What Processing 10 Million Leads a Year Taught Me About Fraud Prevention and Sign-Up Abuse

Processing more than 10 million consumer leads a year taught me that fraud rarely looks obviously false at first. It often looks commercially valid until you examine the behaviour behind the identifiers. Here is what that experience taught me about fraud prevention, sign-up abuse and why most controls still sit too far downstream.

By Malcolm Treanor, Co-founder & COO, WINR

Lead generation is a trust system

Earlier in my career, I built and ran a digital lead generation company with my business partner Marcelo Ulvert, that processed more than 10 million consumer leads a year for clients across telco, insurance, finance, travel, retail, media, gambling, charity lotteries and utilities.

These were high-volume acquisition environments where sign-up offers, discounts, bonuses and other incentives worked exactly as intended. They drove volume. They also attracted abuse.

Looking back, many of the problems we were dealing with would now be labelled sign-up abuse, account creation fraud, affiliate fraud and first-party fraud. At the time, we simply knew that too much of the data looked commercially useful on the surface, but could not always be trusted.

I still remember how personally I took it when we first uncovered affiliate fraud at real scale. As a founder, I found it genuinely offensive. We had worked hard to build the business, and the idea that someone was gaming the model and getting paid for junk really p*$$ed me off.

In hindsight, that probably shaped a lot of what came next, including the ideas behind our Fraud Playbook.

At first glance, lead generation looks simple enough. Drive traffic to the site, create a compelling and highly optimised page, maximise conversion, and move the leads into sales or onboarding.

But at scale, that is only half the story.

The real question is much more fundamental.

Is this a real person, behaving normally, with genuine intent or someone trying to rip me off?

Why bad traffic can look like good business

One of the reasons this problem is so persistent is that fraud rarely looks obviously fraudulent at first. More often it presents as something commercially useful right up until the moment you inspect it properly. A lead with plausible details. A form completion that passes basic validation. A conversion source that appears to perform. An affiliate partner that looks productive on paper.

That is what makes it so awkward inside a business. Marketing is often rewarded for volume and conversions. Sales gets judged on what actually turns into revenue. Risk ends up carrying the cost of what should never have made it through in the first place. Those incentives do not always sit neatly together.

In sectors with sign-up incentives, the problem becomes sharper. Whenever there is value attached to acquisition, whether that is discounted connectivity, a financial offer, a free bet, a travel credit, a subscription incentive or a switching benefit, someone will try to game it. Some will do it through affiliates. Some will do it directly as consumers. Some will do it repeatedly with just enough variation to look new each time.

That is why so many teams get caught. The first symptom is often not a compliance issue. It is a performance issue. Conversion rates drift. Call centre productivity drops. Approval rates soften. Bonus abuse rises. Chargebacks appear in pockets. Customer quality deteriorates. Good traffic starts to feel harder to find.

By the time the tension becomes obvious internally, the fraud is usually already in the system. By the time the business formally calls it fraud, the damage is often already underway.

In my lead generation days, we had to develop practical methods for spotting both affiliate fraud and first-party fraud long before those labels became common in board papers. We did it because margins demanded it. If you are buying media, paying affiliates, or funding acquisition based on volumes that cannot be trusted, bad data becomes expensive very quickly.

The early signals we learned to watch

Some of the patterns were obvious, once you had the scar tissue. Bad phone numbers, so we brought in HLR checks. Bad emails, so we layered in validation. Suspicious IPs, so we blocked them. Names that looked superficially fine but did not sit comfortably against local dictionaries. Bad addresses, so we tightened the front end with rapid address entry rather than accepting whatever people felt like typing.

The data often looked clean enough on the surface. Fields were filled. Records passed basic checks. But it was obvious some bad actors were gaming the system, and that basic validation on its own was nowhere near enough to separate genuine people from manipulated or low-trust submissions.

This is one of the themes we explore in the Fraud Prevention Playbook: the difference between data that merely looks complete and data that actually behaves like it belongs to a real person.

Other patterns were more subtle. Time-of-day anomalies. Velocity spikes after payout changes. Lead cohorts that validated on the surface but underperformed badly once they hit downstream contact or fulfilment. Traffic sources that seemed to know exactly how to pass the visible rules while still degrading the commercial outcome.

That was the key lesson. Fraud detection was never just about finding obviously false records. It was about identifying behaviour that did not look natural when viewed in context.

So we built layers. We looked at repeat use of phones, emails and addresses. We examined how identifiers moved over time. We watched for concentrations by affiliate, publisher and campaign. We compared declared identity details against patterns of prior usage. We treated inconsistency as a signal, but we also treated over-consistency as a signal. Real people are messy. Fraud operations often become strangely neat.

Most importantly, we learned that the earlier you insert trust controls, the more commercial value you preserve.

Why most controls sit too far downstream

That lesson still holds today.

A great deal of modern fraud strategy still sits too far downstream. Businesses wait until account opening, payment, withdrawal, claim, or some other high-risk event before asking whether the identity in front of them makes sense. By then, cost has already been incurred. Operations have already touched the record. Commissions may already have been paid. Incentives may already have been redeemed. In some sectors, the fraudster has already extracted value.

If you only check for fraud at the point of hard verification, you are asking the wrong system to do too much. Traditional KYC and IDV are essential, but they were never designed to carry the full burden of fraud detection on their own. They confirm aspects of identity. They do not always tell you whether the identity behaviour looks familiar, persistent, natural, or commercially trustworthy.

That requires a different layer of intelligence.

It means understanding whether an email has continuity, whether a phone number behaves like it belongs to the person presenting it, whether an address has the characteristics of genuine use rather than synthetic assembly, and whether the overall pattern looks like a real customer beginning a journey or a bad actor testing the edges of your controls.

The Fraud Prevention Playbook was written for teams dealing with exactly this problem: how to spot risk earlier, reduce unnecessary friction, and make better trust decisions before fraud reaches the expensive parts of the customer journey.

Why longitudinal signals matter

The best operators I have worked with do not treat fraud as a binary event. They treat it as an accumulation of signals across the customer journey. Some of those signals come from devices, some from networks, some from payments, some from behaviour, and some from the identity itself.

That last category remains underused.

A fraud stack becomes materially stronger when it can distinguish between identifiers that have history, continuity and normal patterns of use, and those that appear abruptly, inconsistently, or in combinations that do not make sense. That does not remove the need for verification. It makes verification smarter. It helps businesses decide which records should flow through with less friction, which should be stepped up, and which should be stopped before unnecessary cost is created.

Identity signals grounded in the longitudinal history of identifiers such as email, phone and address can help distinguish between records that simply look complete and records that behave like a genuine person. Recency, frequency, velocity and acceleration all matter. Used properly, these signals help businesses reduce friction for lower-risk users and apply stronger controls where risk is higher.

It is also why the Fraud Prevention Playbook is deliberately practical. It is built around the idea that fraud prevention works better when trust decisions start earlier and when identity signals are treated as part of the fraud conversation, not as a separate compliance exercise.

What the playbook is designed to help teams do

If you have ever run affiliate programmes, bought leads, managed onboarding funnels, or owned fraud outcomes in a high-volume acquisition environment, much of this will feel familiar. The mechanics change by sector, but the pattern does not. Fraud tends to exploit weak joins, shallow checks, delayed controls, and organisations that still separate customer acquisition from trust.

The businesses that do this well are the ones that close that gap.

They understand that fraud is not just a payments problem or a compliance problem. It is a data problem, a workflow problem, and very often an upstream identity problem.

That was true when we were processing more than 10 million leads a year.

It is even more true now.

If these challenges sound familiar, download the Fraud Playbook for a practical view of how upstream identity signals can strengthen fraud prevention, reduce sign-up abuse and cut avoidable friction.

Frequently asked questions

What is sign-up abuse?

Sign-up abuse is the manipulation of registration, onboarding, referral or promotional flows to extract value that was intended for genuine new users. It often includes repeated registrations, fake identities, incentive harvesting and low-trust submissions designed to look valid.

What is affiliate fraud?

Affiliate fraud is the manipulation of partner, traffic or attribution systems to generate commissions or payouts that are not tied to genuine customer acquisition.

What is first-party fraud?

First-party fraud happens when a real person uses their own identity, or a lightly altered version of it, deceptively for financial or commercial gain. In acquisition environments, that can include repeated sign-ups, promotional abuse or re-entering funnels under slightly changed details.

Why do fraud controls often sit too far downstream?

Many businesses still rely on checks that happen at account opening, payment or claim stage. By then, operational cost may already have been incurred, incentives may already have been redeemed and bad data may already have entered internal systems. Upstream trust controls help reduce that waste before it compounds.

How can identity signals help prevent fraud?

Identity signals grounded in the longitudinal history of identifiers such as email, phone and address can help distinguish between records that simply look complete and records that behave like a genuine person. Recency, frequency, velocity and acceleration all matter. Used properly, these signals help businesses reduce friction for lower-risk users and apply stronger controls where risk is higher.