Scams in traffic arbitrage: from fake managers to ad account hijacking

All you have to do is ask a couple of questions in any affiliate marketing chat, and a «manager» from a popular affiliate network or a seller of consumables will immediately message you privately. A beginner will be offered a private offer with a higher payout and no hold period, agency ad accounts with unlimited ad spend, or a campaign setup with guaranteed profit for a ridiculously low price or a percentage of ad spend.

For scammers, a beginner affiliate marketer — is the easiest target. It has nothing to do with being naive; beginners simply haven't seen enough of the industry yet or learned how the market works. Without experience, it's difficult to immediately realize that a legitimate CPA network is unlikely to give access to a private offer without campaign statistics, and nobody would sell a high-ROI campaign setup in direct messages for $50.

In 2026, scams in traffic arbitrage have long gone beyond selling useless courses. Scammers create copies of well-known affiliate network websites, distribute seemingly useful browser extensions that actually steal access to ad accounts, drain crypto wallets, take payments for agency ad accounts and disappear.

We've collected the most common schemes used to scam affiliate marketers: from fake gurus and shaving to ad account hijacking. Beginners make up the majority of victims, but even experienced affiliate marketers fall for some of these schemes. We've broken down how each one works and what usually gives scammers away.

Fake gurus, «mentors» and fake teams

One of the newer schemes works like this. An experienced media buyer contacts a beginner and offers to teach them how to run traffic from Facebook or Google. The training is free at first, followed by 10–20% of ad spend once the campaigns become profitable. To build trust, the person sends a few introductory lessons, usually taken from someone else's leaked course.

Next, accounts are needed. The «mentor» tells the beginner which ones to buy: expensive accounts with specifications that don't actually exist on the market. The beginner searches different shops, can't find them and asks for the seller's contact details. They pay the seller, and both the seller and mentor disappear.

There's another version of the scheme: the accounts actually exist, and the affiliate marketer buys them. The mentor then asks for access to «set up campaigns» or «check account trust». Once they get access, they change all passwords and email addresses. The accounts and their balances are taken over.

Warning signs of such mentors:

• They contact you first through direct messages.

• They offer free training but very quickly move on to purchases.

• They insist on consumables that aren't sold anywhere else or are available only from «their» seller.

• They ask for usernames, passwords or verification codes for your ad accounts. A legitimate mentor only needs a screen-sharing call to review your setup. If they genuinely need access to your Business Manager, you can grant it by adding them as a partner or assigning a separate role with limited permissions. You can revoke that access at any time, while keeping control of your passwords and email address.

The classic schemes haven't disappeared either: paid courses and «profitable campaign setups». After payment, you usually receive an outdated manual or information you could find on Google in one evening. It's also worth asking why someone would sell a campaign setup if it really generates 300% ROI. It would be easier to run traffic with it themselves and keep all the profit.

This scheme has now become especially common in the AI creative niche. Influencers showcase «AI-generated» videos on their profiles that are indistinguishable from footage of real people and sell courses teaching others how to create the same content. In reality, some of these videos were filmed with real people.

You can recognize such courses in advance. Comments are disabled on the author's channel, so dissatisfied buyers can't leave feedback. Reviews are shown only as screenshots provided by the admin. You learn about the course through direct message promotions or spam in chats. And when you ask to see at least one lesson before paying, the author says it's «exclusive» content that cannot be shared.

Fake teams operate in a similar way. They contact people on behalf of a well-known affiliate team or a heavily promoted «new team», invite them to training or offer them a job, but first ask them to buy accounts and proxies from a trusted seller. After receiving payment, they disappear.

Before paying, check the following:

• Username. Compare the contact with the team's official channel. Scammers use usernames with an extra letter or underscore.

• Mentions outside the Telegram channel. A channel alone proves very little: even an old channel with an active audience isn't necessarily trustworthy. It can be purchased and repurposed. Look for the team in affiliate marketing media, case studies and conferences, and ask about it in chats or from affiliate marketers you know. If there's no information about a supposedly «well-known team» anywhere else, that's a reason to be cautious.

• Their reaction to «I already have my own consumables». Tell the «team» that you already have accounts and proxies and won't be buying from their seller. If they're scammers, they will usually lose interest in you very quickly.

• Seller's prices. If they're significantly higher or lower than market prices, that's another warning sign.

If you're unsure, simply ask about the team or mentor in a couple of large affiliate marketing chats. Scammers usually deceive dozens of people rather than just one, so many of them have already been discussed there.

Shaving and shady affiliate networks

Sometimes an affiliate network looks reputable but only lasts until the first large payouts are due. The website, dashboard, manager and statistics — everything looks like a legitimate network. The first payments may even arrive on time to gain your trust. But once you increase your traffic volume, delays and «traffic rechecks» begin. Eventually, some leads are rejected, followed by all of them.

Higher payout rates are often used as bait. If one affiliate network pays noticeably more than the others for the same offer, it's worth finding out why. Often, that difference is simply taken back later: large numbers of leads are rejected as fraud or poor-quality traffic.

When an affiliate network or advertiser fails to credit your leads, this is known as shaving. You may suspect it if:

• traffic increases, but conversions don't;

• the numbers in your tracker and the affiliate network's statistics differ significantly;

• many leads are rejected without a clear explanation;

• you're accused of using incentivized traffic even though nothing has changed in your campaign setup;

• the conversion rate suddenly drops and then recovers on its own, while the manager can't explain why.

But not every rejected lead means shaving. Many affiliate marketers believe that major CPA networks rarely engage in shaving because their reputation is worth more than a few saved payouts. In established affiliate networks, leads are more often lost due to technical issues. Or the advertiser may have tightened traffic checks and started rejecting everything that doesn't pass its filters. So before publicly accusing a network of shaving, it's better to carefully double-check everything.

How to protect yourself:

• Run traffic through your own tracker. Without one, you'll have nothing to compare the affiliate network's statistics against.

• Compare results. Take the same offer from two or three affiliate networks and send comparable traffic to each. If one credits noticeably fewer leads than the others, something may be wrong with that network.

• Start with a small budget. First, see how the initial payout goes, and only then scale up.

• Keep agreements in writing. Before launching, ask the manager which traffic sources are allowed and why leads might be rejected. If leads start getting rejected later, you'll have screenshots to refer to.

• Read reviews. If an affiliate network scams people, reports usually start appearing quickly in affiliate marketing chats and on industry websites. Before launching, simply search for the network's name.

If the signs of shaving keep appearing and there are no clear explanations, it's easier to withdraw whatever you've earned and move to another affiliate network.

Fake managers and cloned affiliate networks

In early September, affiliate marketing channels warned about a scheme that even experienced affiliate marketers fall for.

Scammers monitor managers and support representatives from well-known affiliate networks. As soon as one of them changes their Telegram username, the scammers claim the old one. That previous username may remain in affiliate marketers' conversations for years or even appear in the contact list on the affiliate network's own website. As a result, a message from a «familiar manager» doesn't raise suspicion. With people who don't already have a contact, it's even easier: scammers simply introduce themselves as a new manager.

What happens next follows a familiar pattern. The «manager» says the affiliate network has launched a new project or dashboard and invites you to join on prepay terms with a higher payout rate and a balance bonus. The linked website looks genuine, but it's a clone. To receive the promised money, you're asked to connect your crypto wallet.

When you connect your wallet to the website, it asks you to confirm an action. Many people click without reading. In reality, you're authorizing the website to withdraw funds from your wallet. As a result, your crypto disappears immediately, and if the wallet is empty, the funds will be taken the moment a payout arrives.

How to avoid getting scammed:

• Don't connect your wallet to affiliate network websites. A legitimate affiliate network only needs the wallet address you enter yourself in your dashboard to send payouts. If you're asked to connect your wallet and confirm something, close the website immediately.

• Verify contact details. If a «manager» contacts you for the first time in a long while or suddenly offers new terms, check their username on the affiliate network's official website or channel. Better yet, ask in the official chat whether that person actually works there.

• If you've already connected your wallet. Immediately revoke permissions in your wallet settings or through a dedicated service: revoke.cash works for Ethereum and BSC, while TronScan can be used for USDT on the Tron network. Transfer the remaining funds to a new wallet.

There's also a simpler scheme. It's old but still works. An affiliate network «manager» offers to have you send traffic to their personal tracking link and promises a higher payout than the one shown in your dashboard. They may explain it as private terms for selected partners or a way around network limits. They might even pay for the first few leads. But the manager receives the affiliate network's payout for your traffic, and once volumes grow, simply disappears.

The protection is simple: only send traffic to links you obtain yourself from your dashboard on the affiliate network's website. Even if a link comes from an official account, that account could also have been hacked.

Fake account shops and agencies

Every affiliate marketer needs accounts and agency ad accounts, and scammers take advantage of this. For a beginner, it's difficult to distinguish a legitimate shop or agency from a fake one.

Cloned account shops

Scammers copy the name, design and even descriptions of a well-known shop, changing only the domain or bot username. Sometimes the difference is just one letter, making it easy to overlook, especially when someone sends you the link in a private message. You pay and receive either nonfunctional accounts or nothing at all.

How to avoid getting scammed:

• Get the shop link from a reliable source. For example, from reviews and recommendations in affiliate marketing media or a pinned message in a large chat. After your first successful purchase, bookmark the website and access it only through that bookmark. Don't trust links sent in direct messages, even if they come from a «familiar seller».

• Check accounts immediately after purchase. Shops have limited replacement periods, sometimes just 20–60 minutes. If an account doesn't work, contact support before the deadline expires.

• Read the replacement policy before paying, not after an account has already been banned.

Fake agencies

The scheme with agency ad accounts is different. You don't pay the advertising platform directly: you transfer funds to an agent, who then credits them to the ad account. Scammers exploit this arrangement.

A fraudulent agency takes the first payment and disappears. The money never reaches the ad account, and the «manager» stops responding. Such agents usually promise below-market fees and pressure clients to pay quickly.

Sometimes an agency takes away access to ad accounts while campaigns are still running. In one case, an agency came under review, and clients lost access to an MCC with approximately $80,000 in turnover. The affiliate marketers were accused of violating traffic rules, even though they hadn't changed their verticals.

Another scheme targets teams. An experienced media buyer joins a team and casually recommends a «trusted» agency. The team deposits a large amount of money, after which both the media buyer and the agency disappear. In 2024, the owner of a well-known team lost several thousand dollars this way, even though he had personally interviewed the media buyer.

How to protect yourself:

• Look for reviews outside the agency's channel. Ask in affiliate marketing chats and among affiliate marketers you know, and search for mentions on forums and media websites. Followers and channel age can be bought, while genuine discussions in chats are harder to fake.

• Start with a small deposit. Check how quickly the funds reach the ad account before depositing a larger amount.

• Don't keep large balances in ad accounts. Top up only what you need for your current ad spend so that you don't lose everything at once if something goes wrong.

• Keep agreements in writing. Clarify with the agent which verticals and advertising approaches are allowed before launching. That will make it harder to accuse you of violating the rules later.

If you're unsure about a shop or agency, it's better to spend ten minutes looking for reviews than to spend much longer trying to figure out where your money and ad accounts went.

Phishing and account hijacking

Sometimes scammers target your accounts rather than your money. Once they gain access to your Telegram or ad account, they can steal whatever is available there.

Telegram

Almost all affiliate marketing work takes place through Telegram: communication with managers, sellers and teams, as well as channels. That's why hijacking a Telegram account — is a major success for a scammer. According to BI.ZONE, more than 20,000 phishing websites specifically designed to steal Telegram accounts were discovered in the first half of 2025 alone.

These schemes often come down to the same thing: you're asked to enter a Telegram verification code on a third-party website or send it in a private message. The excuses vary:

• Advertising offer. If you run a channel, for example, for organic traffic or warming up an audience for gambling, an «advertiser» may contact you and offer to buy advertising. They discuss the price and post format, then send a link to their «affiliate network» website, where you need to log in through Telegram and enter a code. Sometimes they claim this is required by advertising laws. If you provide the code, scammers can gain access to your account and all the channels where you're an admin.

• «Telegram Support». You receive a message claiming that your account has been hacked or that someone has requested its deletion. To fix the problem, you're told to follow a link and confirm your login.

• «The chat is moving». A message appears in an affiliate marketing chat or affiliate network group saying that the group has been hacked and everyone is moving to a new one, with a link provided. To join the «new chat», you're asked to enter a Telegram code. In reality, this code allows an unauthorized device to log in to your account.

How to protect yourself:

• Never share Telegram verification codes with anyone or enter them on third-party websites. Legitimate support will never ask for them.

• Enable a cloud password. Even if someone steals your verification code, they won't be able to access your account without the second password.

• Check active sessions. If you see an unfamiliar device, terminate the session immediately.

Ad accounts

There's currently a scheme circulating on Facebook that can be difficult to recognize even for experienced affiliate marketers. The emails come from a genuine Meta address — [email protected], because scammers send them through Business Manager itself. They contain a link to a fake page asking for login credentials, 2FA codes and sometimes even a photo of a passport.

There's an even more sophisticated version: you receive a partnership request in Business Manager from an unfamiliar business account. Its name resembles something official from Meta, and all links lead to the real Facebook website. If you accept the request, the other Business Manager receives ongoing access to the pages, ad accounts and pixels you share with it.

How to protect yourself:

• Don't accept partnership requests from unfamiliar Business Managers. Meta doesn't invite people to «partner programs» this way.

• Regularly check the Partners section and the list of admins in Business Manager settings. If someone unfamiliar appears there, remove them immediately.

• Log in only through the Facebook website itself, not through links in emails.

Extensions and free software

Another way to steal account access — is to trick you into installing malicious software. For example, there was a Chrome extension called CL Suite: it promised to extract data from Business Manager, remove verification pop-ups and generate 2FA codes. In reality, it sent those codes and Business Manager data to scammers.

Socket's report on the CL Suite extension: it collected Facebook email addresses and usernames, 2FA codes and secret keys, Business Manager exports, IP addresses and browser data, then sent everything to an external server and the scammers' Telegram. Source: Socket

The same applies to cracked software: antidetect browsers, trackers and activators. They often contain malware that extracts saved passwords, sessions and crypto wallet data from browsers. You save money on a subscription — and lose your accounts.

How to protect yourself:

• Install extensions only from reputable developers and check what permissions they request. If an extension designed for data extraction needs full access to Facebook, that's worth questioning.

• Don't download cracked software. An antidetect browser license costs less than losing your ad accounts to hackers.

• Keep work and personal activities separate. Don't keep your work ad accounts and crypto wallet in the same browser where you install all kinds of software.

Almost all these schemes rely on urgency. You're told your account is about to be deleted, the chat is moving right now, or a partnership request must be accepted immediately. If someone pressures you to act quickly, it's better to stop and double-check everything.

Got scammed: what to do

Scammers constantly come up with new schemes, so even an experienced and cautious affiliate marketer can fall victim. The main thing — is not to panic and to act quickly.

If you've lost money to scammers

• Stop all payments and traffic. Don't pay extra «unlocking fees» or continue sending traffic to a suspicious affiliate network hoping things will improve.

• Collect evidence. Screenshots of conversations, offer terms or agreements with the seller, statistics, receipts and transaction hashes. These will be useful both for resolving the dispute and for writing a review.

• If you paid by card. Contact your bank immediately. Sometimes it's possible to request a refund for a recent payment.

• If your crypto was stolen. Revoke permissions in your wallet settings or through revoke.cash (for Ethereum and BSC) or TronScan (for USDT on the Tron network). Transfer the remaining funds to a new wallet.

If your account has been hijacked

• Telegram. If you still have access, terminate all unfamiliar sessions and enable a cloud password. Warn your contacts about the hack. If you've already lost access, contact Telegram Support and warn people you know through other messaging apps.

• Ad accounts. Remove unfamiliar partners and admins from Business Manager, change passwords and 2FA settings, and unlink payment cards. If you've lost access, contact the platform's support team.

After that, share your experience in affiliate marketing chats or industry media. Your post may help other affiliate marketers avoid the same scam.

FAQ

Is traffic arbitrage a legitimate way to make money or a scam?
It's a legitimate way to earn money. However, there are many scammers in the industry who target beginners. That's why it's important to learn early on how to distinguish legitimate affiliate networks, shops and teams from fake ones.

If an affiliate network doesn't pay immediately, is it a scam?
Not necessarily. Most affiliate networks have a hold period — the time they need to verify traffic before making a payout. It usually lasts from a few days to a month, which is normal. You should be cautious if the hold period is extended without explanation or becomes noticeably longer than promised.

Is it normal for a beginner to be offered prepay?

Usually not. Affiliate networks offer prepay to affiliate marketers with an established history and clear campaign statistics because they're risking their own money. If you're immediately offered prepay or a balance bonus without any experience or statistics, it's most likely bait.

Is it safe to buy through an escrow service?

An escrow agent — is an intermediary who holds the money until a transaction is completed. This is convenient when buying from a private seller. However, fake escrow agents also exist, often impersonating well-known usernames. That's why you should choose the escrow agent yourself and check their reviews in several chats. If the seller insists on using their own escrow agent, it's better to walk away from the deal.

Can you get your money back after a scam?

With crypto, there's almost no chance: transactions cannot be reversed. If you paid by card recently, you can try to recover the payment through your bank. That's why it's better to use a separate card with a small balance when buying consumables or dealing with unfamiliar sellers.