The self-referral problem
Someone signs up for your affiliate program, grabs their referral link, opens a private window, creates a second account with a different email, and pays for a subscription through their own link. Now they collect a commission on the money they just paid you. If your commission is recurring, they have effectively given themselves a permanent discount and you are paying the processing fees for the privilege.
The variant that is harder to argue with: the affiliate has a real second business, or a family member signs up, or an agency refers a client and then pays the client's bill. Some of that is legitimate. Some of it is not. Either way you need to see it before you pay out, not after.
The signals most programs check are the ones easiest to defeat
Almost every affiliate system I have looked at checks three things: email address, IP address, and some flavour of device fingerprint.
