Traffic Fraud Investigation Checklist: A Repeatable Process for Finding Suspicious Traffic

Traffic fraud investigations rarely fail because an analyst cannot find an unusual metric. They fail because the investigation stops at the unusual metric. A high click-through rate, a strange placement, a burst of conversions or a cluster of data-centre IP addresses may justify scrutiny, but none of these findings alone proves fraud.

A reliable investigation connects evidence across the traffic source, click or visit, attribution chain, conversion event and downstream business outcome. It also preserves enough context to distinguish deliberate manipulation from tracking defects, normal audience variation, accidental duplication or a legitimate but low-quality source.

This traffic fraud investigation checklist is designed for performance marketers, affiliate managers, media buyers, analytics teams and fraud analysts. Use it as a repeatable workflow for a paid media audit, an affiliate review, a lead quality investigation or a broader fraudulent traffic audit.

What this checklist is designed to establish

The objective is not to label traffic quickly. The objective is to answer five separate questions:

Is the traffic real? Did a person, browser, device or automated process generate the interaction?
Is the traffic valid? Does it meet the rules of the campaign, publisher agreement, platform policy or measurement design?
Is the attribution accurate? Was the source credited because it genuinely influenced the outcome, or because tracking was overwritten, misconfigured or manipulated?
Is the conversion valuable? Does the lead, signup, order or install survive downstream quality checks?
What action is justified? Should the traffic be monitored, validated, corrected, restricted, held for review or blocked?

These questions should remain separate. Detection identifies a signal. Validation tests whether the signal represents a real and eligible interaction. Prevention reduces future exposure. Blocking is an enforcement action. Treating all four as the same process creates false positives and weak decisions.

Before the investigation: define the case

1. Write a precise investigation question

Begin with a statement that can be tested. For example: Why did Partner 184 produce a sharp increase in attributed leads, and are those leads genuine, eligible and commercially useful? Another useful question might be: Are paid-search conversions concentrated in a pattern that suggests click manipulation, tracking duplication or a campaign change?

A precise question prevents the review from becoming a general search for suspicious activity. Record the date the issue was noticed, who reported it, the affected account or program, the relevant campaigns and the decision that must be made.

2. Preserve the original evidence

Export or preserve the data before changing filters, blocking sources or editing campaign settings. Keep the original timezone, date range, attribution window, currency and column definitions. Save relevant platform reports, raw event logs, affiliate reports, CRM records, landing-page analytics, ad-server data and screenshots of configuration.

Do not rely on a dashboard that may recalculate historical data. Note when each export was taken and whether the data is provisional, deduplicated, sampled or delayed. If a source is suspected of fraud, changing the source relationship before collecting evidence can remove the very information needed to explain the pattern.

3. Define the comparison group

Suspicious traffic needs a meaningful baseline. Compare the affected source with similar sources, the same source during an earlier stable period, or the same campaign by geography, device, placement and landing page. A global account average is often too blunt to be useful.

Make the comparison fair. If one source is mobile-only and another is desktop-heavy, differences in bounce rate or conversion rate may reflect audience and page experience rather than abuse. Record the comparison window and any known changes, such as a bid strategy update, creative launch, tracking release or seasonal promotion.

Traffic fraud investigation checklist

4. Confirm the source and commercial terms

Record the source name, account, campaign, ad group, publisher, sub-publisher, affiliate ID or placement ID.
Confirm how the source was acquired: direct buy, exchange, affiliate relationship, reseller, partner network or unknown referral.
Check the contract, insertion order, affiliate terms or platform policy that defines allowed traffic.
Identify whether incentivized, rewarded, co-registration, toolbar, pop, redirect, email or branded-search traffic is permitted.
Check whether the source is allowed to use a brand name, bidding term, landing page, creative or tracking parameter.
Map every reseller or sub-publisher if the buying path is not direct.
Record the source’s claimed targeting, inventory type, geography, device mix and optimization method.

Many disputes are not classic bot attacks. They are eligibility disputes. A source may send real people but violate an agreement by using prohibited incentives, misleading creative, unauthorized brand bidding or a resold placement. That is still important, but it should be classified accurately.

5. Check the data and tracking foundation

Before interpreting behavior, verify that the measurement system is working as expected. Review tag deployment, event names, conversion definitions, duplicate handling, click IDs, campaign parameters, server-to-server events, consent behavior and timezone settings.

Are clicks and sessions using compatible definitions?
Can one user or device generate multiple conversion events?
Are retries, refreshes or webhook replays being counted as new conversions?
Did a tag, SDK, redirect or consent-management change occur before the anomaly?
Are attribution parameters being lost or overwritten during redirects?
Are internal staff, QA traffic, test orders or development environments excluded?
Are delayed conversions being assigned to the correct click date and source?

A tracking defect can resemble fraud. For example, a missing deduplication key may make one lead appear five times, while a redirect can replace the original campaign identifier with a last-click parameter. Investigate the measurement path before accusing a source.

6. Examine volume and timing

Plot clicks, sessions, leads, orders and revenue over time at an interval that exposes the pattern. Hourly or daily views may be appropriate; minute-level data can be useful for a short burst but can also exaggerate random noise.

Look for abrupt starts and stops, repeated bursts at the same times, activity outside the source’s stated operating hours, conversions appearing immediately after clicks, or volume that continues with unnatural regularity. Compare the timing with budget changes, scheduled campaigns, promotions, billing events and known product demand.

Timing is a clue, not a verdict. Automated systems can produce regular patterns, but human audiences can also respond to a television appearance, email send or time-zone-specific promotion. Record the pattern and test it against other evidence.

7. Review click and session behavior

Compare click-to-session, landing-page view and session-start rates by source.
Review time to first interaction, page depth, scroll behavior and navigation sequence.
Check whether sessions contain meaningful product or form activity.
Look for repeated user-agent, device, browser, language or screen-size combinations.
Review unusually high refresh, back-button, redirect or immediate-exit behavior.
Check whether clicks arrive without a corresponding ad impression where an impression should exist.
Compare the source’s behavior with traffic from similar campaigns and placements.

Do not use bounce rate or session duration as a fraud detector by itself. Privacy controls, slow pages, tracking restrictions, in-app browsers and analytics implementation issues can produce poor engagement signals. Behavioral evidence becomes stronger when several independent fields point in the same direction.

8. Inspect technical and network signals

Review IP address, autonomous system, hosting provider, proxy or VPN indicators, user agent, device characteristics, browser features, language, screen dimensions and connection type when lawfully available and appropriate. Examine concentration and consistency rather than treating any single attribute as decisive.

Questions to ask include:

Are many supposedly different users associated with a small number of technical identifiers?
Do devices claim combinations that are rare, inconsistent or impossible?
Does traffic come disproportionately from hosting or data-centre networks?
Are geographic signals inconsistent across IP, device, billing and submitted information?
Do click IDs, headers or event timestamps repeat in a way that suggests replay?
Are there signs of headless browsing, automation or scripted form submission?

Technical signals are probabilistic. Corporate networks, mobile carriers, privacy tools, shared devices and legitimate testing environments can create concentration. Avoid treating a data-centre IP, VPN or unusual browser as proof of fraud.

9. Audit attribution and click integrity

Attribution manipulation can create apparent performance without creating genuine incremental value. Trace the path from impression or referral to click, landing page, session, lead and final conversion.

Check whether the recorded click occurred before the conversion and within the agreed attribution window.
Look for clicks that happen unusually close to conversion time.
Identify whether a source overwrote an existing paid, organic, direct or affiliate attribution.
Review last-click, first-click, position-based and view-through rules separately.
Check for forced redirects, cookie stuffing, toolbar activity, ad injection or unauthorized retargeting.
Compare click IDs between the ad platform, analytics system, affiliate platform and CRM.
Test whether conversions can be attributed without a valid source click or impression.
Look for repeated identifiers, impossible sequences or conversion events linked to expired clicks.

A source can receive credit legitimately under one attribution model and still add little incremental value. That is a measurement and incrementality question, not automatically fraud. Keep attribution quality, traffic validity and commercial value as separate findings.

10. Validate conversion and lead quality

Downstream evidence often determines whether suspicious traffic matters commercially. Match attributed conversions to CRM, order, call-centre, payment, fulfilment, retention or sales records where permitted.

Check whether leads contain reachable contact details and pass basic verification.
Review duplicate names, phone numbers, email addresses, payment instruments and account identifiers.
Measure contact rate, appointment rate, approval rate, refund rate, cancellation rate and chargeback rate.
Compare activation, repeat purchase, retention or revenue by source when the business model supports it.
Check for rapid form completion, identical answers, repeated addresses or improbable profiles.
Separate rejected leads caused by genuine eligibility rules from leads that are unreachable or fabricated.
Review whether conversions were later reversed, refunded, deleted or marked as test records.

Downstream quality does not prove the mechanism. A low-quality lead may result from misleading targeting, a poor landing page, weak qualification or deliberate abuse. It does, however, help establish business impact and prioritize the response.

11. Test for relationships across sources

Fraud is sometimes distributed to avoid simple thresholds. Compare sources by shared IP ranges, devices, landing pages, creatives, click timing, form values, payment details, referral paths and post-conversion behavior. A single affiliate ID may conceal several sub-publishers, or several source IDs may lead back to the same operator.

Use clustering carefully. A shared landing page is normal; a shared device fingerprint across supposedly unrelated users is more informative. Explain which relationships are expected and which are unusual before escalating.

12. Reconcile every important count

Build a simple reconciliation from source-reported clicks to platform clicks, analytics sessions, server events, attributed conversions and accepted business outcomes. Document the reason for each difference.

Source or publisher reported volume.
Ad platform or affiliate platform recorded volume.
Landing-page or analytics system recorded sessions.
Conversion system recorded events.
CRM, payment or operational system accepted outcomes.

Large gaps can indicate invalid traffic, but they can also result from bot filtering, consent loss, ad blockers, delayed reporting, timezone differences, deduplication or different counting rules. Reconciliation is most useful when definitions are written next to the counts.

13. Assign an evidence-based finding

Use a classification that reflects the strength of the evidence. A practical set of labels is:

Normal or explained: the anomaly has a credible operational or measurement explanation.
Needs monitoring: signals are unusual but insufficient for an enforcement decision.
Invalid traffic likely: several independent indicators suggest the interactions do not meet the traffic rules.
Fraud confirmed: there is direct or corroborated evidence of deliberate manipulation, fabricated activity or prohibited attribution behavior.
Tracking issue: the primary cause is measurement failure rather than source misconduct.
Policy or quality breach: the source may be real but violates commercial terms or produces unacceptable downstream outcomes.

Use confidence levels and state what evidence would change the conclusion. This is particularly important when payment is being withheld, an affiliate is being terminated or a platform is being asked to take action.

How to document the investigation

Use an evidence register

For each finding, record the observation, data source, time range, comparison group, interpretation, alternative explanations and next action. A useful entry might say: Partner 184 produced 62 percent of attributed leads during the review window, but 41 percent were unreachable and 18 percent shared a technical identifier with other submissions. This supports a quality and possible automation concern; it does not yet establish deliberate fraud.

Keep raw evidence separate from analyst interpretation. Record filters, exclusions, query logic and transformations so another person can reproduce the result.

Protect sensitive data

Limit access to personal data, authentication details, payment information and device-level identifiers. Use the minimum data needed for the investigation, follow applicable privacy and retention requirements, and avoid putting sensitive records into informal documents or chat channels.

Prepare a decision memo

The final memo should state the scope, method, key findings, confidence, financial or operational impact, unresolved questions and recommended action. Include whether the recommendation concerns detection, traffic validation, prevention, blocking, payment review, tracking repair or source remediation.

Choosing the next action

When to validate

Use additional validation when the signal is meaningful but not conclusive. Options include a controlled test, landing-page verification, source disclosure, postback review, manual lead sampling, call verification, delayed payout or a comparison campaign. Validation should be designed to answer a specific question rather than create more unstructured data.

When to prevent

Prevention reduces future exposure. It may include stricter source terms, conversion rules, frequency controls, placement exclusions, parameter validation, server-side deduplication, payment holds, pre-approval or improved monitoring. Prevention can be appropriate even when fraud is not confirmed if the expected loss is material and the control is proportionate.

When to block

Blocking removes or restricts traffic, a placement, IP range, device pattern, publisher, affiliate or campaign. Block only when the evidence and confidence justify the risk of excluding legitimate users. Record the scope, reason, start date, owner and review date. A narrow, reversible control is often safer than a broad permanent block.

When to do nothing immediately

Some anomalies are noise, reporting delay or a normal audience effect. If the evidence is weak and the potential harm is limited, continue monitoring with a defined threshold for reopening the case. Inaction should still be documented; otherwise the same question will be investigated repeatedly.

Common investigation mistakes

Calling a source fraudulent because one metric is extreme.
Using a generic bot score as the final decision.
Ignoring tracking changes that happened at the same time as the anomaly.
Comparing unlike campaigns, devices, geographies or attribution windows.
Counting low-quality leads as proof of bot traffic.
Blocking before preserving evidence and informing relevant owners.
Confusing invalid traffic with poor incrementality or weak creative.
Failing to investigate sub-publishers and resellers.
Using post-conversion evidence without checking whether the source could influence that outcome.
Writing conclusions without stating uncertainty or alternative explanations.

One-page investigation checklist

Define the question, scope, decision and review window.
Preserve raw reports, logs, settings and source terms.
Choose a relevant comparison group and document definitions.
Confirm source ownership, reseller paths and permitted traffic types.
Verify tags, event logic, deduplication, click IDs and attribution settings.
Review volume, timing, geography, device and placement patterns.
Inspect click, session and technical behavior.
Trace attribution from impression or referral to conversion.
Validate leads, orders, revenue and downstream outcomes.
Look for relationships across sources and sub-publishers.
Reconcile counts across source, platform, analytics and business systems.
Classify the finding without overstating the evidence.
Choose monitoring, validation, prevention, remediation or blocking.
Document owners, deadlines, controls and a future review date.

FAQ: traffic fraud investigation checklist

What is a traffic fraud investigation?

It is a structured review of traffic, attribution and conversion evidence to determine whether interactions are genuine, valid, policy-compliant and commercially useful. It should also identify tracking errors and other explanations before assigning blame.

What is the first step in a traffic fraud investigation?

Define the investigation question, scope, time range, decision required and comparison group. Preserve the original data before blocking or changing campaign settings.

Is a high click-through rate proof of click fraud?

No. A high click-through rate can result from creative, placement, audience, reporting or tracking differences. It becomes more concerning when supported by abnormal click timing, technical repetition, attribution manipulation or poor downstream evidence.

How do I investigate suspicious affiliate traffic?

Identify the affiliate and any sub-publishers, review permitted traffic methods, compare click and conversion behavior, inspect attribution, validate leads or orders, and reconcile affiliate reports with your own systems.

What evidence is strongest in a fraud investigation?

Corroborated evidence across independent systems is generally stronger than a single score. Examples include repeated event identifiers, fabricated records, impossible sequences, documented unauthorized methods and downstream records that contradict reported conversions.

Can bot traffic create real conversions?

Automated traffic can trigger conversion events, exploit weak forms or generate activity that appears successful in a platform report. A conversion event should therefore be checked against deduplication, user behavior and downstream business records.

Should I block traffic as soon as it looks suspicious?

Not always. First preserve evidence and assess the risk of continued exposure. A temporary, narrow and reversible control may be appropriate while validation continues, but broad blocking based on weak evidence can exclude legitimate users.

What is the difference between invalid traffic and fraud?

Invalid traffic does not meet the rules or quality requirements for counting or payment. Fraud usually implies deliberate deception or manipulation. Invalid traffic can result from mistakes, poor inventory or technical problems, so the terms should not be treated as interchangeable.

How should I investigate attribution manipulation?

Trace the click or impression through redirects, landing pages, identifiers, conversion events and attribution windows. Check for overwriting, cookie stuffing, forced clicks, expired identifiers and credit taken after another source already influenced the user.

What downstream data should I review?

Review reachability, approval, activation, payment, fulfilment, refunds, cancellations, chargebacks, retention, repeat purchase and revenue where relevant. The right measures depend on the business model and should be compared with similar sources.

Can a VPN or data-centre IP prove fraud?

No. VPNs, proxies, corporate networks, mobile carriers and privacy tools can be used by legitimate users. Network data is a supporting signal that requires context and corroboration.

How long should a traffic investigation cover?

Use a window that includes the anomaly, a stable baseline and any relevant campaign or tracking change. Short windows help isolate bursts; longer windows reveal whether the pattern is persistent, seasonal or caused by a one-time event.

What should a traffic fraud investigation report contain?

Include scope, data sources, definitions, comparison groups, observations, alternative explanations, evidence strength, business impact, unresolved questions and recommended actions with owners and dates.

How can I reduce false positives?

Use multiple independent signals, compare like with like, investigate measurement defects, sample records manually, state uncertainty and prefer narrow controls. Do not treat a model score or one abnormal metric as a final verdict.

What is the difference between traffic validation and fraud detection?

Fraud detection looks for suspicious or manipulative patterns. Traffic validation tests whether traffic meets a defined standard for authenticity, eligibility and quality. Validation can reject traffic without proving intentional fraud.

When should an affiliate payment be held?

A hold may be reasonable when the contract allows review, the potential exposure is material and there is a documented, time-bound investigation. State the scope and avoid treating a temporary hold as a final fraud finding.

How often should a traffic source be rechecked?

Recheck continuously through monitoring, and perform deeper reviews after major volume changes, tracking releases, new sub-publishers, unusual conversion patterns or material changes in source terms.

Semantic map

The investigation can be understood as a connected map rather than a single fraud score. A traffic source generates a click or visit; the click passes through an attribution path; the user may produce a conversion event; and the business later records a downstream outcome. Each relationship can be measured, manipulated or misreported.

Source → generates → clicks, impressions or visits
Click → carries → campaign and attribution identifiers
Attribution identifier → assigns credit to → a source or channel
Session → contains → behavioral and technical signals
Conversion event → records → a claimed outcome
CRM or payment system → validates → downstream business quality
Affiliate terms → define → permitted traffic and payment eligibility
Investigation → compares → affected traffic with a relevant baseline
Evidence → supports → a confidence-rated finding
Finding → informs → monitoring, validation, prevention or blocking