Antifraud

About Antifraud

Anti-Fraud is a system designed to detect and prevent fraud in affiliate and partner marketing. Scammers are always finding new ways to trick advertisers and affiliate networks. They use methods like creating fake traffic from bot farms, fake registrations, and even viruses that infect users’ networks. These activities hurt businesses by reducing profits and damaging trust between partners. How Anti-fraud works in UCLIQ To stop fraud, you need more than just a simple plugin that checks IP addresses. Modern fraud systems need to analyze traffic in real time using advanced tools. UCLIQ’s system does just that. It uses machine learning to analyze traffic, detect suspicious activity, and protect against fraud. Analysis, detection, and prevention UCLIQ analyzes incoming traffic with multiple checks. It doesn’t just rely on basic methods like checking IP addresses. Instead, it looks at detailed factors such as the device’s parameters, matching them with patterns of previous fraud attempts. Key steps: - Checking IP addresses for repeat visits and known click farms. - Analyzing device details to make sure they match real systems. - Comparing traffic patterns with historical data to detect suspicious activity. UCLIQ is fully integrated with the platform, so it can analyze traffic in real-time and use historical data to identify potential fraud. How fraud detection works: For each suspicious click, UCLIQ checks various features such as: - Using VPNs or bots (common in corporate networks). - Mismatch of connection type (e.g., VPN or emulator). - Repeated attempts from the same device. - Language mismatch (browser and IP). - Time zone mismatch (device and IP). - Touch support issues (emulator detection). - Repeated use of IP addresses. - Suspicious traffic sources (e.g., from social media or instant messengers). Each feature match adds risk points to the click. These risk points help UCLIQ identify high-risk traffic. Levels of fraud detection 1. At the click level: Traffic that matches suspicious patterns is sent to a fallback address, so it doesn't affect your campaigns. 2. At the advertiser's conversion level: If a conversion comes from a click with high risk points, the system will stop generating payouts for it and send it for manual review by the manager. 3. After generating payments to publishers: If the payment has already been processed, the system can cancel it if it detects fraud, ensuring that publishers are not paid for fraudulent conversions.

Publisher Risk Scoring

The Average risk score feature helps you understand if the traffic coming from a publisher looks suspicious or not. The system shows how often risky patterns were detected, how serious they are, and gives you a clear overview of each publisher’s traffic quality. This tool is used to: - Decide how many risk points are enough to flag or stop conversions - Turn on conversion hold if needed - Block specific publishers or subsources if their traffic doesn’t perform well on certain offers Here’s what each column means: - Publisher – the name of the partner sending traffic - Count – number of conversions - Triggered – how often risk patterns were triggered, shown in % - Avg – average risk score for their conversions Risk signals you’ll see in the report: - OS mismatch – device OS doesn’t match expected (likely emulator) - Connection type mismatch – traffic comes from unexpected network types (can be a fraud sign) - Language mismatch – device language doesn’t fit the geo (risk of fake users) - Autonomous system mismatch – likely traffic from data centers or bots - Same IP – too many conversions from the same IP - Duplicate fingerprint – same device fingerprint reused - Touch support – if there’s no touch support, could mean emulator - Motivated – traffic looks like it came from users who were incentivized - Timezone mismatch – time zone doesn’t match geo (common for spoofing) - Windows conversions – using tech like WinSock, which can be a red flagEvery incoming click is analyzed using the fraud detection system’s templates. When certain characteristics match known fraud indicators, the click is assigned a risk score. These characteristics can include things like IP address matches, device fingerprinting, and behavior that suggests fraudulent activity (e.g., VPN usage or emulation). The system assigns risk points based on how many of these indicators match. The more matches a click has with fraud patterns, the higher the risk score assigned to it. Publishers also accumulate risk points, which help determine the overall risk level of their traffic. Taking Action Based on Risk Scoring Data Once you've analyzed the publisher risk profile, you can take appropriate action based on the risk level: Blocking Publishers If a publisher consistently triggers fraud patterns and has a high average risk score, you may decide to block them from working with certain offers or from the platform entirely. This is done by reviewing their risk score and identifying any recurring fraud indicators. Blocking Sub-Sources For affiliate publishers, you may choose to block specific sub-sources that are generating poor-quality traffic or triggering frequent fraud patterns. This helps maintain the integrity of your campaigns without needing to block the entire publisher. Conversion Retention Mode If a publisher's traffic shows signs of potential fraud, you can enable Conversion Retention Mode, which temporarily holds conversions for review before they are processed. This helps prevent fraudulent conversions from being paid out.

Conversion Scoring

What Is Conversion Scoring? Conversion Scoring is a system that helps you evaluate the quality of your traffic by analyzing how well it converts. Instead of just looking at the number of clicks, it focuses on which sources bring engaged users who take valuable actions. Imagine you’re running an affiliate campaign for a subscription service. Two affiliates drive traffic to your offer: - Affiliate A brings 1,000 visitors, but only 5 sign up. - Affiliate B brings 300 visitors, but 50 sign up. Even though Affiliate A has more clicks, Affiliate B delivers better quality traffic. Conversion Scoring helps you identify these patterns automatically, so you can focus on high-value sources and optimize your marketing strategy. How Does Conversion Scoring Work? Ucliq analyzes multiple factors to assign a score to traffic sources based on their conversion behavior. These factors include: 1. Conversion Rate The percentage of visitors who complete the desired action. Higher conversion rates usually mean better quality traffic. 2. Funnel Progression Tracking user behavior through different steps of the funnel. For example, do visitors just click, or do they also sign up and make purchases? 3. Engagement Metrics How much time do users spend on the landing page? Do they interact with the content, or do they leave immediately? 4. Traffic Consistency Stable, high-quality traffic patterns get a better score, while sources with erratic performance score lower. 5. Fraud Detection Signals If a traffic source has suspiciously high clicks but very few conversions, it might be bot traffic or low-quality leads. How is the Score Assigned? Ucliq uses a proprietary algorithm to assign a score to each traffic source based on a weighted calculation of the factors mentioned above. The system continuously evaluates real-time data, updating scores dynamically as new information becomes available. The scoring process follows these key steps: Data Collection – Ucliq gathers information from user interactions, conversion data, and engagement metrics. Pattern Recognition – The algorithm detects trends, such as steady conversion rates or erratic spikes in traffic. Quality Assessment – Each traffic source is assessed based on fraud risk, engagement levels, and overall conversion effectiveness. Score Calculation – A weighted formula calculates the final score, ensuring the most critical factors have a higher impact. Continuous Updates – Scores are recalculated frequently to reflect changes in traffic quality and performance over time. Main features of the conversion scoring panel In this panel, you can see a list of conversions for a selected time period. You can filter these conversions by: Publishers Offers Advertisers Fraud patterns Retention status (whether the conversion is still under review) This panel helps the risk manager assess which conversions might be fraudulent. Here are the main fields you’ll see in the conversion list: - Publisher: The publisher’s username - Conversion IP: The IP address where the click originated - Fingerprint: A unique identifier for the originating click - Score: The risk score assigned to the conversion - Matches: Possible fraud patterns detected - Goal type: The conversion goal - Type: The type of conversion (sale, lead, etc.) - Sale: The conversion amount - Pub. amount: The payment amount generated for the publisher - OS: The operating system of the click's origin - Timezone: The time zone of the click's origin - Date: The date of the conversion - Actions: Option to approve or decline the conversion You can click on any conversion record for more details. Conversion dashboard tabs The conversion dashboard is organized into four tabs: 1. Overview and Device: Shows click details like fingerprint hash, click ID, IP, browser info, and operating system. 2. Conversion: Detailed information about the conversion, similar to the Analytics > Conversions section. 3. Operations: Shows advertiser postbacks related to the conversion. 4. Transactions: Details on payments made to the publisher. All this data is collected when the click happens and analyzed before it goes to the advertiser’s offer. Types of conversions Conversions in the system are categorized into two types: 1. Processed: These conversions have been automatically processed, and the publisher's payment is either already registered or added to the campaign balance. If you want to cancel a processed conversion, it will reduce the publisher's balance and generate a "decline" conversion. Cancellation options: None: No reason for cancellation Fraud: Conversion cancelled due to spam Motivated: Conversion cancelled due to fake traffic Duplicate: Conversion cancelled due to a duplicate offer Advertiser decline: Conversion cancelled due to the advertiser Test: Conversion cancelled due to a test offer 2. Held (Pending): These conversions are waiting for the risk manager's decision, and no payment has been generated yet. These conversions are marked with a clock icon. You can confirm or cancel them. Confirmation: If the risk manager deems the conversion legitimate, confirming it will trigger payment to the publisher or add it to the campaign balance for later payment. Cancellation: If the conversion is cancelled, no payment will be made, and the publisher won’t know that the conversion was cancelled. How to undo a cancellation If a cancellation was made by mistake, you can undo it in the canceled conversion and select the Confirm option. This will create a new payment to the publisher for the original amount.

Fraud Monitoring

Fraud Monitoring Dashboard Overview The Fraud Monitoring section provides a high-level overview of suspicious activity related to your conversions. It is designed to help you quickly detect and assess fraudulent traffic patterns and take necessary actions to protect your campaigns. This dashboard includes key data visualizations and indicators that show: - How many conversions were approved or declined - What types of fraud signals were detected - Which offers or countries may be affected You can select a custom date range or use predefined filters (e.g. last 7 days, today, last 30 days, etc.) to view the data. Approved / Declined Conversions At the top of the dashboard, there is a line graph that shows the number of approved (green) and declined (red) conversions over the selected period. This helps you monitor trends in traffic quality. A sudden increase in declined conversions may indicate fraudulent activity that requires further investigation. Detected Fraud Indicators This section displays a list of fraud detection triggers, each showing how many times a specific pattern has been flagged in the selected period. Here are the fraud signals explained: - Autonomous system mismatch – Traffic may originate from known data centers, often associated with bot activity. - Connection type mismatch – The internet connection type does not align with typical user behavior (e.g. unexpected proxy or VPN use). - Duplicate fingerprint – The same device fingerprint appears across multiple conversions. - Language mismatch – The user’s device language does not match the expected language for the offer’s target region. - Motivated source – Traffic appears to be incentivized, which may lower conversion quality. - OS mismatch – The user’s device operating system is inconsistent with expected values, often a sign of emulated devices. - Same IP – Repeated use of the same IP address for conversions, which may indicate automated or fraudulent activity. - Timezone mismatch – The user’s time zone does not match the geo targeted by the offer. - Touch support mismatch – The system detects that a device does not support touch input, which may suggest the use of a desktop emulator. These indicators help you understand why certain conversions are being flagged and what type of fraud may be occurring. Top Sales Countries This section includes a visual breakdown of traffic by country, shown as a circular chart. You can filter the view to display: - All traffic - Only approved conversions - Only declined conversions This helps you identify which regions may be associated with suspicious activity. Top 10 Suspicious Offers At the bottom of the dashboard, you’ll find a table listing up to ten offers with the highest levels of suspicious activity. You can switch between viewing: - Offers with high fraud rates - Publishers involved in these conversions This section is useful for prioritizing which offers or partners to review more closely. The Fraud Monitoring dashboard helps you: - Monitor traffic quality over time - Understand the reasons conversions are being declined - Detect patterns of fraud by region, offer, or partner - Take timely action, such as blocking traffic sources or applying stricter conversion checks It is recommended to check this dashboard regularly to ensure ongoing traffic quality and campaign