Stop Lead Theft in Solo Ads: 21 Vetting Questions Buyers Use

Lead theft in solo ads happens when the traffic or opt-ins you paid for are falsified, recycled, or misattributed to someone else's campaign. The primary red flags are mismatched click counts, opt-ins that convert nowhere, and vendors who resist sharing raw tracking data. If you're seeing any of that, stop buying from that vendor and verify your click-level tracking before you spend another dollar.

---

TL;DR:

• Verifying click-level data with unique tracking links and timestamp matching is essential to detect lead theft before scaling up campaigns.
• Signs of fraud include duplicated opt-ins, sudden click spikes, non-human email addresses, and traffic routing through the same IP ranges.
• Mechanical tactics behind lead theft involve click stuffing, redirect stacking, and manipulating tracking parameters to inflate reported numbers falsely.
• A small test buy with a tracked link helps confirm traffic authenticity by comparing actual logs against vendor claims, especially when vendor transparency is lacking.
• Preserving raw logs, timestamps, and opt-in records is crucial for evidence if you suspect lead theft and need to negotiate or report violations.

---

Table of Contents

• What lead theft looks like in solo ads
• Tactics bad actors use to fake traffic
• How to detect and verify leads and traffic quality
• Preventing lead theft with a buyer-first vetting checklist
• If your leads were stolen: what to do next
• An experienced solo ad vendor's take on tracking versus trust
• Where to start verifying your next solo ad buy
• Sources
• FAQ

What lead theft looks like in solo ads

Lead theft rarely announces itself. It shows up as small inconsistencies that, once you notice the pattern, are hard to ignore.

A vendor might report 500 clicks, but your landing page logs only 310 visits. That gap is either a tracking error or evidence that a portion of the "traffic" never reached your page at all. Duplicated opt-ins are another common sign: the same email address shows up across two or three unrelated solo ad buys, which suggests a vendor is reselling one list to multiple buyers as if each purchase were unique. Misattributed conversions happen when a vendor's tracking pixel fires without a genuine human action behind it, inflating your reported numbers while your actual opt-in rate stays flat.

Vendor delivery practices add to the confusion. Many solo ad sellers rotate offers across a shared subscriber base, batch-send across several hours, or use third-party autoresponders that strip identifying data before it reaches you. None of that is automatically fraud, but it creates enough ambiguity that a dishonest vendor can hide behind "that's just how the list works."

Watch for these metric-level signs that should trigger a closer look:

• A sharp spike in clicks followed by an immediate drop in engagement, which often points to bot traffic or click stuffing.
• Opt-in rates that are unusually high compared to your historical average, with almost no follow-up engagement.
• Clicks that arrive in tight, unnatural bursts rather than spread across the delivery window.
• Leads with malformed or clearly fake email addresses that still count toward your paid total.

Any one of these alone might be noise. Two or more together, especially from the same vendor, are worth investigating before you place a second order.

Tactics bad actors use to fake traffic

Understanding the mechanics behind lead theft helps you match what you're seeing in your logs to a likely cause, rather than guessing.

On the technical side, click stuffing loads multiple fraudulent click events behind a single ad impression, inflating the count a vendor reports without any real visitor involved. Redirect stacking routes a click through several intermediate URLs before it lands on your page, which can be used to inject extra click credit or obscure the traffic's true origin. Tracking parameter manipulation strips or rewrites your UTM tags and click IDs mid-redirect, breaking the link between what you paid for and what your analytics actually recorded.

Non-technical tactics are just as common. Some vendors resell the same opt-in list to multiple buyers, presenting recycled subscribers as fresh traffic each time. Others scrape email addresses from public sources or old lists and submit them as if they opted in through your campaign. Falsified opt-ins, where a name and email are entered into your form without the person's knowledge or consent, are one of the more damaging versions of this because they can also expose you to CAN-SPAM liability if you later email that address.

Masking the origin of traffic is the final layer. Proxies, open relays, and recycled IP addresses let a vendor route low-quality or bot traffic through addresses that look geographically diverse, making the traffic appear organic when your server logs would otherwise flag it as repetitive.

Pro Tip: If a vendor's traffic all routes through the same handful of IP ranges regardless of the delivery date, ask them directly to explain it before your next buy.

How to detect and verify leads and traffic quality

Detection is a matter of comparing what you were promised against what your own systems recorded, not what the vendor reports back to you.

Start with these steps before you scale any solo ad relationship:

1. Set up click-level tracking using unique click IDs or UTM parameters for every vendor, so each seller's traffic is logged separately from day one.
2. Log timestamps at the server level, not just in your email autoresponder, so you have an independent record that doesn't depend on the vendor's reporting tools.
3. Match opt-in records to click logs by comparing the timestamp and source parameter on each lead against the corresponding click event.
4. Run a small instrumented test buy using a seeded, unique link or a control landing page that only that vendor receives, so any traffic showing up elsewhere is immediately suspicious.
5. Flag mismatches where an opt-in exists with no matching click, or a click exists with no corresponding opt-in, and treat repeated mismatches as a pattern rather than a one-off glitch.

The guides on click tracking and traffic verification walk through how to structure this kind of test buy step by step, including what a clean set of logs should look like compared to one with gaps.

The strongest evidence you can hold is a click-level match between an individual click and its corresponding opt-in record. Vendor promises without that match are weak evidence at best.

What to collect and retain matters as much as the test itself. Save raw click logs, landing-page server logs, and full email headers for every opt-in, not just a summary export. Timestamps are the connective tissue: a click at 2:14 PM followed by an opt-in at 2:15 PM on the same tracked link is a clean match. An opt-in that appears with no click, or a click that never converts anywhere in your funnel, is the kind of mismatch worth flagging and documenting for a vendor conversation.

Preventing lead theft with a buyer-first vetting checklist

The best time to catch a bad vendor is before you send payment, not after the leads arrive.

A short, practical version of a full vetting process looks like this:

1. Ask for click tracking proof from a recent campaign, including click IDs and timestamps, before you commit to a buy.
2. Ask where the list originated and how subscribers were acquired, since a vague answer here is itself a signal.
3. Ask whether the traffic is exclusive to your order or shared with other buyers during the same delivery window.
4. Ask to see sample opt-in records with timestamps that you can cross-reference against your own tracking once delivery starts.
5. Ask about the refund or replacement policy for traffic that fails to convert or fails to match your tracking logs.

These five questions are a condensed entry point into the fuller 21-question vendor vetting framework, which covers list hygiene, delivery scheduling, and how a vendor handles disputes in more detail.

Designing a small instrumented test is straightforward. Order the smallest click package the vendor offers, route it through a unique tracked link, and set your success metric as the percentage of clicks that produce a real, verifiable opt-in with a matching timestamp. A healthy test shows clicks and opt-ins arriving in a reasonable, spread-out pattern that matches typical human browsing behavior rather than an unnatural burst.

Certain responses should end the conversation outright:

• A vendor who refuses to provide any click logs or timestamped proof of delivery.
• A vendor who cannot explain where their subscriber list originated.
• Pricing that is dramatically below the market range with no explanation for the gap.
• Pressure to buy a large volume immediately, before a small test is even complete.

Pro Tip: Never skip the small test buy, even with a vendor a friend recommends. Tracking data changes vendor by vendor, and a good relationship elsewhere doesn't guarantee a clean log this time.

If your leads were stolen: what to do next

If your tracking data confirms a mismatch, move quickly while the evidence is still intact.

• Save raw click logs, server-side timestamps, and full opt-in records before you contact the vendor, since some platforms overwrite data after a set period.
• Keep every communication record with the vendor, including the original order confirmation and any promises made about traffic quality or exclusivity.
• Present the mismatch clearly: show the vendor the specific clicks with no matching opt-in, or opt-ins with no matching click, rather than describing the problem in general terms.
• Ask for a specific remedy: replacement traffic, a partial or full refund, or full transparency into their delivery logs.
• File a complaint with the FTC if the vendor's practices involve deceptive commercial email, since the CAN-SPAM compliance guide outlines sender identification requirements and penalties that can apply per violating email.

The affiliate fraud verification checklist breaks down exactly which logs to pull together before that conversation, so you're not scrambling for evidence after the fact.

An experienced solo ad vendor's take on tracking versus trust

After 11 years selling and buying solo ad traffic, the pattern I keep seeing is buyers trusting a vendor's word over their own tracking setup. A guarantee is only as good as the vendor's willingness to show you click-level logs that back it up. If they can't produce a match between an individual click and an opt-in, the guarantee is marketing language, not proof.

A small test buy should always come before a large one. Expect a short delay in getting complete logs from a legitimate vendor, but expect to get them. The buyers who avoid getting burned aren't the ones who found a "trustworthy" seller. They're the ones who built a habit of checking the data themselves.

— Philip Coble

Where to start verifying your next solo ad buy

This resource was built around the same principle: verify before you buy, and don’t take a vendor’s word for traffic quality. The site walks through the full 21-question vetting framework, click tracking setup guides, and how to read your logs after a test buy.

If you're about to order from a new vendor, run a small instrumented test first using the checklist on Soloadsguide and compare your own server logs against what they report back.

FAQ

What counts as lead theft in solo ads?

Lead theft is when the clicks or opt-ins you paid for are falsified, recycled from another buyer's list, or misattributed through broken tracking. It shows up as a gap between what a vendor reports and what your own server logs and opt-in records actually confirm.

How can I tell if a solo ad vendor is reselling the same list?

The clearest sign is duplicated opt-ins, where the same email address appears across purchases from different buyers or campaigns. Comparing timestamps on your opt-in records against your click logs will usually expose the pattern within a small test buy.

What should I do if I suspect stolen leads?

Preserve your raw click logs, server timestamps, and opt-in records immediately, since some platforms overwrite this data over time. Present the specific mismatches to the vendor and ask for a replacement, refund, or full transparency into their delivery logs.

Can I report a solo ad vendor to the FTC?

Yes, if the vendor's practices involve deceptive commercial email, you can file a complaint referencing the CAN-SPAM Act, which sets rules for sender identification and can carry penalties per violating email. This applies to deceptive email practices rather than every kind of solo ad dispute.

What is the best way to prevent lead theft before buying?

Run a small instrumented test buy with a unique tracked link before committing to a larger order, and ask the vendor for click-level tracking proof up front. A short vendor vetting checklist covering list origin, exclusivity, and refund policy catches most red flags before money changes hands.

Recommended

• Solo Ad Buyers: 50–200 Click Test and 21 Questions to Verify Leads
• How to Vet Solo Ad Sellers (Before You Spend a Dollar)
• Solo Ad Buyers: 21 Questions to Vet Fake Conversions