Are there accepted criteria to define an author's institutional affiliation?
This is pretty old, but I will provide an answer to an increasingly relevant question. Affiliation is understood to be where the major part of the work was done. If this is not the author's current primary employment, then those details should be included in the contact details and/or acknowledgements. Any paid affiliation is unethical. Surprisingly, I did not find any reference to this "creative affiliation" in the COPE standards https://publicationethics.org/. 

Many publishers include a statement about what to do if affiliation changes during the publication process - i.e. how to credit the institution where the work was begun and the institution where the publication was finalized. For example "Present/permanent address. If an author has moved since the work described in the article was done, or was visiting at the time, a 'Present address' (or 'Permanent address') may be indicated as a footnote to that author's name. The address at which the author actually did the work must be retained as the main, affiliation address." from Elsevier Guidelines for Authors (https://www.elsevier.com/journals/journal-of-archaeological-science/0305-4403/guide-for-authors, but they all include this). It seems that what the OP describes is so unethical that no one has addressed it explicitly (yet).