Referral rings
An inviter who creates the invitees. The same device or network behind inviter and invitees is the clearest lead.
Rewards for customers. Not for farms.
Every reward you give away is something someone will try to collect repeatedly. Fingerly ties signups, referrals and redemptions to the device behind them, so referral fraud and points farming are visible before the reward is paid.
- A visitor IDPer claim, per device.
- Farm signalsDevice farms and emulators.
- Before payoutHold rewards for review.
- No captchaLight for genuine members.
[ 01 / 06 ]Abuse patterns
How abuse reaches rewards and referral programs.
Loyalty, cashback, referral and coupon programs share a weakness: reward value is paid per account, and accounts are cheap. These are the patterns that exploit it.
Sign-up bonus farming
Welcome rewards collected under many emails. The device is the thread that stays the same.
Device farms and emulators
Racks of phones and emulated devices that complete offers and installs for payouts. The native SDKs report emulators and provisioned devices.
Points theft and account takeover
Stolen logins used to cash out points or gift cards. A device the member has never used is worth a second check before redemption.
Bots completing offers
Scripts that complete surveys, check-ins or tasks at machine speed. Automation and unusually busy devices are reported without a captcha.
Affiliate and coupon-site abuse
Fake signups generated to earn affiliate commission, or coupons scraped and redeemed in bulk. Repeat claims are visible per device.
[ 02 / 06 ]Pattern to decision
From pattern to decision.
Fingerly connects claims to devices. It does not know who earned a reward, so what counts as abuse is written in your own program rules.
01
Referral rings
The inviter and the invitees are one device.
Identify at signup and at referral qualification. The same visitor ID on inviter and invitee is a strong reason to withhold the reward and review. Households are ordinary, so let the cluster size guide the action.
- Check at
- Referral signupReward qualification
- Reads
- Visitor IDDevice farmNew or returning
02
Bonus and cashback farming
One welcome reward per device.
Count welcome rewards per visitor ID and review devices that keep coming back. Private windows reset a cookie but not the device, and incognito is reported as context rather than as a verdict.
- Check at
- SignupFirst reward
- Reads
- Visitor IDIncognito modeHigh activity
03
Offer and install farms
One device looks innocent. A rack of them does not.
Emulators, simulators and provisioned devices that complete offers are reported by the native SDKs, and the server sees many alike devices behind one network. Hold payouts for the cluster while it is reviewed.
- Check at
- Offer completionPayouts
- Reads
- Device farmAndroid emulatoriOS simulator
04
Points theft
Check before the balance leaves.
Recognise the devices a member normally redeems from. Step up for a redemption from a new device that also carries automation or an anonymised network.
- Check at
- LoginRedemptionGift card purchase
- Reads
- Visitor IDTor exit nodeAutomation
[ 03 / 06 ]Integration
Integrate at the right moments.
Four habits keep a policy for rewards and referral programs effective without turning it against genuine customers. A production identification is billed per request, from $0.0025, so it is worth placing where it earns its cost.
- 01 Identify at the moment
Call identify at signup, at referral qualification and at every redemption, not on every page. Pass your own member reference as the tag so the result comes back with the claim it describes.
await fingerly.identify({ tag: "reward-claim" }) - 02 Verify on your server
Send only the request ID to your backend, read the stored result with a secret key, and check that its tag matches the action. The server decides who is paid.
- 03 Observe before you enforce
Run in monitoring mode first. Households, offices and shared phones are ordinary, so measure how many genuine members a rule would hold before enforcing it.
- 04 Act in proportion
Hold the reward for a cluster rather than closing accounts on one signal. Publish the program rules, document the signals behind each hold and give a genuine member a way to be paid.
[ 04 / 06 ]Moments
Where to check, what to do.
Where a rewards or referral program usually places the check and what it reads there.
| Moment | Identify when | Read | Usual first decision |
|---|---|---|---|
| Signup | The account is created | Visitor ID, new or returning, device farm | Delay the welcome reward for clusters |
| Referral qualification | Before the reward is earned | Visitor ID, device farm | Withhold when inviter and invitee share a device |
| Offer completion | Before the payout is queued | Emulator, high activity, automation | Review the cluster |
| Redemption | Before points are spent | Visitor ID, Tor exit node | Second factor for new devices |
| Cash out | Before funds are released | Suspect score | Review above your threshold |
Every decision is yours. Fingerly returns the visitor ID, the signals and the suspect score, and never blocks a request by itself.
[ 05 / 06 ]Questions
Questions about rewards and referral programs.
How a rewards, loyalty or referral program uses device fingerprinting against abuse.
Talk to the teamHow do I prevent referral fraud?
With Fingerly, you identify the device at signup and at referral qualification and store the visitor ID with each account. When inviter and invitees share a device, or a cluster of accounts does, the reward can be held for review, and device farm and emulator signals make the pattern more telling.
How can I detect reward and points abuse in a loyalty program?
Count claims and redemptions per visitor ID, and read device farm, emulator and high activity signals beside them. Fingerly connects each claim to the device behind it, and your program rules decide what counts as abuse and what happens next.
Can it stop device farms completing offers?
It helps find them. Native SDKs report emulators, simulators and devices that look provisioned for bulk use, and the server sees many near-identical devices behind one network. You still decide whether to hold payouts, and no detection removes farming entirely.
Will genuine members in one household be blocked?
Not if the policy is built carefully. Households and offices share devices and networks, so a shared visitor ID should send a claim to review rather than to a refusal. Start in monitoring mode and measure who a rule would affect.
Does Fingerly work for a coupon or cashback website?
Yes. The web SDK runs on any site and returns a visitor ID per device. Verify the result on your backend by request ID with a secret key, because a result the browser reports cannot be trusted on its own.
Less guessing. More knowing.
Make the next connection a trusted one.
Start with the signals, keep your own decisions, and pay as you go, only for what you identify. No credit card needed.