In an era where digital acquisition costs are under constant scrutiny, Raiffeisen Bank’s Russian division recently identified a sophisticated scheme designed to siphon marketing budgets through fraudulent affiliate practices. By partnering with the data analytics firm OWOX BI, the financial institution successfully uncovered a system of traffic source substitution that had been artificially inflating the costs of their Cost Per Action (CPA) campaigns. The investigation revealed that certain affiliates were utilizing malicious browser extensions to hijack user sessions during the final stages of the bank’s online application process, effectively "stealing" attribution from organic and paid search channels. This discovery has led to a significant reallocation of the bank’s marketing budget and a total cessation of partnerships with the identified dishonest webmasters.
The Landscape of Digital Advertising Fraud in Banking
The financial services sector remains one of the most lucrative targets for digital advertising fraud due to the high lifetime value of acquired customers and the substantial commissions paid out for successful credit card or loan applications. In a typical CPA model, banks pay affiliates a fixed fee for every completed application or approved contract. While this performance-based model is generally efficient, it is susceptible to "cookie stuffing" and attribution manipulation.
Raiffeisen Bank’s marketing team first signaled an alarm when internal audits showed a paradoxical trend: while the expenditures for affiliate traffic were rising sharply, the overall conversion rate and net revenue remained stagnant. Further investigation into the user experience revealed that customers were experiencing unexpected session breaks and page reloads while filling out application forms on the bank’s website. These technical glitches, initially thought to be server-side errors, were actually the footprints of a sophisticated attribution theft mechanism.
Chronology of the Fraud Detection Initiative
The investigation began when Raiffeisen Bank’s Head of Online Sales, Dmitriy Berezin, noticed the discrepancy between spend and performance. The bank’s internal analysts suspected that the issue lay in the attribution logic. They hypothesized that users were being redirected or their tracking cookies were being overwritten just before the final submission of an application.
To test this hypothesis, the bank required a more granular view of user behavior than what was available through standard web analytics tools. In the second month of the investigation, Raiffeisen engaged OWOX BI to implement a robust data streaming architecture. The goal was to move beyond sampled data and gain a hit-level understanding of every interaction on the site.
The technical implementation followed a strict timeline:
- Infrastructure Setup: Within the first two weeks, the team integrated the OWOX BI Pipeline to stream unsampled data from the bank’s website directly into Google BigQuery.
- Data Processing and Cleaning: Over the following three weeks, analysts developed SQL queries to identify "micro-sessions" where a user’s source changed within a sixty-second window.
- Reporting and Verification: In the final stage, the data was exported to visualization tools to pinpoint specific affiliate IDs associated with the suspicious activity.
Technical Analysis: The Mechanics of Attribution Theft
The fraud was executed through a method often referred to as "Adware-driven Attribution Manipulation." The mechanism relied on browser extensions that users had installed for legitimate purposes, such as finding coupons or earning cashback. When a user navigated to the Raiffeisen Bank checkout or application page, the extension would trigger a background script.
As the user began inputting sensitive information into the application form, the extension would display a pop-up window offering a discount or a "special offer." If the user interacted with this pop-up—or in some cases, even if they didn’t—the extension would force a page refresh or a background redirect. This action would drop a new cookie containing the affiliate’s tracking parameters. Consequently, when the user finally clicked "Submit," the bank’s analytics system would attribute the high-value conversion to the affiliate, even if the user had originally arrived via an expensive Paid Search (CPC) campaign or an Organic search result.
Victoriia Pashchenko, a Web Analyst at OWOX BI, noted that identifying this required analyzing the exact timestamp of every hit. "Standard analytics platforms often aggregate data, which can mask the rapid-fire sequence of events that characterize this type of fraud," Pashchenko explained. "By using Google BigQuery, we could see the precise second a session was terminated and a new one was initiated from a different source on the exact same URL."
Supporting Data and Methodology
The OWOX BI team utilized a three-step data processing framework to provide Raiffeisen with actionable evidence.
Step 1: Raw Data Collection.
The bank utilized the standard version of Google Analytics, which is prone to sampling when handling large datasets. To circumvent this, the OWOX BI Pipeline was used to send hit-level data to Google BigQuery. This ensured that every single action, including those that occurred during session breaks, was recorded with a unique Client ID and a precise timestamp.
Step 2: Identifying the "Fraud Window."
Analysts filtered the data to find instances where a single Client ID generated two sessions on the same page within less than 60 seconds. They specifically looked for transitions where:
- Session A Source: Organic, CPC, or Direct.
- Session B Source: Affiliate/CPA Network.
- Landing Page: The bank’s application or checkout page.
Step 3: Quantifying the Impact.
The final report revealed that a significant percentage of the affiliate "conversions" were actually stolen from other channels. In some cases, affiliates were claiming credit for traffic that the bank had already paid for through Google Ads or had earned through SEO efforts. The pivot tables generated from BigQuery showed specific affiliate IDs that had a 90% overlap with existing organic traffic, a statistical impossibility in a clean marketing ecosystem.
Official Responses and Industry Implications
Dmitriy Berezin, speaking on the findings, emphasized the necessity of transparency in digital partnerships. "Our priority is to ensure that our marketing budget is driving genuine growth. By uncovering these dishonest practices, we are not only saving costs but also protecting the integrity of our data. We have taken immediate steps to terminate contracts with partners who were found to be manipulating the attribution system."
The implications of this case extend beyond Raiffeisen Bank. According to industry reports, ad fraud is expected to cost advertisers worldwide over $100 billion by the end of 2024. The banking sector is particularly vulnerable because the complexity of financial products often leads to longer user sessions, providing more opportunities for malicious extensions to intervene.
Market analysts suggest that this case highlights a growing need for "Server-Side Tracking." By moving tracking logic away from the user’s browser and onto the company’s own servers, banks can prevent browser extensions from seeing or modifying tracking cookies. This transition is becoming a standard recommendation for high-stakes digital environments.
Broader Impact on the Affiliate Marketing Ecosystem
The resolution of the Raiffeisen Bank case serves as a warning to the CPA marketing industry. For years, affiliate networks have operated with a degree of opacity, often making it difficult for brands to verify the origin of their traffic. The use of Big Data tools like Google BigQuery and OWOX BI represents a shift in power, giving brands the technical capability to audit their partners in real-time.
Furthermore, this incident underscores the ethical concerns surrounding browser extensions. While many provide value to consumers, the lack of oversight regarding how these extensions interact with third-party websites poses a risk to both corporate marketing budgets and user privacy. As a result of this investigation, Raiffeisen has also implemented more rigorous monitoring of session stability, treating frequent reloads on high-value pages as a potential security and fraud indicator.
In the final analysis, the bank’s proactive stance has resulted in a more streamlined and honest marketing funnel. By eliminating fraudulent actors, Raiffeisen was able to reallocate funds toward genuine customer acquisition channels, ultimately lowering their overall cost per acquisition and improving the accuracy of their financial forecasting. The collaboration between Raiffeisen and OWOX BI demonstrates that in the fight against digital fraud, the most effective weapon is a granular, data-driven understanding of the user journey.
