Raiffeisen Bank’s Russian division has successfully identified and neutralized a sophisticated affiliate marketing fraud scheme that was siphoning marketing budgets through deceptive traffic attribution. By partnering with the analytics firm OWOX BI, the financial institution uncovered a systematic "cookie stuffing" operation where browser extensions were being used to overwrite traffic source data, falsely claiming credit for organic and paid search conversions. This investigation not only highlights the growing complexity of Cost-Per-Action (CPA) fraud in the banking sector but also underscores the necessity of unsampled, real-time data processing in modern digital marketing.
The investigation began when the bank’s marketing department, led by Dmitriy Berezin, Head of Online Sales, noticed a concerning divergence in their performance metrics. Despite a significant increase in the costs associated with affiliate traffic, the bank’s overall revenue remained stagnant. Furthermore, internal monitoring revealed a peculiar technical anomaly: a high volume of customers were experiencing session breaks while attempting to fill out application forms on the bank’s website. These indicators suggested that the attribution model was being manipulated, prompting a deep-dive analysis into the integrity of the bank’s CPA network relationships.
The Mechanics of Traffic Substitution Fraud
The suspected fraudulent activity involved a technique known as traffic source substitution, a variation of cookie stuffing. In this scenario, users who had installed certain browser extensions—often marketed as tools to find discounts or promo codes—were being targeted during the checkout or application process. When a user reached a specific stage of the bank’s conversion funnel, the extension would trigger a popup window offering a discount.
If the user interacted with this popup, the extension would execute a script to refresh the session or redirect the user through an affiliate link. This process effectively rewrote the traffic source data stored in the user’s browser cookies. Consequently, if the user had originally arrived at the site via an expensive Cost-Per-Click (CPC) campaign or through organic search, the credit for the eventual conversion would be reassigned to the fraudulent affiliate. For the bank, this meant paying a commission to an affiliate for a customer they had already acquired through other channels.
Chronology of the Investigation and Technical Integration
The resolution of this challenge required a transition from standard reporting tools to a more granular data infrastructure. Raiffeisen Bank was utilizing the standard version of Google Analytics, which, while robust for general reporting, often relies on sampled data and lacks the hit-level detail necessary for forensic fraud detection.
To address this, the OWOX BI team, led by Web Analyst Victoriia Pashchenko, implemented a sophisticated data pipeline. The chronology of the project followed a structured path:
- Infrastructure Deployment: The team established a data flow from the Raiffeisen website to Google BigQuery using the OWOX BI Pipeline. This allowed for the collection of unsampled, hit-level data in near real-time.
- Data Normalization: Unlike standard analytics, this pipeline captured the precise timestamp of every hit, enabling the analysts to reconstruct the exact sequence of user actions across multiple sessions with millisecond precision.
- Hypothesis Testing: The analysts formulated a query to identify "unnatural" session transitions—specifically, instances where a user’s session ended and a new one began on the same URL within a very short timeframe, accompanied by a change in the traffic source.
- Fraud Identification: By filtering the raw data for sessions that restarted within 60 seconds on the same page, the team was able to isolate the specific affiliate IDs responsible for the source rewriting.
Technical Analysis of Data Processing
The processing phase was critical in distinguishing legitimate affiliate conversions from fraudulent ones. The analysts focused on three primary data points: the Client ID (a unique identifier for the browser), the session start time, and the traffic source values (utm_source, utm_medium, and utm_campaign).
The "smoking gun" in the data was the session duration and the page path. Under normal circumstances, it is highly improbable for a user to organically end a session and start a new one on the exact same application form page within less than a minute. By utilizing SQL queries in Google BigQuery, the team generated reports that highlighted a pattern: users would arrive via "Organic" or "CPC," and within seconds, a new session would trigger under a "CPA" source.
The OWOX BI add-on was then used to export these findings into Google Sheets, creating a pivot table that mapped fraudulent transactions back to specific affiliate partners. This data provided the bank’s marketing team with the empirical evidence needed to confront the CPA networks.
Supporting Data and Industry Implications
Digital ad fraud remains a multi-billion dollar problem for the global economy. According to industry benchmarks, financial services are among the most targeted sectors due to the high payout rates for successful lead generation and account openings. CPA fraud, in particular, is insidious because it often appears as "successful" conversions on the surface, making it difficult to detect without deep-path analysis.
In the case of Raiffeisen Bank, the data revealed that two specific affiliate partners were responsible for the bulk of the anomalous traffic. These partners were effectively "robbing" the bank’s organic and CPC channels. By analyzing a cohort of customers, the bank found that a significant percentage of "affiliate-driven" transactions were actually redirections of users who were already mid-way through the conversion funnel.
The broader implications of this study suggest that "last-click" attribution models are particularly vulnerable to this type of exploitation. When a system blindly rewards the final touchpoint before a conversion, it creates a financial incentive for bad actors to "insert" themselves at the end of the customer journey.
Official Responses and Strategic Remediation
Following the discovery, Raiffeisen Bank took immediate steps to protect its marketing budget. Dmitriy Berezin emphasized the importance of transparency in affiliate relationships. The bank utilized the reports generated by OWOX BI to terminate contracts with the dishonest webmasters and renegotiate terms with CPA networks to include stricter monitoring of traffic sources.
"The company managed to optimize the ad budget by ceasing cooperation with two dishonest partners that rewrote the traffic sources and unreasonably overbilled Raiffeisen," the bank noted in a summary of the project. This move allowed the marketing team to reallocate funds toward genuine acquisition channels that provided a verifiable Return on Ad Spend (ROAS).
Victoriia Pashchenko of OWOX BI highlighted that this case serves as a template for other organizations. The ability to track the sequence of user actions across sessions in a single, unsampled report is no longer a luxury but a requirement for any large-scale digital advertiser.
Broader Impact on the Financial Sector
The Raiffeisen case highlights a shift in how financial institutions must approach digital security. Traditionally, "fraud" in banking referred to credit card theft or account takeovers. However, "marketing fraud" represents a significant drain on corporate resources that can go unnoticed for years.
As browser privacy changes (such as the phasing out of third-party cookies) continue to reshape the landscape, the methods used by fraudulent affiliates are likely to evolve. Experts suggest that server-side tracking and more sophisticated identity resolution will become the next battleground in ensuring attribution integrity.
For Raiffeisen Bank, the integration of Google BigQuery and OWOX BI has evolved beyond a one-time audit into a continuous monitoring system. The bank now maintains a dashboard that flags suspicious attribution shifts in real-time, allowing them to maintain a "clean" marketing ecosystem. This proactive stance not only saves direct commission costs but also ensures that the bank’s internal data remains accurate for future machine learning models and predictive analytics.
In conclusion, the collaboration between Raiffeisen Bank and OWOX BI demonstrates that while affiliate fraud is becoming more sophisticated, it leaves a digital trail that can be uncovered through rigorous data analysis. By moving beyond sampled data and embracing hit-level transparency, advertisers can reclaim control over their budgets and ensure that their marketing investments are driving genuine growth rather than rewarding technical manipulation.
