Traffic quality for CPA offers: bots, duplicates and incent traffic
Every CPA advertiser eventually asks: how do I know the conversions are real? This guide explains the three ways traffic quality fails — bots, duplicates, incentivized users — the data signature of each, and the validation loops that catch them before they cost you money.
What quality means in a CPA deal
In CPA, quality is not an impression — it is a measurable outcome: the share of delivered conversions that pass your validation and behave like real customers afterward. A conversion is good if it approves (the deposit clears, the order confirms, the subscription activates) and its cohort shows real downstream behavior — retention, redeposits, activity. This definition matters because it aligns incentives: the buyer is paid only for what validates, so a rational buyer filters aggressively before delivery.
Quality failures come in exactly three families, each with its own signature and defense. Bots: automated traffic that was never a person. Duplicates: the same user or order counted more than once. Incentivized traffic: real humans with worthless intent. Understanding the difference matters because the fixes are different — and because lumping them together as "fraud" produces arguments instead of filters.
Bots: the signatures automation cannot hide
Automated traffic betrays itself statistically, because simulating human behavior at scale is expensive. The classic signatures: click-to-conversion times no human produces; conversion timestamps flat across the day instead of following human rhythms; device and browser fingerprints repeating at impossible rates; GEO mismatches between the click's location, the device settings and the conversion; and conversions with zero downstream behavior — no second session, no deeper event, nothing.
No single signal convicts; real users sometimes look odd. The conviction comes from aggregation: a source showing several signatures at once is cut from rotation. Detection works in two layers. Before delivery, placement-level filtering — sources with bot signatures are excluded from buying. After delivery, reconciliation — conversions are matched against your system of record within the hold window, so what slipped through is caught before payment, not disputed after. Both layers depend on the same thing: your validation data flowing back fast and per-conversion.
Duplicates: the quietest leak
Duplicates are the least dramatic quality failure and the most constant. The same user converts through two paths — an organic visit and a paid click, two different sources, a retargeting campaign and a first-touch one — and both conversions arrive claiming payment. Left unruled, deduplication becomes a monthly argument where everyone has a plausible claim.
The defense is procedural, agreed before traffic: the attribution window that bounds how long a click earns credit, the deduplication rule that decides who wins (typically first valid postback, or last click within the window — what matters is that it is written), and reconciliation against your system of record, where the same order ID or customer ID cannot approve twice. Duplicates are never eliminated; they are managed down to a small, predictable, non-disputed residual. Predictability is the goal — a known 2% costs less than a contested 0.5%.
Incentivized traffic: real humans, worthless intent
Incent is the dangerous category: real people, completing real actions, for the reward rather than the product. Paid-to-register users, offer-wall installers, minimum-deposit bonus hunters. It passes naive validation — the registration is real, the deposit cleared — and fails every metric that matters afterward: no retention, no redeposits, no activity, no revenue. Incent does not show up in your approval rate; it shows up in your cohort reports, weeks later, as expensive silence.
The defense is cohort analysis per source. When you share downstream behavior per source — week-one activity, repeat deposit rate, sale rate — incentivized supply identifies itself: approval followed by nothing. Sources that systematically deliver it are cut. This is why the cohort feedback loop matters more than any single fraud filter: filters catch machines, but only cohort data catches humans behaving worthlessly. A buyer with your cohort data optimizes toward revenue; a buyer without it optimizes toward the cheapest conversions that pass validation — which is precisely what incent traffic is.
The validation loop that catches everything
Every defense above runs on the same fuel: fast, per-conversion, reason-coded validation feedback from you to the buyer. Approval status per conversion. Rejection reasons per rejection. Cohort behavior per source. On that data, quality management is mechanical: bad sources are cut, good ones scaled, edge cases resolved against logs. Without it, quality management is theology — both sides arguing from aggregate numbers that cannot settle anything.
The operating rhythm we run with offer owners: validation within the agreed hold, rejections with stated reasons, weekly per-source reconciliation, disputes resolved against written terms and logs. The traffic quality page describes the framework, and the terms page describes how it is fixed in writing. Traffic quality is not a promise a partner makes; it is a loop both sides operate.
What you control on your side
Four practices make any CPA supply cleaner, and all four are yours. Validate fast: slow approval windows hide bad sources and punish good ones — approve within the shortest window your operations genuinely allow. Share rejection reasons: a rejection without a reason cannot be filtered against. Watch cohorts, not just approvals: retention and redeposit data catch what validation misses. And keep caps during validation: capped volume limits what an undiscovered bad source can cost.
One more honest point: a falling approve rate is not automatically a traffic problem. Slow confirmation, slipping delivery coverage, a changed funnel — all produce the same symptom. Reconciling approval per source against your own operational data is how you tell which is which, and a good buying partner will show you their side of that data when you ask. Quality is a joint product; the loop is how you run it together.