I’m currently working on my Referral System, but I have a problem with protecting it of frauds.
Okay, here’s how it works for now:
- user registers and activate it’s account
- user now have access to the control panel and there is it’s uniqe link in following format: domain.tld/ref/12345
- when someone other click to user’s link, he or she must to click a specific button to confirm that is not some kind of fraud (like “click here, you’ll get $100” or something)
- system writes visitor’s IP in a database and some data to cookies to prevent re-pressing the button. User now have +1 point.
But, the problem is that visitor can change it’s IP, clear cookies and hit button again. It takes a few seconds, and that’s not OK, that’s cheating.
How to prevent it? Is there some trick to get some unique computer ID or something can’t be changed that easy?
Really the only options are to tie the process to something which is not so easily manipulated by the user – super cookies, browser fingerprints, OpenID, Email addresses and telephome numbers (the latter 2 using some sort of validaton step before a vote is counted)