A partner network has frozen a payout and sent a short accusation: bots, incentivized traffic, duplicate leads, misrepresentation, or breach of traffic rules. The label may be broad, but the financial effect is concrete. To defend against affiliate fraud allegations, first preserve the evidence, identify the precise accusation, and compare it with the network’s contract and your own traffic data.
CPA-LAW.TECH handles these disputes for Russian-speaking media buying teams, founders, and agencies working with international networks. The work is factual before it is legal: first logs, then assessment, then a claim or a reasoned decision not to pursue one. A payment hold and an ad account ban are different disputes. They should not be mixed into one letter.
What an affiliate fraud allegation actually means
Affiliate fraud allegations are not a single legal category. A network may use the word “fraud” when its anti-fraud system sees unusual click patterns, when an advertiser rejects leads after its own review, or when the network believes a traffic source was not disclosed. Those are different factual situations, and they require different answers.
A CPA model means payment for a specified action, such as a registration, deposit, or approved application. A CPL model means payment for a lead. The dispute usually begins after the action has already been recorded in a tracker and credited in the network interface. Then the network places a hold — a temporary freeze on payment — while it reviews traffic or waits for the advertiser’s decision.
The accusation may concern invalid clicks, automated requests, repeated devices, low-quality leads, prohibited incentives, misleading creatives, or traffic sent outside agreed geographic, placement, or source restrictions. Sometimes the letter names none of these. It simply says that the traffic violated terms of service, or ToS, meaning the contractual rules of the network or advertiser.
That is not enough detail for a meaningful response. It is enough to start preservation work.
Defend against affiliate fraud allegations with evidence, not explanations
The first mistake is to respond emotionally or promise that all traffic was clean without checking the records. The second is to send screenshots from the network dashboard as if they establish the full history of a conversion. They usually do not.
Preserve the original data before filters change, accounts are restricted, or retention periods expire. Export tracker logs from Keitaro or Binom, including timestamps, click IDs, sub IDs, landing-page events, conversion postbacks, IP information where lawfully available, user agents, referrers, campaign parameters, and status changes. Keep the export format, the date of export, and the account from which it came.
A useful evidence file also includes the offer terms in force at the relevant time, insertion orders or correspondence about caps and approved sources, invoices, payment history, and the network’s hold notice. If the network changed the offer page or traffic rules, preserve the earlier version available to your team. A later version may not describe the terms under which the traffic was bought.
Do not alter logs, overwrite campaign names, or recreate missing reports. A gap in records can be explained. A modified export can damage the entire position.
What tracker logs can establish
Tracker logs can show whether clicks and conversions followed a plausible sequence, whether conversions clustered in a way that needs explanation, and whether the same parameters repeatedly appeared across supposedly independent users. They can also identify technical anomalies that deserve separate analysis rather than a blanket accusation.
For example, a high conversion rate alone does not prove invalid traffic. A narrow placement, a short campaign window, a strong pre-lander, or an approved source can affect results. On the other hand, a concentration of identical device patterns, repeated request timing, or conversions without a corresponding user path may support the network’s concern.
The point is not to force a favorable interpretation. It is to separate live traffic from artificial or unsupported events. A legal position is stronger when it acknowledges what the records do and do not prove.
Tracker data also has limits. Your logs may record a click and postback, while the advertiser holds additional information about deposit confirmation, duplicate customer checks, call-center validation, or chargebacks. Ask the network to specify which conversions it rejected and on what basis. If it refuses to disclose everything, request at least a conversion-level list, the rejection categories, the review period, and the contractual provision it relies on.
Review the contract before demanding payment
A network can withhold payment only within the terms the parties accepted and the applicable law. The practical question is not whether its anti-fraud team is dissatisfied. The question is whether the contract allows a hold, for how long, under what procedure, and whether it permits a full forfeiture of earnings.
Read the offer terms together with the general ToS. Check the definition of invalid traffic, the approved traffic sources, the network’s right to audit, notice requirements, dispute deadlines, payment conditions, and governing law. Also check whether the network may rely solely on an advertiser’s decision or must provide its own grounds.
This review often changes the approach. If the terms allow an investigation but not an indefinite hold, the request should focus on a documented review and a decision. If a category of traffic was explicitly prohibited, the work shifts to whether that category is actually shown by the data and whether the network approved or knew about the source in correspondence.
A verbal approval in a manager chat can matter, but it is not automatically stronger than written terms. Preserve the full conversation, not selected messages. Context matters: the offer, dates, campaign name, cap, and any limitations discussed.
Build a response that the network can verify
A useful response is not a long defense of the team’s reputation. It is a structured factual document that allows the recipient to compare your position against its anti-fraud findings.
Start with the disputed payout period, offer, campaign identifiers, and the exact amount under hold. State that you dispute the allegation to the extent it is unsupported. Then set out the traffic source, the agreed conditions, the relevant tracker evidence, and the specific questions requiring an answer.
Where the logs show an anomaly, do not ignore it. Explain the technical context if one exists, distinguish affected conversions from unaffected ones, and avoid claiming that every lead must be payable. A partial dispute can be more credible than an unsupported demand for the entire amount.
The request should be proportionate. Ask for release of the undisputed balance where the contract and facts support it. Ask the network to identify disputed conversions and explain the rule applied. Set a reasonable deadline for a substantive response, but do not invent deadlines that the contract does not contain.
For international networks, the claim and supporting chronology are often prepared in English, while the team’s source materials and internal explanations are in Russian. Translation must preserve technical meaning. “Rejected lead,” “invalid conversion,” “hold,” and “account restriction” are not interchangeable labels.
Keep the payout dispute separate from account access
A frozen CPA payout is a dispute with a network or advertiser about conversions and payment. A restriction in Meta Business Manager or Google Ads is a platform access issue governed by that platform’s policies and appeal process. One event may have triggered the other, but the evidence, recipient, and remedy are different.
Do not use a network payment claim to argue for a Meta unban or a Google Ads unban. Do not send a platform appeal filled with invoice arguments that the platform cannot verify. Each matter needs its own record and its own factual request.
The same separation applies to payment administration. If a team receives earnings from foreign networks in fiat currency or USDT as a payment method, the payment trail should match the contract, invoices, and actual business activity. Legalizing payouts for media buyers means building a documented payment structure and explaining the source of funds where required. It does not cure a disputed traffic claim.
When a formal claim is justified
A formal pre-litigation claim is justified when the evidence is preserved, the contract has been reviewed, the network has received a clear request, and the hold remains unsupported or the response conflicts with the terms. It may also be appropriate where the network refuses to identify the disputed conversions while retaining the full payout.
It is not always the right next step. If logs show material anomalies, or if the contractual restriction is clear and documented, a demand for all earnings may create unnecessary risk. The better course may be to narrow the dispute, seek records, or assess exposure before communicating further.
A claim should not promise a court result or assume that a network will release funds after one letter. Its function is to state the facts, preserve the legal position, request a defined action, and create a record for the next stage if one becomes necessary.
FAQ
Can a network call all traffic fraudulent because some leads were rejected?
Not automatically. The contract, the rejection basis, and conversion-level evidence matter. Rejected leads may justify review of those leads, but they do not by themselves establish that every conversion in the period was invalid.
Are screenshots from Keitaro or Binom enough?
Usually no. Screenshots can illustrate a point, but original exports and a clear explanation of fields, dates, and identifiers are more useful for technical review and a formal claim.
Should we stop traffic while the hold is under review?
It depends on the allegation, the offer terms, and the risk to the remaining budget. Continuing the same traffic without clarification can enlarge the disputed amount. Stopping every campaign without analysis can also cause avoidable loss.
If a network has held your payout on affiliate fraud grounds, send the hold notice, the applicable offer terms, and the tracker export for the disputed period. Start with the record that exists now. It is harder to build a defensible position after the data has disappeared.