Rule self_referral, from the product code
An affiliate buying through their own link
The simplest fraud there is: your affiliate becomes your customer, and their commission comes straight back to them. 100% margin loss on that sale.
Rule 1st of 12Holds, never deletesEvidence in your queue
The fraud queue, running on demo data.
How the rule works
The exact mechanics, from the engine. No black box, no tuning required.
- 01One email comparison
Every sale carries the buyer's email. The engine strips anything after a plus sign, and dots too on Gmail, then compares it with the affiliate's own address. A match means the affiliate bought through their own link.
- 02It holds, not rejects
The commission goes on hold with the evidence attached. You see both emails side by side in the fraud queue and decide: release or uphold.
- 03Alias proof
Buying via your.name+tag@gmail.com doesn't dodge it. The alias rules are the same ones the duplicate-account rule uses, so one trick can't beat two rules.
The signals
- Buyer email = affiliate email
- Plus-tag aliases stripped
- Gmail dots stripped
What lands in your queue
When self-referral fires, this is what you see. Release or uphold is your call, not the engine's.
| Affiliate | What tripped | Commission | Status |
|---|---|---|---|
| Affiliate 7 | Buyer email = affiliate email, aliases stripped | $112.40 | Held |
heldWaits for youThe commission stays out of payouts until you decide.releasedPaid normallyReal pattern after all. It returns to the pipeline.upheldNot paidFraud confirmed. The clawback is journaled.In the wild
Amazon bans it. Courts call it fraud when it scales.
- Fact: Amazon Associates' participation rules bar purchases through your own account. Self-referrals pay commission on a sale you would have made anyway.
- Adjacent case: The eBay cookie-stuffing prosecutions (below) are the canonical version of an affiliate harvesting own commissions: Shawn Hogan took $28M+ before prison. Source
Cases and figures verified against court records and named reports, . Vendor estimates are labelled as such.
How attackers try to beat it
Adversaries rotate plus-aliases and Gmail dots. The comparison normalizes both before matching, so name+shop@gmail.com and n.a.m.e@gmail.com still land on the same account.
Every rule is one layer. The twelve overlap on purpose: beating one cleanly usually means walking into another.
Related rules
Rule thresholds checked against the code . Windows are rolling.
Self-referral questions
Can I change the threshold?
The thresholds ship fixed, tuned from the rule code and tested together. Tightening one in isolation breaks the overlap the twelve rules build as a set.
What does a hold cost me?
Nothing but time. A held commission is frozen, not deleted. If you release it, it flows to the next payout exactly as if the hold never happened.
Does this rule fire on my best affiliate?
Every rule is scoped to the commissions linked to what tripped it, weighted by conversions, and rate-limited on the click side. A rival can't aim it at your top earner.
This rule, on every sale,
before the payout.
Self-host for $99 once, or run it in the cloud free for 14 days.