How fraud scores are calculated

Every lead gets a score from 0 to 100 and a risk level derived from it: 0–29 is low, 30–64 is medium, 65 and above is high. The score is a weighted average of every detection rule that had enough data to run on that lead.

Open any lead from the Lead report and the Why this score section shows exactly how its score was reached: which rules ran, which ones flagged and why, where it falls on the Low/Medium/High scale, and whether a list match decided the result.

Every plan runs the same 8 core rules on every upload. Basic, Medium and High: everyone gets full detection on a single upload's own data.

Core rules — every plan

• Time-to-convert outlier — flags conversions that happen implausibly fast after the click (or with a negative time-to-convert, which shouldn't be possible).
• Duplicate detection — flags leads that share an email or phone number with another lead, in the same upload or in any earlier upload on your account. The more times a value has appeared in total, the higher it scores.
• Duplicate lead, same affiliate & offer — a narrower, stronger version of duplicate detection: flags the same email or phone converting more than once for the same affiliate on the same offer.
• Gibberish/disposable email — flags known disposable-email domains and local parts that look auto-generated rather than typed by a person.
• Conversion velocity spike — flags an hour where one affiliate's conversions spike well above their own normal pace elsewhere in the same file.
• Email pattern detection — catches two addresses that resolve to the same inbox once dots and +tags are stripped, and several addresses on one domain sharing a base with a trailing counter (name1@, name2@, name3@).
• Completeness score — flags a lead missing fields (phone, IP, name) that the same affiliate normally fills in on their other leads in the file.
• Blacklist match / allowlist match — if you checked one or more of your lists on that upload, any lead whose email, phone, IP address, or name matches an entry is flagged (blacklist) or cleared (allowlist). See Managing blacklists.

Advanced rules — Medium and High plans

Medium and High also run 6 rules that need this account's own history across uploads to say anything meaningful, not just the one file you're scoring right now:

• Relative affiliate benchmarking — flags an affiliate whose own flagged rate on an offer runs well ahead of every other affiliate running that same offer.
• Shared-IP rings — flags an IP address that several distinct email addresses convert from.
• Interval regularity — flags one affiliate's conversions landing suspiciously close to a fixed interval apart, the way a script would produce and a real person wouldn't.
• Repeat offender — flags a lead whose email, phone, or IP already scored High risk on an earlier upload for this account.
• Payout outlier — flags a payout well above what's typical for its offer.
• Conversion time, relative to this offer — flags a lead that converted much faster than typical for this specific offer, even when it clears the fixed time-to-convert rule above.