How to detect *truly unique users/individuals*, for affiliate-marketing-payout tracking purposes? What are the most bulletproof, fraud-proof mechanisms?
The scenario is this: I am building a referral/affiliate/partner payout system into one of my software products. The idea is simply that those who refer others receive a percentage of their revenues. HOWEVER the development environment is a tricky one where I…
The scenario is this: I am building a referral/affiliate/partner payout system into one of my software products. The idea is simply that those who refer others receive a percentage of their revenues. HOWEVER the development environment is a tricky one where I don't actually have direct access to the amount of revenue earned from each specific individual. (This product is sold/offered as an add-on/extension for a desktop application on a third-party platform that handles the payment processing and they black-box the customer-specific payout information, unfortunately. It's a major limitation, I know, but it's a constraint I'm forced to work within on this project.) What this means is... a malicious user trying to game the affiliate-marketing-payout system in their favor could, in theory, keep re-creating accounts on our tool which would have the same referrer attached to it. In other words, someone could make it seem like they drove 100 signups and thus be eligible for the 100 payouts when in reality it was just them creating 100 accounts over and over again. I've already put in place a pretty strong duplicate-user-detection stack that includes the following: a unique browser-side id, where to bypass this they'd need to clear browser storage or open in Incognito mode; IP address, where to bypass this they'd need to rotate IP addresses for each new account; a unique desktop-application-side id, where to bypass this they'd need to clear the localStorage memory for our product in association with the desktop application that our product is offered on; some basic browser-fingerprint information (user agent, graphics card details, screen resolution, a few others); some basic device-fingerprint information (cpu model, cpu memory, a few others); I considered email or phone number verification BUT those can get mass-produced pretty easily online using a number of services so it doesn't seem super robust. The ideal solution would be able to conclusively say: "Yes, this is for sure a distinct specific individual on this one computer" without there being the possibility of false positives. Some sort of "universal_unique_computer_id" would be the holy grail for this sort of thing (like the VIN number equivalent for a computer, for example) BUT it apparently just doesn't exist for these kinds of fraud-detection purposes. At least not in a way where I would be able to access it. The above 5 items, individually, could be circumvented/changed via various means -- BUT the idea that any one person would be so thorough in their fraud that they'd think to modify all 5 of those items seems unlikely. Still, it's not totally bulletproof, some of them have the risk of false positives (ie, many people would share the same computer and thus would share those attributes), and unfortunately there's not one totally conclusive sort of "unique_id" that I can use for my purposes. The bottom line is, I'm just trying to minimize the possibility of me being on the hook to issue massive payouts for a scenario where the referrals were actually fake and produced by fraud. So the most accurate means of detecting fraudulent signups/referrals is ideal here. Any ideas you have, or experience you have working to solve this problem, would be GREATLY appreciated, as it's my first time doing any sort of affiliate-marketing setup for a business and I'm really just kind of fumbling my way through it. Thanks!
已收录讨论
You're incentivizing the wrong thing. Pay out when people spend money. Pay out less than they spend.
Are you familiar with Mturk (or similar)? If there is any cost effective way for someone to game your system using it, they will. www.mturk.com Affiliates get paid when the people they refer pay you.
Your title looks like a prompt you'd give to ChatGPT Tech subs have become insufferable since AI due to this
you can't truly identify a unique human, only make faking one costly. cookies clear, IPs are shared behind NAT, fingerprints drift. most payout systems settle for server-side dedup on a hashed IP plus a few signals, then manually review outliers instead of trusting the client.
Does the end product "black box" have a digital receipt that can be verified some how ?
Agree with the folks saying "pay on spend, not signups" but it seems like you have a blocker since the platform black-boxes per-user revenue, so you can't. It might be worth pushing further into that and not your detection stack, because no fingerprinting setup hits the "conclusively one individual" bar you want. You're trying to prove identity when what you need is proof of value. Since your product is an add-on on a desktop app, I'd dig into whatever paid-conversion artifacts that platform exposes like maybe a purchase webhook, a verifiable receipt, a license tied to a paid seat, etc. I wonder if this is something you could work with their team on to see if there is anything available to you? If they really expose nothing, then you're stuck approximating with identity signals, but just know it's leaky. Incognito plus a cheap VM or second profile wipes your browser id, storage id, and most of the fingerprint signals in one move, so it's not really the 5 hurdles you mentioned. You could use some of those signals to try and detect the tools bad actors might use to farm your incentives like automation, proxies, etc. but you’re still not going to have a clear fraud/not-fraud signal to base payouts on.