A withheld payout is almost always explained with one word: fraud. Behind that word sit several different things, and some of them are entered by accident.
Multi-accounting
One person registering several times to collect a bonus or credit themselves a deposit. Detected by device, address and payment details. Registering under your own link belongs here too, and it is the most common «I did not know».
Incentivised traffic
Players who were paid or promised something to register. They deposit the minimum and disappear. To the programme that is a loss, and such sources get cut off.
Inflated numbers
Artificial clicks and registrations for the sake of volume. Visible immediately from behaviour: registrations happen, play does not.
How people trip into it
Working several accounts from one subnet. Test registrations «to check the link» from your own device. Traffic bought from a contractor who inflated it for you — you will be the one answering.
On address relatedness: subnet reputation.
How to protect yourself
Keep your own statistics from day one: in a review it is the only thing that demonstrates the traffic was real — how to keep them. Do not test links by registering. Know where a contractor's traffic comes from.
If a payout is already held
Ask for specifics: which players and on what signal. A blanket «fraud» with no detail is a reason to reconsider the offer rather than yourself — signals are in choosing an offer.