As for the timing, it always happens before payout for one clear reason: since so many accounts never earn enough to get paid out it makes no sense to do significant auditing until there's an actual disbursement of cash. Thus the catch that many fraudulent (or suspected fraudulent) accounts don't get flagged until they actually trigger a payment.
