Reviews
Part of 6 points on choosing fraud detection tools
Fraud detection evidence: how to read a coverage claim
Fraud detection evidence, surface by surface: the four kinds of proof, what each platform's authorized and public levels establish, and what to ask a vendor.
Coverage is the claim that sells fraud detection tools, and it hides the only thing worth knowing: what kind of evidence is obtainable on each surface. For an influencer agency vetting creators, a product that lists Instagram, TikTok, YouTube, X, Facebook and Pinterest may hold authorized access on one, public collection on three, and a profile field on the rest.
That difference decides whether an output is a finding or a guess. This page is about the evidence, surface by surface, and what to ask when a support claim arrives with no level attached.
What to take away
- Ask what evidence is obtainable, not which platforms are supported. Support is not a level.
- Server side records beat anything measured in a browser, and you usually already own them.
- The strongest evidence about a creator comes from the creator, and no product can supply it.
Why no ranking is offered
Products in this category are not substitutes. One works on traffic and payouts, where the evidence is in logs you control. Another works on audiences, where the evidence is public or authorized and never conclusive. An agency that buys the wrong half of that split has bought something excellent for a problem it does not have.
Coverage also moves faster than any page can track. Sources open and close and terms change, so a product's real position can shift in a quarter with no announcement. What is durable is knowing how to ask.
Four kinds of fraud detection evidence, and where each lives
Four kinds of evidence
| Evidence type | Where it comes from | What it can establish | What it cannot |
|---|---|---|---|
| Your own server logs | Your systems, already yours | Timing, repetition, sources with no downstream behavior | Anything about who a person is |
| Payout chain records | The platform running the payments, if you may read them | Clicks landing after a decision, credit concentrating oddly | Intent |
| Authorized creator analytics | The creator's own account, with permission | Audience makeup and reach over a stated window | Anything after permission ends |
| Public and modeled signals | Collected from visible pages, then inferred | Growth shape, engagement patterns, a place to look first | A claim about any individual, stated as fact |
The first row is the one agencies overlook and the cheapest to use. Signals recorded on your own side are harder to manipulate than anything measured in a visitor's browser, because the browser is the environment the other party controls. Browser-side evidence is what a tag, pixel or script reports from the visitor's device: page events, device and browser characteristics, cookies. All of it can be blocked, spoofed or replayed by whoever runs that device, while a server log records what actually reached your systems. Where the concern is click fraud rather than audience quality, most of the usable evidence is already in your logs and needs no purchase at all.
Four Evidence Types and Limits
Server logs
- Source
- Your systems
- Establishes
- Timing, repetition
- Cannot
- Who a person is
- Access
- Already yours
Payout records
- Source
- Payment platform
- Establishes
- Clicks after decision
- Cannot
- Intent
- Access
- If permitted
Creator analytics
- Source
- Creator account
- Establishes
- Audience makeup
- Cannot
- After permission ends
- Access
- With permission
Public signals
- Source
- Visible pages
- Establishes
- Growth shape
- Cannot
- Individual claims
- Access
- Public
The second row often belongs to someone else.
If the booking runs through an intermediary, its dispute clause decides which records it keeps and which it leaves with you, as the creator marketplaces guide explains.
What each level looks like on a named platform
A coverage claim resolves into these levels. Instagram: the authorized level runs through the Instagram Graph API, where an insights permission covers audience makeup and reach for a connected professional account; the public level reaches follower counts, posting rhythm and visible engagement; the profile level is what any visitor sees. TikTok: the authorized level runs through the Display API for a connected account, the public level covers profile and video data, and audience demographics arrive only from the creator's own analytics. YouTube: the Data API reports public channel statistics to anyone, and the authorized level runs through the YouTube Analytics API, which is the only place demographics exist. None of this tells you which level a given product holds on your roster, and that is the question in the next section.
What a support claim should be broken into
Ask a vendor to place each platform it claims into one of the four rows above. Then ask three follow ups.
Vendor Coverage Follow-Ups
- Ask proportion of roster with live authorized connection
- Ask which fields require which permission
- Ask what interface shows when connection revoked
- Ask vendor to place each platform in four rows
What proportion of the roster currently holds a live authorized connection. This is the honest version of the coverage figure, and most vendors can produce it when asked plainly.
Which fields require which permission. A grant that allows reach figures does not necessarily allow audience geography, so coverage of a platform is really coverage of a particular permission on it.
What the interface shows when a connection is revoked. A product that silently falls back to estimates presents two different kinds of claim in the same place, and nobody reading that screen a month later can tell them apart.
Traffic evidence against audience evidence
These are different problems, they need different products, and conflating them is the most common category error here.
Traffic and payout questions are about behavior: visits with no downstream action, timing that repeats, credit landing on the same partner every time. Where money is moving through a partner chain, the validation and clawback mechanics that make evidence usable are set out in the guide to how partner programs work.
The evidence there is in logs, the strongest of it yours, and a conclusion can be firm because you can see the whole path.
Audience questions are about people, and the evidence is indirect by nature. Growth arriving in steps, engagement that does not move with reach, comments that would fit any post. None of it proves anything about an individual, and a product that says otherwise is overselling.
The ceiling is a pattern that is hard to explain otherwise, which is enough to decline a booking and not enough to make an accusation.
The law has moved on the buying side. The Federal Trade Commission's final rule banning fake reviews and testimonials, formally the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials at 16 CFR 465 and published in the Federal Register on August 22, 2024 as 89 FR 68034, was approved by a 5-0 Commission vote and effective 60 days after publication. It lets the agency seek civil penalties against knowing violators. It prohibits anyone from selling or buying fake indicators of social media influence, such as followers or views generated by a bot or hijacked account, where the buyer knew or should have known they were fake and they misrepresent the buyer's influence for a commercial purpose. That makes a documented anomaly worth recording carefully, and it is still a reason to decline rather than a finding against a named creator.
Signals that survive scrutiny on any surface
Some indicators hold up when challenged, and they are worth knowing independently of any product. Why the ceiling above sits where it does, and what audience evidence can honestly establish, is set out in the pillar guide to detection and audience quality.
Growth over time, because real audiences do not arrive in blocks. Whether engagement volume moves with reach or independently of it. Whether comments respond to the actual content. The gap between a stated audience and the analytics from the creator's own account for a stated window. Traffic sources that convert at zero across meaningful volume.
Some collapse on the first question. A single engagement rate threshold applied across categories, since normal ranges differ enormously by format and audience size. Follower to following ratio alone. And any flag rate quoted without a base rate, which is the base rate fallacy in its most expensive form, because a rare thing tested at scale produces mostly false alarms even from an accurate test.
When a source changes
Every product here depends on access it does not control, so ask the historical question: what did you do the last time a platform changed what it exposed, how long was the gap, and how did customers find out? Specifics indicate a vendor who has been through it.
Then ask what you keep if it goes badly. Data already collected under an authorized connection is a different asset from live access, and whether you retain it is a contract matter rather than a technical one.
That is the same exposure that makes an export test the cheapest item in any evaluation, as the guide to comparing suppliers argues.
Common questions
A vendor claims full coverage of a platform. What does that usually mean?
Public collection for everyone, plus authorized data for whoever connected. Ask for the proportion with a live connection and the claim resolves itself.
Should we buy the broadest coverage available?
Only if you buy broadly. Depth where your spend concentrates is worth more than breadth across surfaces you never use.
Two products disagree about the same account. Who is right?
Possibly neither. Ask each what the output is built from and over what window, then treat the disagreement as the finding and go to the creator's own analytics.
Can we do useful detection with no product at all?
On traffic and payouts, frequently yes, because the evidence is in your own logs. On audiences it is slower and still possible, and it teaches your team what a real anomaly looks like.
