How an Affiliate Manager Uncovered $18K in Fake CPA Commissions in 20 Minutes

ArcPlay is a Manila-based iGaming operator serving roughly twenty thousand monthly active players across the Philippines and broader Southeast Asia. The platform runs sports betting and casino verticals, settling in both USDT and PHP, generating approximately $3.5M per week in gross gaming revenue. Sixty-plus affiliate partners drive a substantial share of new player acquisition — which also means sixty-plus potential attack surfaces for fraud.

Products used: Fraud Detection, Affiliate Audit, Device Intelligence

20 minutes | to identify a fraudulent affiliate and build a suspension case

340 | ghost registrations traced to a single affiliate account

$18K | in fraudulent CPA commissions recovered and clawed back

---

Challenge

Ryan Santos manages ArcPlay's affiliate program from the ground up — partner onboarding, CPA negotiations, weekly payouts, performance reviews. Sixty-three active partners. On a good week, that program generates forty percent of the platform's new first-time depositors and handles close to $190K in commission payouts.

On a Thursday afternoon in the third week of the month, something caught his eye while preparing the monthly affiliate performance summary. One partner, registered under the handle AFF-SEA-114, had sent 340 new registrations in the current billing cycle. That was the fifth-highest registration count in the entire network. At ArcPlay's standard CPA structure — $53 per qualified first-time depositor — that looked like roughly $18K in earned commission headed for payout the following Tuesday.

The problem was the deposit rate. Platform-wide, ArcPlay converts 42% of new registrations into first-time depositors within the first 72 hours. AFF-SEA-114's 340 registrations had converted at 6%. Nineteen FTDs out of 340 attempts. Ryan had seen low-quality affiliates before — partners who bought cheap traffic, partners whose geo was slightly off, partners whose landing pages loaded slowly on mobile. None of them had ever been this far below the waterline. The math didn't add up, and neither did the commission.

"At first I thought it was a tracking issue. Maybe their UTM tags were broken and we were double-counting registrations from another source. But when I checked the raw numbers, everything pointed to the same affiliate. Three hundred forty accounts with almost no deposits. That's not bad traffic — that's coordinated."

— Ryan Santos, Affiliate Manager, ArcPlay

The practical problem was what to do next. Suspending an affiliate mid-month — especially one with 340 registered accounts already in the system — required evidence. Not a hunch. Not a bad conversion rate. Real evidence that could survive a dispute, satisfy the payments team, and hold up if AFF-SEA-114 challenged the clawback. Ryan opened Gaming Mind AI and started pulling the thread.

---

Solution

Ryan had one question: is this fraud or just terrible traffic? Gaming Mind AI gave him a methodology, not just a number — walking him from the anomaly through player behavior, device signals, and financial exposure in a single focused session.

---

Ryan: "Show me AFF-SEA-114's registration and deposit performance this month compared to the affiliate network average."

Metric	AFF-SEA-114	Network Median	Network Next-Lowest	Network Best
Registrations (billing cycle)	340	94	198	412
First-time depositors (FTDs)	19	41	48	187
FTD conversion rate	5.9%	43%	24%	45.4%
Rank by registration volume	5th of 63	—	—	—
Rank by FTD conversion rate	63rd of 63 (last)	—	—	—
Accrued CPA at $53/FTD	$18,037	—	—	—
Registration ramp pattern	290 of 340 in last 12 days	Spread evenly	—	—

30-Day Registration Trend — AFF-SEA-114

Week	Registrations	FTDs	FTD Rate
Week 1	12	4	33%
Week 2	38	9	24%
Week 3	134	4	3%
Week 4	156	2	1.3%
Total	340	19	5.9%

⚠️ Gaming Mind flags: AFF-SEA-114 ranks 5th by registration volume but dead last (63rd of 63) by FTD conversion rate. The next-lowest affiliate converts at 24%. A partner with this volume performing this far below the median has a less than 0.3% probability of doing so through random variance. 290 of 340 registrations arrived in a tight 12-day cluster — a ramp pattern inconsistent with any legitimate marketing campaign.

The gap was worse than Ryan had eyeballed in the spreadsheet. AFF-SEA-114 had sent 340 registrations — the fifth-highest in the network — but their 5.9% FTD rate put them dead last out of sixty-three partners. The next-lowest affiliate sat at 24%. The network median was 43%. Gaming Mind flagged the anomaly as statistically extreme: a partner with this volume who performed this far below the median had a less-than-0.3% probability of doing so through random variance alone. This wasn't noise. The system surfaced one additional signal: AFF-SEA-114's traffic had ramped sharply in the last twelve days of the cycle, with 290 of the 340 registrations arriving in a tight cluster, rather than spread across the month.

---

Ryan: "What are those 340 players actually doing after registration? Walk me through their behavior."

Behavior Segment	AFF-SEA-114 Accounts	Platform Avg (same period)
Total accounts analyzed	340	—
Session length < 90 seconds	287 (84%)	8%
Never navigated past registration screen	211 (62%)	3%
Visited a game lobby page	31 (9%)	71%
Made a deposit attempt	24 (7%)	44%
Completed first-time deposit	19 (5.6%)	42%
Average session length (non-depositors)	43 sec	7 min 12 sec
Average session length (depositors)	8 min 31 sec	9 min 04 sec

Depositor Behavior Detail (19 legitimate FTDs)

Metric	Value
Browsed before depositing	Yes — opened game categories
Deposit range	$10–$30 PHP
Post-deposit activity	Minimal — went quiet after first session
Device / IP origin	Distinct residential IPs across Luzon + Visayas
Behavioral classification	Consistent with real human traffic

Non-Depositor Behavioral Cluster (287–321 accounts)

Signal	Detail
Registration-to-bounce time	< 90 sec
Exploratory navigation	None
Behavioral classification	Automated account creation — no genuine user intent

⚠️ Gaming Mind flags: 287 of 340 accounts had session lengths under 90 seconds. 211 never navigated past the registration confirmation screen. Only 31 visited a game lobby. The 287 instant-bounce accounts form a distinct behavioral cluster consistent with automated account creation, not human traffic from any real marketing source. The 19 depositors are the only accounts exhibiting normal user behavior.

The behavior profile was immediate and damning. Of the 340 registered accounts, 287 had a recorded session length of under ninety seconds. Two hundred and eleven had never navigated past the registration confirmation screen. Only thirty-one had visited a game lobby page. The nineteen who deposited were the only ones who engaged in anything resembling normal user behavior — they'd browsed, opened game categories, deposited between $10 and $30 in PHP, and then gone quiet. Gaming Mind flagged the 287 instant-bounce accounts as a distinct behavioral cluster: registrations with no exploratory intent, consistent with automated account creation rather than human traffic from any real marketing source.

---

Ryan: "Is there any pattern in the devices or IP addresses tied to these accounts?"

Device Fingerprint Analysis — AFF-SEA-114 (340 accounts)

Category	Count	Detail
Total accounts analyzed	340
Accounts with distinct device signatures (legitimate)	77	Residential IPs, unique hardware
Accounts sharing 14 device signatures (fraud cluster)	263	18–19 accounts per physical device
Unique device signatures in fraud cluster	14
Avg accounts per fraud device	18.8

IP Address Analysis

Category	Accounts	IP Range	Location
Fraud cluster IPs	263	3 × /24 subnets	Metro Manila data center
Legitimate depositor IPs	19	Diverse residential	Luzon + Visayas (scattered)
Other non-depositor IPs	58	Mixed	Various PH residential

Device Cluster Detail (Fraud — 14 Devices)

Device ID	Accounts Registered	IP Subnet
Device #1	22	103.12.48.x
Device #2	21	103.12.48.x
Device #3	19	103.12.49.x
Device #4–14	17–19 each	103.12.48.x / .49.x / .50.x
Subtotal (14 devices)	263	3 /24 subnets

⚠️ Gaming Mind flags: 263 of 340 accounts share just 14 unique device signatures — an average of 18–19 accounts per physical device. All 263 fraud accounts cluster into 3 /24 IP subnets resolving to a single Metro Manila data center. The 19 legitimate depositors came from genuinely distinct residential IPs across Luzon and Visayas. This is a device farm. The evidence is unambiguous.

This was the clearest confirmation Ryan had seen. Gaming Mind's Device Intelligence module mapped the 340 registered accounts against device fingerprints and IP metadata. Two hundred and sixty-three of the accounts shared just fourteen unique device signatures — an average of eighteen to nineteen accounts per physical device. The IP addresses clustered into three /24 subnets, all resolving to a single Metro Manila data center. The nineteen legitimate depositors came from genuinely distinct devices and residential IPs spread across Luzon and Visayas. Gaming Mind rendered the device overlap as a visual cluster map: the 263 fraud accounts formed a tight, distinct mass separated entirely from the legitimate player population. Ryan had his device farm.

---

Ryan: "How much has ArcPlay paid AFF-SEA-114 in commissions, total and this cycle?"

AFF-SEA-114 Commission History — 4 Months Active

Cycle	FTDs Claimed	CPA Rate	Commission Paid	Fraud Accounts (est.)	Fraud Commission (est.)
Month 1	41	$53	$2,173	~18	~$954
Month 2	87	$53	$4,611	~52	~$2,756
Month 3	210	$53	$11,130	~140	~$7,420
Month 4 (current — accrued, unpaid)	340	$53	$18,037 accrued	263 confirmed	$13,939 clawback-eligible
Lifetime total paid (months 1–3)			$17,914
Lifetime total incl. current accrual			$35,951

Current Cycle Clawback Breakdown

Account Category	Count	CPA Qualified?	Commission Accrued	Clawback Eligible?
Legitimate FTDs	19	Yes	$1,007	No
Device-farm accounts qualifying under standard agreement	263	Yes (met min. registration criteria)	$13,939	Yes
Non-qualifying registrations	58	No	$0	N/A
Current cycle total	340		$18,037	$13,939

⚠️ Gaming Mind flags: $13,939 in current-cycle commission is clawback-eligible under ArcPlay's standard affiliate agreement fraud clause. Total lifetime commissions paid to AFF-SEA-114 across three prior cycles: $17,914 — with escalating fraud volume in each cycle suggesting the same pattern may have inflated earlier claims. A precise clawback figure is available; this is not an estimate.

AFF-SEA-114 had been active on the ArcPlay network for four months. Total lifetime commissions paid came to $31,200 across three completed payout cycles. The current cycle had accrued $18,037 — paid at ArcPlay's $53 CPA rate for the nineteen legitimate FTDs, plus the fraudulently qualified accounts that had slipped through without triggering automatic quality flags. Gaming Mind isolated the clawback-eligible amount by cross-referencing the 263 device-farm accounts against the CPA qualification rules: of the 321 non-legitimate accounts, 263 had met the minimum registration criteria to qualify for commission under ArcPlay's standard agreement, generating $13,939 in commission that had not yet been paid. Ryan now had a precise figure — not an estimate — to bring to the payments team.

---

Ryan: "Can you trace how AFF-SEA-114 is actually sending traffic to us? What does their referral chain look like?"

Traffic Group	Accounts	Disclosed Source	Actual Referral Path	Intermediate Domains	Classification
Legitimate depositors	19	Facebook media buys — Filipino sports fans	Direct Facebook placement ID → ArcPlay	None (clean)	🟢 Verified legitimate
Fraud cluster	263	Facebook media buys — Filipino sports fans	Redirect chain → 2 undisclosed domains → ArcPlay	2 (not disclosed, not registered with ArcPlay compliance)	🔴 Traffic broker arbitrage
Unclassified registrations	58	Facebook media buys	Mixed / partial tracking	Partial match	🟡 Unclear origin

Redirect Chain Detail (Fraud Accounts)

Step	Domain	Disclosed to ArcPlay?	Registered in Compliance Docs?
Origin	Bulk redirect source (low-quality traffic broker)	No	No
Intermediate #1	Undisclosed domain A	No	No
Intermediate #2	Undisclosed domain B (clean-looking landing page)	No	No
Destination	ArcPlay registration page	—	—

UTM Pattern Analysis

UTM Parameter	Fraud Accounts (312 of 340)	Legitimate Depositors (19)
utm_source	broker-redirect-A	facebook
utm_medium	redirect	paid_social
utm_campaign	Obscured / generic	Filipino-sports-2024
Clean Facebook placement ID present	No	Yes

⚠️ Gaming Mind flags: AFF-SEA-114 disclosed "Facebook media buys" as their traffic source at onboarding. 312 of 340 registrations carry UTM paths consistent with a redirect chain passing through two undisclosed intermediate domains — neither disclosed in onboarding documents nor registered with ArcPlay's compliance team. The redirect structure is consistent with traffic broker arbitrage. The 19 legitimate depositors had clean Facebook referral paths — they were likely acquired legitimately and mixed into the batch to dilute the fraud signal.

AFF-SEA-114 had disclosed their traffic source as "Facebook media buys targeting Filipino sports fans" during onboarding. The referral chain told a different story. Gaming Mind traced the UTM parameters on the 340 registrations: 312 of them carried referral paths consistent with a redirect chain passing through two intermediate domains neither disclosed in AFF-SEA-114's onboarding documents nor registered with ArcPlay's compliance team. The redirect structure was consistent with traffic broker arbitrage — buying cheap, bulk redirects from low-quality sources and routing them through a clean-looking intermediate page to obscure origin. The nineteen legitimate depositors had clean referral paths that traced directly to Facebook placement IDs. They were probably real — acquired legitimately by the same partner and mixed into a batch of manufactured accounts to dilute the fraud signal.

---

Ryan: "What's the total financial exposure here — commissions paid, commissions accrued, and estimated GGR impact from the fake accounts?"

Category	Amount	Notes
Lifetime commissions paid (months 1–3)	$31,200	Prior cycles — may contain same fraud pattern at lower volume
Current-cycle commission accrued (unpaid)	$18,037	Billing cycle in progress
Current-cycle clawback-eligible	$13,939	263 device-farm accounts qualifying under standard agreement
Current-cycle legitimate commission	$1,007	19 verified FTDs at $53 CPA — not clawback-eligible
GGR from 263 device-farm accounts	$214 total	Negligible — mostly bonus abuse from legitimate depositors
Net GGR-to-commission ratio (fraud accounts)	1.5%	$214 GGR vs $13,939 commission accrued
ArcPlay's highest fraud score on record	Yes	AFF-SEA-114 ranks #1 across all 63 active partners

Recovery Scenario

Action	Recovery Amount
Block unpaid current-cycle commission (fraud portion)	$13,939
Open prior-cycle review (months 1–3)	Up to $17,914 (investigation required)
Remove 263 accounts from active player counts	Prevent future bonus exploitation
Immediate confirmed recovery	$13,939

⚠️ Gaming Mind flags: The 263 device-farm accounts generated just $214 in aggregate wagers — essentially zero real revenue — while costing ArcPlay $13,939 in accrued commission. Total lifetime commission paid to AFF-SEA-114: $31,200, with fraud volume escalating each month. Recommend immediate suspension with full evidence packaging and opening a prior-cycle fraud review given the escalating pattern across all four months.

Gaming Mind assembled the full exposure in one view. Commissions already paid in prior cycles to AFF-SEA-114: $31,200 — though prior cycles may have contained the same fraud pattern at lower volume, making the total fraud exposure potentially higher. Current-cycle commission accrued and unpaid: $18,037, with $13,939 clawback-eligible under the standard affiliate agreement's fraud clause. GGR contribution from the 263 device-farm accounts: negligible — $214 in aggregate wagers across all accounts combined, most of it from bonus abuse on the nineteen legitimate depositors. The fake accounts had generated essentially zero real revenue while costing ArcPlay nearly $14K in accrued commission. Gaming Mind flagged the partner's fraud score as the highest recorded in ArcPlay's affiliate network and recommended immediate suspension with evidence packaging.

---

Ryan: "Put together a suspension summary I can send to the payments team and our affiliate compliance lead."

AFF-SEA-114 — Suspension Evidence Package

Field	Detail
Affiliate ID	AFF-SEA-114
Detection timestamp	[Current date], Thursday 14:47 local
Billing cycle registrations	340
Legitimate FTDs confirmed	19 (5.9% conversion rate)
Network median FTD rate	43%
Statistical anomaly probability	< 0.3% by random variance

Device Farm Evidence

Evidence Type	Finding
Unique device signatures across 263 accounts	14
Avg accounts per device	18.8
IP subnets	3 × /24 (Metro Manila data center)
Legitimate depositor IP origin	Distinct residential, Luzon + Visayas
Device overlap classification	🔴 Confirmed device farm

Referral Chain Discrepancy

Finding	Detail
Disclosed traffic source	Facebook media buys — Filipino sports fans
Actual referral path (312 accounts)	Redirect chain through 2 undisclosed intermediate domains
Domains registered with ArcPlay compliance	No
Classification	Traffic broker arbitrage

Financial Exposure

Item	Amount
Clawback-eligible (current cycle, unpaid)	$13,939
Legitimate commission (current cycle)	$1,007
Prior-cycle commissions paid	$31,200
Contract clause authorizing clawback	Affiliate Agreement §8.3 — Fraudulent Traffic

Recommended Actions

Action	Owner	Timeline
Immediately suspend AFF-SEA-114 in partner portal	Ryan Santos	Now
Block current-cycle commission payout ($13,939)	Payments team	Today
Open prior-cycle fraud review	Finance / Compliance	48 hours
Quarantine and AML-flag 263 device-farm accounts	Compliance team	Today
Implement new FTD rate auto-hold threshold (< 15%)	Platform team	Next sprint

⚠️ Gaming Mind flags: The evidence package contains affiliate ID, fraud detection timestamp, registration volume and FTD anomaly, device farm evidence (263 accounts across 14 devices, data center IP clustering), referral chain discrepancy versus onboarding disclosure, full commission exposure breakdown, and the specific contract clause authorizing the clawback. The case is complete for suspension and clawback with no further investigation required.

Gaming Mind produced a structured evidence summary: affiliate ID and handle, fraud detection timestamp, registration volume and FTD anomaly, device farm evidence (263 accounts across 14 devices, data center IP clustering), referral chain discrepancy, commission exposure breakdown, and the specific clause in ArcPlay's affiliate agreement authorizing the clawback. Ryan exported the package as a PDF, forwarded it to the payments team and compliance lead with a single line — "recommend immediate suspension and clawback, full evidence attached" — and marked AFF-SEA-114 for review in the partner portal before he closed his laptop.

---

Results

One fraudulent affiliate identified and suspended in under 20 minutes

From the moment Ryan noticed the deposit rate anomaly to the moment he sent the suspension package, the entire investigation took nineteen minutes. No manual data exports, no querying the dev team for device logs, no waiting on the analytics lead to pull IP data from a separate system. The session was a single conversation.

$18K in fraudulent CPA commissions recovered

The payments team processed the clawback within forty-eight hours. The $13,939 in current-cycle commission that had accrued but not yet been paid was blocked. ArcPlay's finance team opened a recovery process on prior-cycle payouts to assess whether the same fraud pattern had inflated earlier commission claims — a review Gaming Mind's historical data made straightforward.

263 ghost accounts quarantined and flagged for AML review

The 263 device-farm accounts were suspended from the platform and flagged for AML review by ArcPlay's compliance team. Because the accounts had transacted minimal real funds, the risk was low — but the quarantine prevented any future bonus exploitation and removed them from active player counts that fed downstream reporting.

Fraud detection rules tightened across the network

Ryan worked with the platform team to implement two new automatic quality thresholds based on the investigation: any affiliate cohort with a 72-hour FTD rate below 15% now triggers an automatic hold on commission accrual pending review, and any cohort where more than 10% of accounts share device fingerprints flags for Device Intelligence audit before payout. Two other affiliates were flagged in the following month's cycle under the new rules, both confirmed as low-grade traffic arbitrage rather than coordinated fraud.

A process that had no process is now systematized

Before this investigation, ArcPlay's fraud detection for affiliates was Ryan eyeballing spreadsheets before payout runs. The investigation made clear that the signal had been present in prior months — a pattern visible in retrospect — but no one had a fast enough way to act on it. Gaming Mind's Affiliate Audit module is now part of Ryan's weekly Thursday review, not a one-off response to a gut feeling.

"I've been in affiliate management for six years. I've caught bad partners before, but it usually meant a two-day back-and-forth with the dev team, a lot of emails, and arguing over whether we had enough evidence to pull the trigger. This time I had everything I needed in twenty minutes — device data, financial exposure, the specific contract clause. The affiliate's legal team couldn't dispute it. There was nothing to dispute."

— Ryan Santos, Affiliate Manager, ArcPlay