> For the complete documentation index, see [llms.txt](https://help.impact.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.impact.com/brand/what-would-you-like-to-learn-about/advocate-program/protect-your-advocate-program/security-features-for-referral-programs.md).
# Security Features for Referral Programs
Fraud prevention is a consideration for every company with a referral program. Inevitably, someone will test the system. Although you can’t change the intentions of bad actors, you can design your program to minimize fraudulent behavior. Combining our standard Advocate security features with good program design minimizes the risks posed by fraudulent activity.
## Use built-in security features
Turn on Fraud Protection
Your Advocate program has an optional, automated Fraud Protection feature that can be used together with manual actions like blocking email domains and specific participants and IP addresses to mitigate the effects of fraudulent behavior. When Fraud Protection is turned on, all referrals are assigned a fraud score based on various risk factors. Referrals are approved, denied, or placed into a pending state for your manual review based on their fraud score. Learn more about how [Fraud Protection](/brand/what-would-you-like-to-learn-about/advocate-program/protect-your-advocate-program/advocate-fraud-protection-explained.md) works.
Block email domains
We automatically compare referred friends’ email addresses against an extensive list of known disposable and temporary email domains. Our system also lets you manually block domains from within your impact.com account settings. Learn more by viewing our [Blocked Email Domains](/brand/what-would-you-like-to-learn-about/advocate-program/protect-your-advocate-program/block-an-email-domain-for-advocate.md) article.
Block participants and IP addresses
Blocking participants can be done in a few ways:
* You can invalidate a participant’s referral code to prevent them from making successful referrals. When the participant tries to use their code, they’ll receive a `404 Not Found` message, or they won’t get attribution credit for the referral they made.
* Individual IP addresses or a range of IP addresses can be blocked within your impact.com account settings.
* Participants from specific countries can also be blocked if you have configured your data sharing settings to include sending us participant locale information.
## What happens when you block?
Blocking isn't instant or absolute in every case—it behaves differently depending on whether the block targets an IP address or a person, and whether the affected user already has an account. Here's exactly what to expect on both sides of a block, and what happens if you later unblock.
When you block an IP address
**For the blocked IP:**
* Any new users who register from that IP address are automatically blocked upon registration.
* Existing users with that IP are not blocked automatically and can continue using the program.
* Existing users with that IP can continue to log in to the Microsite and access their share links.
* If someone clicks a referral link from a blocked IP, no `_saasquatch` cookie is dropped.
**For referrals from a blocked IP:**
* If a person clicks a referral link from a blocked IP, they still go through the referred user experience and land on the program landing page.
* The advocate will *not* receive a reward, since no cookie is dropped.
* If the brand manages rewards using the cookie to detect referrals, the referred user will *not* receive their reward.
* If the brand manages rewards by checking for the `rsCode` in the URL, the referred user might still receive their reward.
* No referral will be created in Advocate, so it won't appear in the referral feed or referral history table.
* If the referred user is already registered in Advocate, they will be blocked automatically, preventing them from being referred.
* If the brand uses the [Friend Widget](/brand/what-would-you-like-to-learn-about/advocate-program/manage-advocate-participant-experiences/widget-experiences/widget-types-explained.md#friend-widget) to distribute discounts, the referred user will see an error on submission because no reward code is available.
**When unblocking an IP:**
* Users automatically blocked because of the IP restriction remain blocked, but can be manually unblocked if desired.
* Existing referrals that were auto-moderated must be reviewed manually.
When you block a user, participant, or email address
**For the blocked user**
* The user will be blocked from logging in to the Microsite and will see an "Account Disabled" error message.
* The user can still access widgets and retrieve their share link.
* The user cannot be referred.
* This user cannot make new referrals.
* If the user clicks their own share link, it behaves the same as any other person clicking a blocked advocate's link — no cookie is dropped.
**For referrals made by a blocked user**
* When a referred user clicks a blocked user's share link, they still go through the referred user experience.
* The advocate will *not* receive a reward.
* The referred user will likely *not* receive their reward unless the brand manages rewards independently.
* No referral will be created in Advocate.
* In-progress referrals made by this user will not be converted or rewarded.
* If the brand uses the Friend Widget, the referred user will see an error on submit because no reward code is available.
**Notifications**
* No notification is sent to the blocked user.
* No notification is sent to program admins.
**When unblocking a user**
* The user can be unblocked.
* Existing referrals that were auto-moderated must be reviewed manually.
* Previous referrals may be rewarded if a conversion event is received after the user is unblocked, and the user is eligible for rewards per program rules.
## Design your program with fraud prevention in mind
A common form of referral program fraud is someone trying to refer themselves multiple times to get rewarded. Programs that offer double-sided rewards for both the advocate and the referred friend are especially appealing for this type of fraud. Fortunately, with thoughtful design, you can minimize the impact of these attempts to game the system. Learn more about [designing a fraud-proof referral program](/brand/what-would-you-like-to-learn-about/advocate-program/protect-your-advocate-program/design-a-fraud-proof-referral-program.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.impact.com/brand/what-would-you-like-to-learn-about/advocate-program/protect-your-advocate-program/security-features-for-referral-programs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.