Referral Abuse
Self-referral, referral rings, farmed referees and publicly broadcast codes that convert refer-a-friend incentives into cash, stock or credits without acquiring genuine customers.
What it is
Referral programs pay existing users to bring in new ones. Usually both the referrer and the referee get paid, sometimes with tiered milestones for prolific referrers. Abuse happens when the referral relationship is manufactured: the referee is the referrer under another identity, a farmed account, a synthetic identity, or a real person paid to sign up and leave.
Referral abuse differs from Sign-Up Bonus Abuse in one important way: there's a graph. Every reward is an edge between two accounts, so the abuser has to create links you can see. That's why Referral Graph Patterns and Graph Analytics are the center of the defense.
The incentive is real money. As an illustration of current program design, a major U.S. brokerage's public referral terms (2026) pay stock rewards at milestones ($50 for one qualifying referral, up to $10,000 at 200) with a $15,000 annual cap per person. The terms require the referee to be a new customer with a settled deposit. Rewards can be sold after three trading days, but the cash value can't be withdrawn for 60 days. The terms explicitly name fabricated referrals, duplicate or fake accounts, and automated referral generation as grounds for rescinding rewards. Each of those clauses is a control on a known pattern.
How it works
Abuse usually takes one of these forms:
- Self-referral. One person refers their own alternate accounts. Low volume, high frequency, mostly first-party.
- Referral rings and chains. Coordinated groups refer each other in loops or chains so each member collects both sides. The graph shows dense, reciprocal, or tree-like structures with shared attributes.
- Farm-backed referral trees. One referrer at the root of many farmed referee accounts. It depends on Fake Account Creation (Bots), Device Farms and Emulators and, at regulated firms, identities that pass KYC and Customer Identification Program (CIP) (Synthetic Identity Fraud, stolen identities, or recruited real people).
- Code broadcasting. Posting referral codes publicly to harvest strangers. Whether this counts as abuse depends on your terms. One widely cited case had a single user reportedly accumulate about £50,000 in ride credits by posting a referral code online (Ravelin). The referees there do nothing wrong; the loss is that the program pays for customers it would have gotten anyway.
- Recruited referees. Real people paid a share of the reward to open accounts and meet the minimum. They pass identity checks because they're real. This shades into Money Mules when the accounts get reused.
Transaction footprint
The qualifying action is where the money path starts, and where funding risk crosses into referral risk.
| Stage | What you see in the data | Decision point |
|---|---|---|
| Referral link | Code use, referrer-referee timing, landing context | Is the referrer eligible? Is the referrer's cohort already suspicious? |
| Referee onboarding | Device, network, contact and identity attributes; similarity to referrer | Link the referee to the referrer? Step up identity verification? |
| Qualifying action | Funding source (shared with referrer? newly linked?), amount at or barely above the minimum, first-trade or first-purchase pattern | Count it as qualifying? Wait for settlement? |
| Reward credit | Referrer and referee rewards; milestone progress | Pending vs. available; per-person caps |
| Post-reward | Referee activity after reward; reversal of funding; dormancy | Clawback if the funding reverses or the referee is linked |
| Payout | Referrer withdrawal; pooling of referee balances into referrer | Release, hold, or step-up on cluster risk |
Three parts of the money path matter most:
- Qualifying-deposit risk is a funding-fraud problem. If a referee's qualifying deposit comes through an unverified external account, the reward can pay out before the deposit settles or gets returned (see ACH Funding Fraud, Instant Funding Abuse (Kiting)). That's why public terms require a deposit that settles and isn't reversed.
- In circular funding, the same funds move from referrer to referee, qualify, and move back. A Funding Source Signals view (shared bank accounts, same-day round trips) catches what device linkage misses.
- The ring's profit is realized when referee rewards consolidate. That pooling happens through P2P transfers, gift card purchases, or the referee's own withdrawal to a shared destination (Withdrawal and Payout Controls).
Common variants
| Variant | Industry where it bites | What's different |
|---|---|---|
| Cashback app referral (cash or points both sides) | Cashback, Coupons and Rewards | Qualifying action is a receipt or first purchase, so it overlaps Receipt Fraud (Cashback) |
| Neobank referral (cash on direct deposit) | Neobanks and Consumer Fintech | "Direct deposit" classification can be looser than the name implies, which weakens the qualifying signal |
| Brokerage referral (free stock) | Brokerage and Investing | KYC required; reward is a security with sale and withdrawal restrictions |
| P2P/payments referral (cash on first send) | Payments and P2P | Qualifying action can be a self-transfer between linked accounts |
| Marketplace two-sided referral | Online Marketplaces | Buyer-seller collusion (fake orders between referrer and referee) |
| Gig and delivery referral | Gig platforms | Driver/courier referral bonuses tied to trip counts; collusive trip generation |
At a cashback app, the ring needs receipts and devices; the reward is small and the cash-out is a gift card. At a neobank, the ring needs identities that pass CIP and an external account to fund from; the reward is larger and the cash-out is ACH or P2P. The graph looks the same on both sides of the house. The bottleneck resource differs: devices and evidence on the retail side, identities and funding sources on the financial side. Put your strongest control on that bottleneck.
Where it shows up
- High-acquisition-spend growth stages. Referral abuse peaks when growth teams raise rewards. Check with New Product and Promo Launch Review before changing reward levels.
- Lifecycle. Onboarding (linking referee to referrer), funding (qualifying deposit), rewards (crediting), payout (cash-out). See Customer Lifecycle Map.
Impact
- Direct reward loss on non-genuine referees, often doubled because both sides get paid.
- Inflated acquisition metrics. A widely reported 2022 example: PayPal disclosed it had identified about 4.5 million accounts it believed were illegitimately created to farm incentive campaigns (Fintech Business Weekly). Abuse at that scale distorts user counts, CAC and lifetime-value models, and growth decisions built on them.
- Downstream fraud exposure. Farmed referee accounts that pass KYC become Money Mules or resale inventory (Account Farming and Resale).
- Regulatory and tax noise. Rewards may be reportable income (brokerages note rewards may appear on a 1099). Clawbacks and voided accounts create support and reporting work.
Red flags
- Referrer and referee share devices, networks, contact patterns or identity elements → Device Reputation and Linkage, Identity Element Consistency
- Referral trees that are deep, fast-growing or star-shaped with similar attributes → Referral Graph Patterns
- Referee funding from a source tied to the referrer, or funding at exactly the minimum → Funding Source Signals
- Referees inactive after the qualifying action; rewards withdrawn quickly → Customer Tenure and History, Fast In Fast Out Patterns
- Disposable or patterned emails and phone numbers among referees → Email Risk Signals, Phone Risk Signals
- A referrer's earnings concentrated right before an annual cap or milestone → Promo and Reward Redemption Patterns
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Referral Program Controls | Per-person caps, referee eligibility rules, qualifying actions that cost real effort, restrictions on public broadcasting |
| Prevent | Promotion Design Guardrails | Tie rewards to sustained activity that a script can't complete in one action |
| Prevent | Bank Account Ownership Verification, KYC and Customer Identification Program (CIP) | Raises the cost of farmed referees on financial products |
| Detect | Graph Analytics on Referral Graph Patterns | Finds rings, trees and reciprocal structures |
| Detect | Entity Link Analysis | Links referrer and referee through shared attributes |
| Respond | Reward Vesting and Clawback | Holds and withdrawal delays (like the 60-day example above) let funding settle and links show up |
| Respond | Withdrawal and Payout Controls | Holds referrer payouts when the referee cluster is high-risk |
Emerging variants and adversary adaptation
- As fintechs tighten device and email checks, rings shift to identities that pass KYC: recruited real people and synthetic identities. Detection has to move from device graphs to identity and funding graphs (Synthetic Identity Fraud).
- Rings learn that dense, obvious structures get caught and spread referrals across more referrers with fewer referees each. Compensate by linking on funding, payout and identity attributes as well as the referral edge.
- Tiered programs with large top milestones concentrate abuse at the threshold. Watch referrers approaching milestones the way you'd watch a balance approaching a payout threshold.
- The same farmed identities hit many fintech referral programs in sequence, which raises the value of Consortium and Data Sharing and External Intelligence Feeds.
- Likely next are AI-generated personas and agents. Automated persona creation and agents completing qualifying actions at scale will lower the cost of farm-backed referral trees (Generative AI and Deepfake Fraud, Agentic Commerce Fraud).
Related mechanisms
- Sign-Up Bonus Abuse: the referee side often doubles as bonus abuse
- Multi-Accounting and Fake Account Creation (Bots): the account supply
- Account Farming and Resale: farmed referees as inventory
- Fraud Rings and Collusion: ring structure and takedown
- Promo Code Abuse: referral codes as promo codes
Real-world examples
- PayPal's 2022 disclosure of about 4.5 million illegitimately created accounts linked to incentive campaigns (Fintech Business Weekly).
- One user reportedly earned about £50,000 in ride credits by publicly posting a referral code (Ravelin).
- Neobank referral offers whose "direct deposit" requirement was reportedly weaker in practice than its name implied (Fintech Business Weekly, 2022). Check that your qualifying actions measure what they claim to.
Sources and further reading
- Robinhood Tiered Referrals Program terms (2026): milestone rewards, settled-deposit requirement, sale and withdrawal holds, annual cap, abuse provisions
- Fighting fraud with SentiLink (Fintech Business Weekly, Feb 2022): PayPal's 4.5M illegitimate accounts; neobank referral and direct-deposit requirement weaknesses
- Why is promotion abuse a problem for online businesses? (Ravelin): referral abuse types; £50k referral-credit example; merchant survey data
- Bonus abuse (Sardine): linking accounts, per-identity caps, withdrawal holdbacks (vendor source)
- How food delivery fraud happens (Bureau): circular referral networks; customer-courier collusion (vendor source)