A platform launches a referral program: refer a friend, get $10 when they sign up and make their first purchase. The API supports: register account → submit referral code → complete a qualifying action → trigger reward payout.
A bot operator writes scripts that: create account A (referee), generate a referral link, create account B (referred), complete B’s registration with A’s referral code, have B complete a qualifying action (often minimal). Repeat at scale. Each cycle pays out $10 to the operator-controlled account A. 1,000 cycles = $10,000 extracted from the business.
Email verification is bypassed with disposable email addresses. Phone verification is bypassed with virtual phone numbers (cheaply purchased in bulk). IP checks are bypassed with residential proxies. Identity verification (ID documents) does stop it — but most platforms don’t require ID for sign-up. The friction cost of adding verification must be weighed against the fraud cost.
The platform pays real money for each fraudulent referral. The bot operator’s marginal cost per cycle is near zero — compute, disposable emails, proxy services. At scale, referral fraud can cost platforms millions of dollars before detection systems catch up.