for reasons unrelated to the product.

What did not work

• The first theory was wrong. Program X first suspected the affiliate of sending crash-game traffic against the slots-only terms. That would have been a terms breach rather than simulated players, so the theory underestimated what was going on.

• Clean one row at a time. Small, similar deposits pass a row-by-row review. The uniformity only shows when the whole source is viewed at once.

• Single signals mislead. Card-only deposits or a late first deposit can each have an innocent cause. The case held because the signals clustered and repeated across two programs.

• The tracker could not settle it. The proof came from payment and device data that an affiliate tracker does not see.

Takeaways for affiliates: spotting affiliate fraud

If you run a program or product:

• Put a minimum yardstick into every test. Even a no-KPI test can name pause triggers: a payment-method mix, a deposit-to-play ratio and a time-to-first-deposit range.

• Look at distributions, not averages. Plot deposit amounts, sign-up timestamps and time-to-deposit per source. Tight clusters and synchronous spikes deserve a stop and a check, not a celebration.

• Use the payment and device layer. Ask your payment provider what device data it can return. If you ship a native Android app, Google's Play Integrity API can report whether a request comes from a genuine, certified Android device, and an emulator that fails its checks returns no device verdict.

If you buy or resell traffic:

• Audit sub-sources before they reach a program. Affiliate fraud prevention starts upstream: one sub-source sending emulated players can cost you the whole relationship, not only one payout.

• Rule out other fraud types. Odd conversion quality can also come from attribution theft such as cookie stuffing, so check click paths as well as players.

• Tie deposits back to clicks. Clean postback tracking lets both sides trace a flagged FTD to its source quickly.

FAQ

What is affiliate fraud in iGaming?

Affiliate fraud is any attempt to get paid for players, deposits or clicks that are not genuine. In casino and sportsbook programs its forms include fake FTDs, bonus abuse, duplicate accounts and simulated traffic like the case above. Our guide to affiliate fraud in iGaming covers each type.

How do you detect fake players or simulated deposits?

To spot simulated deposits, look for clusters: a narrow amount band, a fixed delay between sign-up and deposit, one payment method across a whole source, sign-ups in synchronous bursts and forms with no drop-off. Then confirm with device and payment data, which in this case showed emulators. Affiliate fraud detection here depended on several signals lining up.

Why were the deposits small and uniform?

The programs read the narrow, near-minimum amounts as a preset limit meant to look natural while keeping each deposit cheap. It backfired: live players deposit uneven amounts, so a steady EUR 21-23 band became the clearest signal in the case.

What happens to an affiliate whose traffic is flagged as fake?

Here, the traffic was stopped and both affiliates were removed from their programs; the first was told it would not be paid. Whether an operator can withhold payment or end a deal depends on the fraud clause in the terms you signed, so read it before a test starts.

Sources

• Media Rating Council, update to the Invalid Traffic Detection and Filtration Standards, June 25, 2020

• Android Developers, Play Integrity API: integrity verdicts

• Case figures: anonymous account by two affiliate programs and the product's CEO, published in a February 2026 trade report. Single anonymous source, not independently verified; this article regroups and summarises it and adds no independent data.