Referral Graph Patterns
The shape of who-referred-whom networks (tree depth, fan-out, conversion timing and shared attributes between referrers and referees), used to separate organic word-of-mouth from self-referral and rings.
What it measures
A referral program writes a directed graph: each edge says "this account brought in that account". The graph carries signal in four layers:
| Layer | Features |
|---|---|
| Edge-level similarity | Referrer and referee share device, IP, address, payment instrument, payout destination, name pattern or email pattern; referee created minutes after referral link generated; referee onboarded on the referrer's device |
| Node-level fan-out | Referrals per referrer over time; bursts; conversion rate of referees; share of referees that complete only the minimum qualifying action |
| Tree shape | Depth (chains A→B→C→D), breadth, symmetric or reciprocal referrals, star-shaped hubs with dozens of short-lived leaves |
| Post-referral behavior | Referee activity after the bonus vests (real customers keep transacting, farmed referees go dormant); referee payout destinations overlapping with the referrer's |
Why it matters
Referral incentives pay out per new account, so they are the most direct way to convert fake account creation into cash. They are also hard to police with account-level signals: each referee is a new account with no history, and each referral is individually plausible. The controller shows up in the referral graph as a hub of near-identical leaves, a chain of accounts that each referred one other and then stopped, or referees whose bonuses end up at the same destination as the referrer's.
By industry: in Neobanks and Consumer Fintech and Brokerage and Investing, referral cash or free stock typically vests after the referee funds the account, so referral rings tie into Funding Source Signals (the same bank account funding many referees); in Cashback, Coupons and Rewards, the bonus vests after a first receipt or purchase; in Payments and P2P, after a first send, which can be a round trip back to the referrer; in Online Marketplaces and ride/delivery-style apps, buyer and seller referral credits create collusive pairs.
How to collect it
- Persist every referral event with link generation time, click/install time, sign-up time, qualifying-action time and reward grant/vest/redeem times.
- Attach the referrer and referee to the shared entity graph (Entity Link Analysis) so edge-level similarity can be computed on devices, instruments, destinations and addresses.
- Track referral source channel (personal share vs. public post vs. affiliate). Public posts produce legitimately large fan-out.
- Built in-house: referral logic is product-specific. Device and identity linkage inputs may come from vendors.
How to use it
- Score the edge at reward time: high referrer–referee similarity (same device, same payout destination, same funding source) is the strongest single pattern, because it is self-referral in all but name.
- Score the referrer: fan-out bursts, low referee retention and high share of minimum-qualifying referees → hold referrer rewards pending review (Reward Vesting and Clawback).
- Score the tree: flag components with farm shape (many leaves, uniform creation timing, shared cash-out endpoints) for ring investigation (Playbook - Referral Abuse Members).
- Combine with Promo and Reward Redemption Patterns: farmed referees typically complete the minimum qualifying action, redeem, and go dormant.
- Feed design: tie rewards to genuine engagement (vesting periods, multi-action qualification, caps per referrer), see Referral Program Controls and Promotion Design Guardrails.
Strengths and limitations
Strengths: directly targets the incentive mechanism; cluster-level view catches farms that account-level signals miss; reward vesting gives time to observe post-referral behavior.
Limitations: individual similarity signals can be degraded by organized operations, though multi-signal linkage and post-referral behavior compensate. Legitimate viral growth looks like fan-out. Programs that pay instantly leave no time for graph signals to mature.
False positives and fairness
- Influencers, creators and community leaders with large legitimate audiences.
- Families and roommates who refer each other and share devices, Wi-Fi and addresses.
- Workplace or campus referrals clustered on the same network.
- Small business owners referring employees to a payroll-linked product.
- Deal-community members who share referral codes publicly within program terms.
Define allowed sharing channels in the terms and differentiate reward caps from fraud enforcement.
Privacy and compliance considerations
Clawing back referral rewards should rest on clear, disclosed terms; CFPB Circular 2024-07 warns that revoking rewards under vague "abuse" clauses may be unfair or deceptive. Referral rewards may be taxable income; brokerages and banks should coordinate with tax reporting. Referral data reveals social connections, so handle it with care in reviewer tooling. See Privacy and Data Use in Fraud Prevention.
Mechanisms it helps detect
Referral Abuse · Multi-Accounting · Sign-Up Bonus Abuse · Fake Account Creation (Bots) · Account Farming and Resale · Fraud Rings and Collusion · Device Farms and Emulators
Related signals and controls
Entity Link Analysis · Device Reputation and Linkage · Promo and Reward Redemption Patterns · Customer Tenure and History · Referral Program Controls · Reward Vesting and Clawback · Graph Analytics · Playbook - Referral Abuse Members · Playbook - Multi-Accounting and Linkage Members
Sources and further reading
- CFPB Circular 2024-07: Rewards programs: limits on revoking rewards under vague terms; hidden bonus limits.
- FINRA Regulatory Notice 22-25: shared referral sources and attributes as signs of centrally controlled accounts.