admin
Raiffeisen Bank, a prominent financial institution operating in Russia, has successfully identified and mitigated a sophisticated affiliate marketing fraud scheme that was siphoning marketing budgets and disrupting the user experience on its digital platforms. By partnering with OWOX BI, the bank implemented an advanced data streaming and analysis framework that revealed how certain Cost Per Action (CPA) affiliates were using browser extensions to illegitimately claim credit for organic and paid search traffic. This investigation not only protected the bank’s marketing spend but also highlighted a growing vulnerability in the digital advertising ecosystem where technical "source rewriting" can go undetected without hit-level data analysis.
The Genesis of the Investigation: Anomalies in Acquisition Costs
The investigation began when the marketing department at Raiffeisen Bank noticed a troubling trend in their performance metrics. While the overall volume of customer acquisitions remained relatively stable, the costs associated with affiliate marketing channels were rising at an abnormal rate. Specifically, the bank was paying out higher commissions to CPA partners, yet there was no corresponding lift in total revenue or new account openings that could justify the expenditure.
Simultaneously, the bank’s technical team received reports of session breaks and errors occurring while customers were in the middle of filling out application forms for financial products. These technical glitches were not only frustrating for the users but were also leading to higher abandonment rates. Initial audits suggested that these issues were not caused by internal server errors, prompting a deeper look into the external traffic sources and the behavior of browser-based third-party tools.
The bank’s hypothesis centered on a deceptive practice known as "cookie stuffing" or "source rewriting." They suspected that some affiliates were leveraging browser extensions installed by users—often marketed as "discount" or "coupon" finders—to intercept the customer journey. These extensions would detect when a user was on the Raiffeisen checkout or application page and trigger a background event or a pop-up link. If a user interacted with these elements, or even if the extension acted autonomously, the original traffic source data (such as "Organic Search" or "Paid Search") would be overwritten with the affiliate’s tracking parameters. Consequently, the bank would be billed for a conversion that would have occurred regardless of the affiliate’s intervention.
Chronology of the Data Integration and Detection Process
To prove this hypothesis, Raiffeisen Bank required a level of data granularity that standard web analytics tools could not provide. The bank’s reliance on the standard version of Google Analytics presented a significant hurdle, as it typically provides sampled data and lacks the hit-level detail necessary to track rapid changes in session sources within a matter of seconds.
The project was divided into three distinct phases:
Phase 1: Establishing a High-Resolution Data Pipeline
In collaboration with OWOX BI, the bank established a streaming data pipeline to move raw website data into Google BigQuery. This move was critical because BigQuery offers the computational power to process millions of rows of unsampled data while maintaining the highest security and compliance standards required by the financial sector. By using the OWOX BI Pipeline, the bank was able to bypass the limitations of Google Analytics, gaining access to the actual timestamp of every hit (page view or event) in near real-time.
Phase 2: Defining the Fraudulent Pattern
With the raw data flowing into BigQuery, analysts from Raiffeisen and OWOX BI defined the specific parameters of a "rewritten" session. They focused on identifying users who experienced a session break on the same page where they were active. The specific logic involved looking for instances where:
- A user was active in an initial session (Session A) from a non-affiliate source like Organic or CPC.
- A second session (Session B) started for the same user ID on the exact same URL.
- The time elapsed between the end of Session A and the start of Session B was less than 60 seconds.
- The traffic source for Session B was attributed to a CPA affiliate.
Phase 3: Analysis and Reporting
The final phase involved querying the BigQuery dataset to isolate these specific occurrences. The analysts used SQL to join session tables and calculate the time differences between hits. The results were then exported to Google Sheets via an automated add-on, creating a transparent dashboard for the marketing team. This report clearly identified which affiliate IDs were associated with these rapid session switches and which original channels—such as organic search or paid search—were being "robbed" of their attribution.
Supporting Data and Technical Findings
The data analysis revealed a stark reality. A significant portion of the bank’s affiliate-attributed transactions followed the suspicious pattern of "instant session replacement." In many cases, the time between the original session and the affiliate-tagged session was as low as five to ten seconds. This timeline is inconsistent with natural user behavior, as a human user would typically not leave an application form, search for a discount, and return to the same page within such a narrow window without experiencing a noticeable disruption.
The technical explanation for the session breaks reported by users also became clear. When the browser extension rewrote the traffic source data in the user’s cookies, Google Analytics interpreted this as a new session. In many web environments, a change in session parameters can reset certain security tokens or state variables, causing the application form to reload or error out. This confirmed that the affiliate fraud was not just a financial drain but a direct threat to the bank’s conversion rate optimization (CRO) efforts.
The report generated for the marketing team included:
- Transaction IDs: Specific orders or applications that were misattributed.
- Source Cannibalization: A breakdown of how much "Organic" and "CPC" revenue was being redirected to "CPA."
- Affiliate Rankings: A list of partners ranked by the percentage of their traffic that met the fraudulent criteria.
Official Responses and Strategic Actions
Following the presentation of these findings, Raiffeisen Bank’s digital marketing leadership took immediate corrective action. Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, noted that the ability to track the sequence of user actions across sessions in a single report was the turning point for their strategy. The bank determined that two specific affiliate partners were responsible for the vast majority of the source rewriting.
The bank’s response was twofold:
- Termination of Partnerships: Raiffeisen ceased cooperation with the dishonest webmasters identified in the report. By removing these partners from their CPA network, the bank immediately reduced its marketing overhead without seeing a dip in actual customer acquisitions.
- Budget Reallocation: The funds previously lost to fraudulent commissions were reallocated to high-performing, transparent channels like Google Search and internal retention programs.
Victoriia Pashchenko, a Web Analyst at OWOX BI who worked closely on the project, emphasized that this case serves as a blueprint for other enterprises. She highlighted that in an era of complex browser interactions, relying on "last-click" attribution without verifying the integrity of the session path is a major risk for any large-scale advertiser.
Broader Impact and Industry Implications
The Raiffeisen Bank case highlights a systemic issue within the global affiliate marketing industry, which is estimated to be worth over $17 billion. Affiliate fraud, particularly through adware and malicious extensions, costs companies billions of dollars annually. For the banking sector, where the Cost Per Acquisition for a credit card or a mortgage can be quite high, the incentive for affiliates to engage in "attribution theft" is significant.
This event underscores the necessity of moving toward "first-party data" and "server-side tracking." As browsers like Chrome, Safari, and Firefox continue to restrict third-party cookies, the methods used by fraudulent extensions may evolve, but the need for hit-level, unsampled data remains constant. By owning their data pipeline, Raiffeisen Bank has transitioned from a reactive stance to a proactive one, where they can audit their partners in real-time.
Furthermore, this investigation has implications for how CPA networks vet their members. It suggests that financial institutions must demand greater transparency and perhaps implement stricter "no-extension" clauses in their affiliate contracts. The success of Raiffeisen’s data-driven approach has already prompted discussions within the Russian digital marketing community regarding the standardization of fraud detection in banking.
In the long term, Raiffeisen Bank plans to continue using its BigQuery infrastructure to refine its attribution models. Beyond fraud detection, the bank is looking to implement multi-channel attribution that recognizes the true value of every touchpoint in the customer journey, ensuring that marketing budgets are spent on driving genuine growth rather than rewarding technical manipulation. This shift toward advanced analytics marks a significant step in the bank’s digital transformation, moving it closer to a fully data-transparent operating model.
