Every traffic source shows you numbers in its own dashboard, and those numbers are almost always prettier than reality. More clicks than people, more registrations than players, deposits that never repeat. Fraud doesn’t get its own line in the report. It hides in the gap between what the source reported and what you see in your funnel, and you pay for that gap out of your own margin. Below: how to spot the gap before the source does, and read traffic quality with your own eyes instead of the eyes of whoever is selling it. Alanbase works as the layer that keeps your statistics next to the source’s numbers in real time, so the discrepancy shows up at once.

What’s inside:

• why a source’s stats are structurally inflated, and when it isn’t deliberate
• where fraud hides at each funnel stage, with the logic worked through on numbers
• how to reconcile a source’s stats against your own: three checks that catch padding
• a red-flags checklist you can apply on your next buy

Why someone else’s numbers look better than yours

A source earns on the volume it ships you. Its success metric is clicks, impressions, sometimes registrations. Yours is deposits, retention, and LTV. The two coordinate systems don’t line up, and everything settles into the gap between them: honest under-optimization and outright padding alike.

Separate two cases. In the first, the source simply doesn’t clean its placements: bot and low-quality clicks get mixed in, and the network has no reason to look while you keep paying. In the second, quality drops exactly when you scale: clean on the test, then “manual reconciliations” and slippage on volume. For you as the buyer the conclusion is the same in both cases: trust only the numbers that line up with your own funnel.

Where fraud hides: a walk through the funnel stages

Fraud rarely shows in a single metric. Look for it in the transitions between stages, where traffic should thin out for understandable human reasons and instead behaves unnaturally. Four typical gaps below. The numbers in the examples are illustrative, but the proportions come from real traffic behavior in gambling and betting, so carry the logic over to your own data.

Stage 1. Click → registration: a suspiciously smooth picture

The source reported 12,000 clicks and a 9% CTR while your average for this geo and format runs around 2.5%. 480 registrations, and 70% of them landed in the first eight minutes after the click, in an even stream minute by minute. A real person doesn’t behave like that. Real registrations spread across hours: someone left to think, someone got distracted, someone came back in the evening. A perfectly flat click-to-reg curve and an abnormal CTR give away auto-fill.

What to measure: not the absolute number of registrations, but the shape of the curve over time and CTR against your own geo norm.

Stage 2. Registration → deposit: real forms, no real people

Registration approval is 95%, forms filled in correctly, data valid. But only 0.4% reach a first deposit against your norm of 4-6%. The forms hold real data, and there is no person behind them: there is a worker who got paid for a completed form. High reg approval with a failed deposit is one of the most common signals of incentivized traffic.

What to measure: the share reaching FTD, not the quality of the registrations themselves. A clean form says nothing about intent.

Stage 3. Deposit → retention: money that comes in once

The most expensive fraud hides here, because it passes the FTD check. Deposit conversion looks normal, say 5%, average deposit $20. But D1 retention is 2%, near zero by D7, no repeat deposits. The player made one deposit and disappeared.

The archetype of this gap is working with local partners in a new geo. It is easier for them to ask friends to make a deposit and earn on their own payout than to bring real traffic. One “deposit-for-payout” cycle looks like a win in the source’s report and like a player who never existed in your cohort. That is why a prepay model works against you almost by default when you enter an unfamiliar geo, while revshare filters out anyone counting on a one-off pad.

What to measure: retention and repeat deposits by the source’s cohort, not a one-time FTD. A source that is strong on the first deposit and empty on the second is selling you transactions, not players.

Stage 4. Technical signals: uniformity where there should be variety

A real audience varies across devices, OS versions, and browsers. When 80% of traffic comes from one device model or one system version, and a noticeable share of IPs belongs to data centers rather than mobile carriers, you are looking at an emulator or a single farm posing as live people.

You cannot build this view if the user-agent gets lost along the way. So pass the {useragent} macro into your postback: it sends the user’s device and browser straight into your analytics and gives your anti-fraud an extra signal you can use to flag uniform farms early.

How to reconcile: three checks that catch padding

You cannot catch fraud with one button. One method: you put every external number next to your own. Three checks cover most cases.

1. Source volume against your unique users.

Dedupe traffic by device and IP and compare it to your own unique count. If the source reports noticeably more than you have live devices, the difference is duplicates and padding you pay for as people.

2. Source approval against your retention.

The source is proud of its high registration approval. Put your D7 retention next to it. High approval with dead retention means the traffic looks good at the door and runs empty over distance.

3. The conversion-over-time curve against human distribution.

Real human actions spread across the day with understandable peaks. Instant or perfectly flat curves are a machine signature. This view is easiest to read when the source’s stats and yours sit in one window and update in real time, instead of getting assembled by hand after the fact.

Reconciliation exists for one thing: so you make scaling decisions on your own numbers. Once your funnel and the source’s stats sit side by side, a discrepancy becomes a management signal you can see in advance.

Checklist: red flags of a source

Nine signals worth running on every new buy. One flag is a reason to look closer, two or three together are a reason not to scale until you have dug in.

• CTR 2-4x above your geo norm. Almost always auto-clicks or a bot farm, a live user doesn’t click that often. Check the source’s CTR against your own average for this geo and format before you trust the volume.
• 70-90% of registrations arrive in the first minutes after the click. People take time to decide, and an even or instant spike is the signature of auto-fill. Build the click-to-reg curve by minute and machine uniformity shows up at once.
• High registration approval, but deposit conversion several times below norm. The forms are real, the intent to play behind them is not. Look at the share reaching the first deposit, not the quality of the registrations.
• Normal first deposit, but D1/D7 near zero. A sign of one-off “friendly” deposits made for the partner’s payout. Count retention and repeat deposits by the source’s cohort, not just FTD.
• 80% or more of traffic from one device model or OS version. A real audience varies, uniformity points to an emulator or a single farm. Pass {useragent} into the postback and build a device breakdown.
• A noticeable share of IPs from data centers and hosting. Server traffic posing as mobile. Filter by IP type and check it against the geography of real deposits.
• Source volume noticeably above your unique users. Click padding or duplicates of one device that you pay for as people. Dedupe by device and IP and compare to your own uniques.
• A local partner in a new geo insists on prepay. The classic fraud risk at launch. Keep revshare at the entrance until the traffic proves its quality over distance.
• Conversion drops sharply right as volume grows. Quality on the test that disappears at scale is a typical sign of mixed-in traffic. Hold the budget until retention on large numbers repeats the test.

Conclusion

Another anti-fraud module will not close this, and a pretty source dashboard will not cancel it. Discipline solves it: you check every external number against your own. The gap between the source’s report and your funnel is your money. Either you lose it quietly, or you turn the discrepancy into a management decision. The difference is whether you spot the gap first or last.

Alanbase pulls your statistics and source data into one window, with a device breakdown through {useragent}, traffic segmentation, and real-time reconciliation, so anomalies surface before they eat your margin. Want to see how it looks on your funnel? Book a demo call with an Alanbase manager: we will gather your requirements and show you how to read traffic quality with your own eyes.

Alanbase · alanbase.com