AffiliateTracking
Sign in Buy for $99

Rule geo_mismatch, from the product code

Sales from countries the clicks never came from

The link was clicked in Turkey, the sale came from Vietnam, and the affiliate is paid in dollars. Stolen cards and proxy buyers leave a geographic seam.

Buy self-host for $99 All 12 rules

Rule 11th of 12Holds, never deletesEvidence in your queue

Fraud queue on demo data: geo_mismatch sits with its verdict, subject, reason and action, above the held commissions with amounts.

The fraud queue, running on demo data.

How the rule works

The exact mechanics, from the engine. No black box, no tuning required.

  1. 01Click country vs sale country

    Every click and conversion carries a country from Cloudflare's edge headers. The rule compares the sets over 7 days.

  2. 023 sales, 30% share

    Three or more conversions from countries with zero matching clicks, at a 10% minimum share of 5+ geo-tagged conversions.

  3. 03Edge headers only

    Country data comes from the CDN edge, not client-side APIs, so a browser extension can't rewrite it.

The signals

  • 3+ conversions from clickless countries
  • 30%+ share
  • 7-day window
Holds, never deletesA hold freezes the commission before payout. Nothing is lost while you decide.
Evidence attachedThe queue shows exactly what tripped, side by side with the sale.

What lands in your queue

When geo mismatch fires, this is what you see. Release or uphold is your call, not the engine's.

Fraud queue · geo_mismatch · demo dataMade-up numbers
Example held commissions after geo mismatch fired, on demo data
AffiliateWhat trippedCommissionStatus
Affiliate 215 conversions from countries with zero matching clicks$163.75Held
heldWaits for youThe commission stays out of payouts until you decide.
releasedPaid normallyReal pattern after all. It returns to the pipeline.
upheldNot paidFraud confirmed. The clawback is journaled.

In the wild

4 million stolen cards, $530M in losses

  • Case: Infraud Organization, DOJ indictment Feb 2018, sentencings 2021: 10,901 members across 50 countries sold 4M card credentials; $530M actual losses. Leader got 10 years.
  • Stat: Juniper Research (2023): online payment fraud losses to exceed $362B cumulative 2023 to 2028, $91B in 2028 alone.

Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.

How attackers try to beat it

A fraudster routes clicks through the same country as the stolen cards. Now they need infrastructure per fraud geography, and the IP overlap rule catches the reuse.

Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.

Related rules

Rule thresholds checked against the code . Windows are rolling.

Geo mismatch questions

Can I change the threshold?

The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.

What does a hold cost me?

Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.

Does this rule fire on my best affiliate?

Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.

This rule, on every sale,
before the payout.

Self-host for $99 once, or run it in the cloud free for 14 days.

Buy self-host for $99 Try cloud free for 14 days