Paying for Growth Without Paying for Fraud: A Guide for Fintech and Crypto Apps

An advertiser recently contacted us with good news. Their campaign was performing exceptionally well. Users were spending more, and the revenue generated for every dollar spent on advertising had improved considerably.

We examined the results and found something quite different. The traffic was fraudulent, exploiting a vulnerability on the advertiser’s side. We introduced additional protections and asked the advertiser to identify and fix the problem.

The experience illustrates something I’ve learned over years of working in fraud prevention: unusually good results deserve as much attention as disappointing ones. A campaign can appear to be delivering excellent returns, while in reality, the company is paying for activity that brings little genuine value.

For fintech and crypto companies, this is particularly important when customer acquisition relies on financial rewards. According to Sumsub’s Identity Fraud Report 2025-2026, sophisticated identity fraud increased by 180% worldwide between 2024 and 2025. The report also describes a move towards more complex, multi-step fraud schemes.

The question for finance leaders is how to keep rewarding real customers without allowing fraudsters to collect a growing share of the acquisition budget.

Why Are Growth Incentives the First Target for Fraud?

Sign-up bonuses and referral programs are obvious targets because they offer money for relatively little effort.

Someone signs up, claims a bonus, and realizes there’s nothing preventing them from collecting another one. Why stop after the second account? Referral rewards can be exploited in much the same way if users can repeatedly collect payments without introducing new customers.

Fraudsters actively look for these opportunities, scouting for emerging companies that may be offering attractive incentives before their fraud prevention processes are properly tested. An established business launching a new referral program can be equally exposed if it hasn’t experienced this type of abuse at scale.

Now, I don’t want to discourage companies from offering rewards. They can be highly effective at attracting customers. But the incentives need to encourage the behavior the business actually wants, with safeguards that prevent repeated abuse.

AI has made this problem more complicated.

Previously, automating large numbers of fraudulent registrations required someone who could write scripts or develop bots. Today, people with limited technical experience can use AI to create those tools and adapt them as circumstances change.

I’ve observed a decentralization of fraud as a result. Activities that once required technically sophisticated groups are increasingly accessible to smaller operations and even individuals.

That changes the challenge for companies, since they aren’t necessarily dealing with a handful of professional fraud groups anymore. A poorly protected incentive can attract many independent attempts at abuse, especially when the reward can be collected repeatedly.

Why Can Excellent Campaign Results Be Suspicious?

Growth teams usually investigate disappointing campaign results. But I think they should be equally interested in fully understanding unexpectedly good ones.

For instance, consider return on ad spend, or ROAS, which measures how much revenue a campaign generates for every dollar spent on advertising.

A low return suggests that the acquired customers aren’t producing enough value. But an exceptionally high return can also indicate fraud, particularly when it represents a sudden departure from previous performance.

Fraudsters can take advantage of weaknesses that allow fake purchases to appear as actual transactions. They may exploit insufficiently protected payment processes or promotions in which the reward exceeds the cost of the activity required to earn it.

These are different problems, but they have something in common: the numbers can appear attractive even when the activity behind them is fraudulent.

In the advertiser case I described earlier, the sudden improvement was precisely what prompted us to investigate. The advertiser saw higher spending and better returns. Our examination of the underlying activity revealed a vulnerability being exploited.

During the first days of a campaign, I want to understand who is signing up and what those users are doing. Are there unusual similarities between accounts? Does their behavior make sense for the financial product being advertised?

Monitoring also needs to continue after launch, and here, the challenge is identifying unusual activity quickly without overwhelming analysts with false alarms. An alert that constantly fires becomes difficult to trust, while one that misses important changes leaves the company exposed.

Finance leaders should expect growth teams to explain significant improvements in campaign performance before approving additional spending.

What Should You Ask Acquisition Partners Before Scaling?

Before increasing spending with an advertising network or acquisition partner, I would ask two questions:

What incentives are users receiving, and what’s stopping fraudsters from collecting those incentives at scale?

I would expect anyone managing customer acquisition to understand the questions and have a convincing answer.

Here are some responses that would make me reconsider increasing the budget:

• The partner cannot clearly explain how users are rewarded
• They avoid discussing how those incentives could be abused
• They dismiss fraud as an unlikely problem
• They cannot discuss previous experience handling fraudulent activity
• They claim they’ve never encountered fraud

That last answer, in particular, is a major red flag.

When someone tells me they’ve never had a problem with fraud, I question whether they have enough experience recognizing it. Acknowledging the problem is a basic part of managing it.

Partners don’t need to reveal confidential detection methods. But they do need to understand the incentives they are offering and be prepared to discuss how they handle abuse.

These conversations should happen before a company commits a larger budget. Once a campaign scales, the cost of discovering that nobody has considered these questions can easily skyrocket.

Is Paying for Verified Actions Enough?

One way to make incentives harder to exploit is to reward actions that require more commitment than simply opening an account.

For fintech and crypto apps, examples include passing an identity check, making a deposit or completing a trade. Adding this friction makes repeated abuse more difficult. However, none of these actions provides a guarantee.

Professional fraud operations have resources to overcome obstacles that companies sometimes consider sufficient. I’ve seen identity checks passed to people in other parts of the world, probably for a dollar or two per successful verification. If the reward is considerably higher, that additional step remains profitable to exploit.

Deposits and trades aren’t foolproof either. Automated tools can complete them quickly, so a completed transaction doesn’t necessarily prove that the person behind it intends to become a real customer.

I place much greater importance on what happens over time.

Real users should be rewarded for engagement that shows either genuine loyalty over time or financial risk-taking. Fraudsters don’t like either.

Someone who continues using a product because it serves a real purpose is very different from someone whose interest disappears as soon as the bonus is collected.

Of course, additional verification can discourage legitimate customers, too. That’s the constant tension between growth and fraud prevention, and there’s no single set of requirements that will work for every business.

Good analysis of incoming traffic helps companies understand where additional safeguards are necessary. When something unusual appears, fraud prevention teams need to investigate promptly and work closely with product and development teams to address it.

The goal is to protect the rewards available to real customers while making abuse increasingly difficult to sustain.

What Should Finance Leaders Do Next?

AI will make fraud prevention more demanding over the next two or three years, but it also offers companies an opportunity to become considerably more effective.

Fraudsters are already using AI to automate work that previously required technical expertise. Fraud prevention teams should be using it to their advantage as well.

I would deploy AI agents that can review traffic up to 100 times faster than a human analyst and flag anomalies for the fraud team to investigate.

If a CFO could ask one question every month, mine would be: What percentage of the activity in each customer acquisition campaign is fraudulent? Acquisition managers should know that figure, or at least have a credible estimate. If they cannot explain it, they don’t have a complete picture of the return on their spending.