How to Choose a CPA Traffic Source
CPA sounds like the safest deal in performance marketing. You pay only when someone registers, buys, or completes whatever action you defined. No action, no invoice.
The fraud data says otherwise. In AppsFlyer’s State of Fraud for Marketers 2026, based on more than 106 billion installs, affiliate networks showed a fraud rate of around 40% throughout the period. Self-reporting networks like the big social and search platforms sat at about 1%. By Q1 2026 the gap had reached 36x. Paying per action only protects you if the actions are real, and a lot of them aren’t.
So choosing a CPA source mostly comes down to checking it. We put together the questions we’d ask any partner before the first dollar goes out.
First, Which Kind of CPA Are We Talking About?
The term covers two quite different things.
On ad platforms, CPA is a bidding strategy. In Google Ads, Target CPA sets bids automatically to get as many conversions as possible at the average cost per action you choose. You’re still buying from Google’s inventory. The platform just optimizes toward your target.
This article is about the other kind: sources that sell you actions directly. That includes CPA and affiliate networks, individual affiliates (who often resell traffic from their own sub-affiliates), rewarded platforms like offerwalls and rewards apps, and task-based platforms where real users complete actions you define. They differ a lot in how much you can see and control.
10 Questions to Ask Before You Sign
1. Where exactly does the traffic come from?
“Our network” isn’t an answer. You want to know whether you’re getting users from websites, apps, social media accounts, email lists, or rewards apps, and ideally which ones.
A good partner can show you this at the level of a sub-ID or a referring domain. Some affiliate platforms build it into their rules: Commission Factory, for example, requires subnetworks to pass back the domain of the traffic source for every transaction. If a source refuses to share anything beyond total conversions, treat that as a warning.
2. Do you use sub-affiliates?
Many affiliates don’t generate all their traffic themselves. They pass your offer to smaller partners, who sometimes pass it further down the chain. Each step adds distance between you and the people actually sending users.
With a long chain, nobody sees the whole picture. The network knows its affiliate’s ID, the affiliate knows its sub-IDs, and the person buying the traffic sees only their own sources. Ask how many levels there are, and whether you can block a specific sub-source without dropping the whole partner.
3. Is any of the traffic incentivized, and how is it labeled?
Incentivized traffic isn’t a problem in itself. Users get a reward for completing an action, and for many offers that’s a perfectly legitimate channel. We cover how it works in Rewarded User Acquisition: How It Works.
What causes trouble is incentivized traffic that’s hidden. Rewarded users behave differently from people who found you on their own, and mixing them into one cohort quietly ruins your benchmarks. Ask for incentivized traffic to be labeled separately or delivered through its own sub-ID or account. If a source says it has none, ask how it checks that its sub-affiliates don’t either.
4. How are conversions reported?
Server-to-server postbacks are the standard. When a user completes the action, your tracking system (or MMP, for apps) tells the partner’s server directly, with a click ID linking the conversion to the original click. Browser pixels can be blocked, duplicated, or fired from places they shouldn’t be.
Ask which method they use, how they handle duplicate conversions, and whose numbers count when yours and theirs don’t match. Settle the last one in writing, before the first payout.
5. What exactly counts as an action?
“Registration” can mean an email typed into a form or a verified account that completed onboarding. “Purchase” can include orders that are later refunded. Define the action precisely, along with how it’s confirmed and what happens to conversions that turn out to be fake or reversed.
The deeper in your funnel the paid event sits, the harder it is to fake. AppsFlyer’s data shows the same pattern from the other direction: in categories where advertisers pay only for high-value actions, a much smaller share of installs passes store validation, because that’s where fraudsters concentrate their effort.
6. What fraud checks do you run, and what happens to bad conversions?
Every source will say it has fraud protection. Ask what it actually looks for: device and IP anomalies, click-to-conversion timing, emulators, unusual behavior after the action. Then ask what happens when fraud is found. Do they reject the conversion before billing you, refund it afterwards, or leave it to you to argue?
Don’t rely only on their side. Run your own fraud protection through your MMP or tracking platform from the first day.
7. Can we start small?
A source you can trust won’t object to a test with a small budget, daily caps, and limited geos. A source that pushes you to commit large volumes before you’ve seen any data is making the decision easier for itself, not for you.
8. What data will we get beyond conversions?
A conversion count tells you how much to pay. It doesn’t tell you whether those users were worth it. Ask whether you’ll see breakdowns by sub-source, geo, and date, and whether the partner can work with your retention or revenue data to adjust bids. Partners that optimize toward users who stay are worth more than partners that optimize toward the cheapest possible action.
9. What are the payment and dispute terms?
Find out how long you have to review conversions before paying, what evidence is needed to reject them, and whether payouts can be held while a dispute is open. Net terms with a review window give you time to check quality. Prepayment for unverified volume doesn’t.
10. Does the traffic comply with app store and platform rules?
For apps, this matters a lot. Paying for ratings or reviews breaks Apple’s App Review Guidelines and Google Play’s User Ratings, Reviews, and Installs policy. Installs bought only to push chart positions can get filtered out or worse. Ask directly whether any part of the offer involves store ratings, reviews, or rank manipulation, and walk away if it does.
Red Flags
- Conversion rates far above anything you see elsewhere. Real users don’t convert at 40% from a cold click.
- Conversions that arrive in bursts, at odd hours, or seconds after the click.
- A refusal to share sub-IDs or source domains “for competitive reasons.”
- Pressure to scale fast, especially right before a seasonal peak. AppsFlyer’s report has a useful example: affiliate fraud in shopping apps climbed from 27% to 36% over the year and peaked at 41% in Q4, when advertisers plugged in new networks with loose controls for holiday campaigns.
- Users who complete the paid action and never come back.
How to Run the First Test
Pick one action that predicts real value, not the easiest one to count. Set a small budget and a daily cap. Track the source as its own cohort, separate from everything else, and look at it again at day 7 and day 30: are these users still active, still paying, still there?
Expect fraud to move rather than disappear. When finance advertisers in AppsFlyer’s study tightened their affiliate controls, the affiliate share of fraud dropped from 58% to 49%, while the share hiding in organic traffic rose from 35% to 46%. Keep an eye on your organic numbers while a test runs, too. We wrote more about that in Incentivized Traffic vs. Organic Traffic.
Strict partners and strict advertisers do get results. AppsFlyer found that affiliate fraud in gaming fell from 29% to 14% in a year, and attributes it to gaming advertisers enforcing KPIs consistently over several years.
Where IPweb Fits
IPweb is a task-based source, so most of these questions have short answers. You define the task yourself, whether that’s a visit, a registration, or a specific step in your funnel. The people completing it are real English-speaking users with unique IP addresses, and you pay only for completed tasks. There’s no chain of sub-affiliates between you and the user, and you can start with a small test. For a wider comparison of rewarded and incentivized sources, see Best Incentivized Traffic Sources for App Marketers.
Want to test a CPA source you can actually see into? Create a task on IPweb, set your own action, and judge the users before you scale.
Internet Marketer
