All the scammers have to do is purchase say x% of clicks and the. Refund the money. It's very hard to track which ad click generated exactly which sale. For example through Adwords content network you don't know which site generated the click/purchase. You can know that content network ads gets more refunds, but without access to googles data you can't know the specifics.

So as good as CPA sounds, its not full proof either. You can just bypass it with either stolen credit card purchases or refunds.