AntifrogACADEMYExplore Antifrog ↗
Case library/ Case 09
Case 09 / Affiliate risk / 6 min

Paid for players who never traded.

Measure what a referred customer does after the payment event.

Unused ivory invitations move across an empty stone courtyard.
Your brief

You review partner traffic at Meridian FX, a fictional forex and CFD broker. One affiliate delivered 312 first-time depositors last month and was paid €200 for each. Almost none of them traded. The next payment run, with 140 more depositors from the same partner, is in five days. Decide what to do before it runs. All people, figures and internal procedures in this exercise are synthetic.

Fictional scenario · Synthetic data · No real customer records
first deposits / month
312
CPA paid
€62,400
placed a trade after week 1
6 / 312
02 / Examine the evidence

What would
you look at?

Open at least two files before making a decision. You can read every file.

0 of 3 files opened

A useful definition
01 / Affiliate dashboardPartner report

The affiliate, Ridgeline Media, is paid €200 for each referred account that passes verification and deposits at least €100. Last month it delivered 312 such accounts. Six placed a trade after the first week; 290 requested withdrawal of their deposit within 14 days, which the terms allow. Across all other affiliates, 38% of first-time depositors placed a trade after the first week, measured at day 30 and 12% withdraw without trading. These cohorts use the same 30-day observation period.

The report measures the payment event precisely and the customer afterwards hardly at all, which is the structural problem. The comparison with other affiliates turns a low number into an anomaly. It does not yet say whether the anomaly is the affiliate’s audience, its methods, or someone else using its link.

02 / Risk workbenchAccount attributes

Of the 312 accounts, 190 registered from addresses in 203.0.113.0/24 and 58 from 198.51.100.0/24. Deposits came from 128 distinct card references; 84 cards fund more than one account. Names and documents are distinct and passed verification. The affiliate’s declared channel is a comparison site. Marketing approved a ‘deposit €100, trade commission-free for a month’ offer for this partner, which could attract deposit-and-withdraw bargain hunters in good faith.

Shared payment references and concentrated infrastructure warrant ownership and channel checks, but do not establish that the affiliate directed abuse. The approved offer provides a competing explanation. The 64 accounts outside the two network ranges are not automatically unlinked on every other attribute.

03 / Partner contractAgreement

The affiliate agreement lets Meridian withhold or claw back CPA for referred accounts that fail quality criteria within 60 days, provided the partner receives written notice and a reasoned list within 30 days. It also allows a switch to deferred payment, 30 days after first deposit, for any partner on notice. This month’s pending payment is €28,000 for 140 accounts. Ridgeline is your third-largest partner by referred volume. For this exercise, the signed quality schedule prohibits self-referrals, unauthorised third-party funding and fabricated identities. Low trading activity alone is not a breach. Notice permits a 30-day evidence review of the next run; accounts that meet the agreed criteria remain payable.

The contract gives you scoped, reversible levers with a procedure attached. It does not decide the question for you: a reasoned list means showing which criteria each account failed, and a third-largest partner means the commercial team will ask you to show it.

03 / Choose a next step

Make the call.
Leave your reasoning.

Choose what you would do under this scenario’s assumptions. Your notes stay in this browser. Do not enter real customer information.

Your next step

Private notes, saved locally. The debrief responds to your chosen action; it does not grade your writing.

Further reading

OWASP · Automated Threats to Web Applications

Reference checked 5 November 2026. The scenario, runbook and debrief are original Antifrog teaching material; the source does not endorse them.