Encrypted parameters, single use nonces, velocity, fan out, bot, signature, geo and duplicate checks, every block logged with a reason.
Affiliate fraud is not usually dramatic. It is a slow drip of clicks that never had a human behind them, conversions fired twice, links replayed from a script, traffic from countries the offer does not take. Offer Capsule screens every click and every conversion against a stack of checks, and - this is the part that matters when the money is disputed - it records what it found. Nothing is silently dropped. Every attempt, including the ones that never got as far as a valid parameter, leaves a row with an explicit reason attached.
Tracking links do not carry readable identifiers. The affiliate-offer pairing, the offer id on a conversion, and the trackback token are all encrypted, so a URL exposes nothing an attacker can reason about. There is no id to increment to find another affiliate, and no offer id to guess at to fire a conversion against something you were never given. A parameter that fails to decrypt is recorded as a decrypt failure with the detail attached rather than being ignored.
Replay is the cheapest attack there is: capture one valid tracking request and fire it a thousand times. Offer Capsule issues single-use nonces from a database-backed ledger. Issuing is an insert; consuming is a conditional update that succeeds for exactly one caller. The second attempt to consume the same nonce updates nothing and fails - atomically, at the database, not in a per-process cache that a second web server would know nothing about. An expired nonce and a forged one are distinguished from each other and from a genuine replay, so the log tells you which of the three you are looking at, and expired rows are swept.
On a click, once the offer-state gates have passed, Offer Capsule runs a sequence of checks and stops at the first that fires:
Email creatives get a targeted exemption: empty-referer and velocity checks are skipped when the click's creative is an email creative, because an email drop legitimately arrives with no referer and all at once. Every other check still runs. Conversions get their own pass, including duplicate detection against the originating click.
Every click and conversion attempt ends with an explicit status, and clean traffic is marked as such rather than left blank. Blocked traffic is recorded with the specific reason - which check fired, and a note explaining what it saw. Blocked geo traffic and capped traffic are separate statuses again, so genuinely suspicious traffic is never conflated with traffic that was simply not eligible.
Forensic rows are written even when there is nothing to attribute them to. A request with a missing identifier, a tampered parameter, or an unhandled failure still produces a row with a reason. That is the difference between a system that stops fraud and a system that can prove it stopped fraud. When an affiliate disputes a scrub, you are not describing a policy from memory - you are showing them dated rows with the check that fired and the reason it fired, in a log they cannot edit. Offer, creative, segment, coupon, and network-connection changes are audit-logged on top of that, so the terms in force at the time are provable too.
Related: tracking links, reporting, and the conversion lifecycle.
See Offer Capsule running against your own offers. We will follow up to arrange a walkthrough.