Fraud Risk
Manufactured volume: detecting incentive abuse on platforms
Any platform that pays for growth will eventually buy some growth that was manufactured for the purpose. This is not a statement about dishonest people. It is a statement about incentives: if a number determines a payout, a promotion or a place on a leaderboard, that number acquires a second life independent of what it was meant to represent.
The control problem is that manufactured volume and real volume look identical in aggregate. Both are transactions. Both settle. Both increase the metric. The difference only appears in structure.
The pattern, stated generally
Strip away the specifics of any given platform and incentive abuse has a consistent shape: activity that is disproportionately funded from inside the system that rewards it.
A campaign whose contributions come overwhelmingly from the platform's own promotional credits rather than from external participants. A merchant whose transaction volume is largely with counterparties sharing its own device fingerprints. A referral cohort where the referred accounts transact once and never return.
In each case the tell is the same: the ratio of internal to external funding is far from what the population as a whole looks like. That ratio is your detection primitive, and it is far more robust than any absolute threshold.
Why absolute thresholds fail here
The instinct is to set a limit — flag anything above a certain amount of promotional spend. This produces two failures simultaneously.
It floods you with large, entirely legitimate accounts whose scale means they exceed any fixed number in the ordinary course. And it misses small-scale abuse entirely, which is where most of it lives, because individually the amounts are unremarkable.
A ratio has neither problem. A large legitimate account with 4% internal funding does not flag. A small account with 85% internal funding does, regardless of size. Add a minimum materiality floor so you are not investigating trivial amounts, and you have a screen that scales.
Absolute thresholds detect size. Ratios detect structure. Incentive abuse is a structural phenomenon.
Building the screen
The construction is straightforward and most of the work is in the data preparation rather than the logic.
- Define the internal funding source precisely. Which credits, promotions, waivers or subsidised transactions count. Ambiguity here invalidates everything downstream — and there is always at least one edge case that reasonable people classify differently.
- Compute the ratio per entity, not per transaction. The unit of analysis is the account, merchant, campaign or seller — whatever the incentive is attached to.
- Establish the population baseline. What does the distribution actually look like? You cannot say a ratio is anomalous until you know what typical is, and typical is usually not what people assume.
- Apply a materiality floor. Below some absolute value, a high ratio is noise. Set it explicitly rather than letting it emerge from whoever builds the query.
- Attribute ownership. Every flagged entity should carry the name of whoever onboarded or manages the relationship. Not to assign blame — to route the question to someone who can answer it.
That last point is where most screens fail operationally. A list of flagged entities with no owner attached becomes a document that circulates without resolution.
The three explanations, and why you must hold all three
When an entity flags, there are always at least three live hypotheses, and they are not equally likely in the way people assume.
It is legitimate and the ratio is explainable. Seed funding for a new seller. A deliberate promotional push signed off by someone. A category where internal funding is simply how the product works. This is the most common outcome by a wide margin, and any framing that does not treat it as the leading hypothesis will produce bad conversations.
It is a control weakness rather than misconduct. The incentive was poorly designed and the behaviour it produced is the rational response. Nobody broke a rule; the rule was badly drawn. This is more common than deliberate abuse and much cheaper to fix.
It is deliberate manipulation. Real, and the reason the screen exists — but the smallest of the three categories, and the one you should be slowest to assert.
Raising it without accusing anyone
This is the part that determines whether the screen survives its first month.
A flagged list framed as "suspicious accounts" or "suspected fraud" puts every named person on the defensive immediately. Half of them are managing entirely legitimate relationships. They will contest the methodology rather than answer the question, and they will be partly right to.
The same list framed as a review — entities whose funding profile sits outside the population norm and warrants an explanation — gets answered. Often within a day, often with an explanation that is entirely satisfactory, and occasionally with one that is not. The second kind is what you were looking for.
Concretely, in the output itself:
- Use "higher-risk", "outside expected range", "warrants review" — not "suspicious", "fraudulent", "abuse".
- Show the ratio and the population baseline side by side, so the reader can see the basis rather than trusting a label.
- State what would resolve the flag. A question with a known answer is a task; a flag with no exit criteria is an accusation.
- Report the population statistics, including how many flags resolved benignly. It calibrates everyone's expectations and protects the screen's credibility.
What the screen is not
It is not evidence of anything on its own. A ratio is a prompt to look, and the looking is where the finding is made or discarded. Treating the screen output as a conclusion is the single fastest way to destroy trust in it — internally, and with the people whose accounts appear on it.
It also will not catch sophisticated manipulation that deliberately keeps its ratios near the population mean. Someone who understands the screen can evade it. That is true of every detection control ever built, and it is not an argument against building this one. Most incentive abuse is opportunistic rather than engineered, and opportunistic abuse does not manage its ratios.
The uncomfortable organisational part
A screen like this frequently surfaces behaviour that was, in some sense, encouraged. Someone set a target. Someone else met it in the way the incentive made rational. The control function then arrives and describes the result as a risk.
Handling that well requires saying the quiet part plainly: the finding is often about incentive design, not individual conduct. Frame it that way in the write-up and the conversation goes somewhere useful. Frame it as a conduct issue and it becomes a territorial fight that nobody wins and the underlying incentive stays exactly as it was.