Affiliate fraud means generating paid events dishonestly: fake or self-referred accounts, forced cookies, bought or incentivised sign-ups, or traffic taken from your own brand searches. Bonus abuse is the player-side version, where accounts exist to extract offers rather than to play. Both are worth catching. Neither is worth catching by treating every affiliate as a suspect.

This guide lists what large programmes' published terms prohibit (read in October 2026), the signals each type leaves, and how to investigate without punishing the honest majority.

What programme terms prohibit

We read the terms of eight programmes: bet365, Entain, 888, FDJ United, LeoVegas, William Hill, Rank and Super Partners. The prohibitions fall into a small number of types.

Type What it looks like Examples in published terms
Brand bidding Paid search ads on your brand name, taking customers already looking for you Banned by all eight. bet365 bans keywords "identical or similar to" its marks; Entain 5.14(b); 888 3.11; William Hill 5.20; Rank 6.2 and 9.3; LeoVegas 4.16
Restricted keywords Targeting terms on an industry blacklist, or aimed at vulnerable people 888 (3.12) and William Hill (5.20) ban the UK Industry Keyword Black List; Entain bans keywords such as "self-excluded" or "GAMSTOP" (5.15(l))
Incentivised traffic Paying or rewarding people to sign up, including sharing the CPA with them Entain 5.15(a); FDJ United 3.9(1); Super Partners pays for no incentivised traffic "in any form"; 888 counts unauthorised rakeback as fraud (5.20)
Self-referral The affiliate, staff or family signing up through their own links bet365; Entain 5.15(r); 888 4.4; FDJ United 3.8; Rank; Super Partners
Cookie stuffing and forced clicks Cookies dropped on impressions, sites opened without a click, others' traffic redirected Entain 5.15(g), (i) and (j); FDJ United 3.9(7) and 3.9(9)
Fake or low-intent registrations Accounts made to trigger CPA with no intent to play Entain bans "creation of false accounts"; Rank 7.10; 888 allows one Lead per household device (4.5)
Bonus abuse and advantage play Promoting matched betting, arbitrage or bonus extraction; organised players betting both sides bet365 cites "different customers betting both sides of an event"; 888 5.20; FDJ United 3.9(15); LeoVegas 4.11.1
Collusion and multiple accounts Working with players or other affiliates to shift commission FDJ United bans using multiple sites or accounts "to hedge bets, offset losses" (3.9(8)) and more than one account without approval (3.9(10))
Other channels Spam, scraping, lookalike domains bet365, Entain and FDJ United on spam; bet365 on scraping; bet365 and Entain 5.14(a) on lookalike domains

One exception is worth knowing. Rank lets affiliates run cash-back schemes "as long as such schemes are organised, managed and funded by the Affiliate" (clause 8.1). Incentives are a policy choice, not a universal rule, so say clearly which you allow.

Signals worth watching

Each type leaves traces in data you already hold. None of these proves anything alone; they tell you where to look.

  • Your brand terms showing an ad that lands through an affiliate link
  • Sudden branded traffic from a partner who runs PPC on generic terms

In the funnel

  • Clicks with no matching page views, or registrations with no click before them
  • Many registrations from one device, address or payment method
  • A spike in registrations that stops at the minimum deposit and the CPA baseline
  • Registrations sharing details with the affiliate's own account

In player behaviour

  • Players who deposit, claim a bonus, meet wagering and withdraw, with no later play
  • Linked accounts placing opposite bets on the same event
  • Chargebacks on first deposits, which 888's terms list as fraud (clause 5.20)

Investigating fairly

Most affiliates who send odd-looking traffic are not committing fraud. Their traffic may have changed, a player group may be abusing bonuses without the affiliate's knowledge, or your own tracking may be at fault. Investigate the evidence, not the partner.

  1. Separate player abuse from affiliate fraud. A group of bonus abusers arriving through a site does not mean the site owner recruited them. Act on the accounts first.
  2. Check your own side. Tracking breaks too. Safari caps cookies set by scripts to seven days (WebKit, ITP 2.1), so a returning player may lose their link to the affiliate. Rule out your faults before you blame theirs.
  3. Hold only what is affected. Entain's terms let it void or withhold money gained through a breach (5.16). That scope, limited to what the breach produced, is fairer than freezing a whole balance.
  4. Set a time limit. 888 publishes an upper bound: fraud reviews of up to 180 days (clause 5.19). Publish yours, and close reviews early when you can.
  5. Tell the affiliate what you found. Name the accounts, the rule and the evidence. Give them a chance to explain or remove a source.
  6. Record the outcome. Note what was held, what was released and why. It becomes your precedent.

Affiliate view

Most writing on affiliate fraud treats us as the suspect. From our side, the common problems look different: players we sent who never appear in reports, terms changed after the fact, and whole balances frozen over a handful of accounts. A fair process shows us the evidence and holds only what it covers.

Remedies in published terms

The programmes we read use three remedies, often together:

  • Withholding. bet365 may keep amounts where it has "reasonable cause to believe" traffic was not generated in good faith. FDJ United (6.7) and LeoVegas (5.3.3) can withhold CPA for accounts flagged for bonus abuse or fraud.
  • Clawback and set-off. Entain can set off past payments from prohibited activity (9.8); 888 can set off fraud-generated amounts (5.19); Super Partners may pass on the financial costs of fraudulent activity.
  • Termination. Closing the account, in serious or repeated cases.

Match the remedy to the case. Withholding a CPA for one abused bonus is proportionate. Terminating a long-standing partner over the same thing usually isn't.

Why operators must police this in Great Britain

In Great Britain, the Gambling Commission makes operators answerable for their affiliates. Licence condition 1.1.2 states: "Licensees are responsible for the actions of third parties with whom they contract for the provision of any aspect of the licensee's business related to the licensed activities." Contracts must require those third parties to act as if bound by the same conditions, and must allow prompt termination. That wording was read on the Commission's website in October 2026.

This is why fraud and compliance controls belong in the same programme. A partner who bids on your brand may also be running ads you would never approve. For the regulator's own explanation, read the Commission's page on affiliates or third parties. This guide is not legal advice.

Operator view

Our licence is on the line for what affiliates do in our name. That is why we act quickly, and why we need terms that let us act without arguing about whether we're allowed to.

What to put in your terms

  • A list of prohibited activity, with each type defined in plain words
  • Your position on incentives and cash-back, stated either way
  • Brand and restricted keyword rules, including how affiliates get the list
  • Self-referral rules covering staff, family and housemates
  • One-account rules, and how to request a second account
  • What you may withhold, for which reasons, and for how long
  • What you will show the affiliate when you withhold
  • Set-off and clawback rules, limited to amounts the breach produced
  • A route for the affiliate to respond before termination, except where the law or your licence requires faster action

Checklist

  • Monitor brand-term search results for affiliate links
  • Flag device, address and payment overlaps at registration
  • Watch minimum-deposit-only patterns against CPA baselines
  • Check your own tracking before suspecting an affiliate
  • Hold only affected amounts, with a stated end date
  • Share evidence, then record the outcome

Vetting before approval prevents much of this. See How to vet affiliates.

Sources

  1. bet365 Partners terms and conditions
  2. Entain Partners terms
  3. 888 Affiliates terms and conditions
  4. FDJ United Affiliates global terms, March 2026
  5. LeoVegas Affiliates terms and conditions
  6. William Hill Affiliates terms
  7. Rank Affiliates terms
  8. Super Partners terms
  9. Gambling Commission: LCCP condition 1.1.2, responsibility for third parties
  10. Gambling Commission: affiliates or third parties
  11. WebKit: Intelligent Tracking Prevention 2.1

Checked 4 October 2026. Rules change: check the regulator’s own guidance before acting. How we research and correct our guides.

Terms in this guide

Written by

Steve Evans, Editor

I’ve worked in, and somehow survived, over 25 years in the gambling and iGaming industries, covering pretty much everything from horse racing and sportsbooks to casinos, lotteries, tech, marketing and media.

LinkedIn · More from Steve