Raiffeisen Bank, one of Russia’s leading financial institutions, has successfully identified and mitigated a sophisticated affiliate marketing fraud scheme that was siphoning marketing budgets and distorting performance metrics. In collaboration with the data analytics firm OWOX BI, the bank’s marketing and analytics departments implemented a high-resolution data tracking system to expose "cookie stuffing" and traffic source substitution. The investigation revealed that several affiliates within the bank’s Cost Per Acquisition (CPA) network were utilizing malicious browser extensions to hijack traffic from organic and paid search channels, falsely claiming commissions for conversions they did not generate.
The Landscape of Digital Acquisition and the Emergence of Anomalies
In the highly competitive Russian banking sector, digital customer acquisition is a primary driver of growth. Raiffeisen Bank, like many of its peers, relies heavily on a diverse mix of channels, including Search Engine Marketing (SEM), Search Engine Optimization (SEO), and CPA affiliate networks. Under a CPA model, the bank pays external partners a fixed fee for every successful action, such as a completed loan application or a new credit card activation.
The investigation began when Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, noticed a troubling divergence in the bank’s marketing performance data. While the costs associated with affiliate traffic were rising significantly, the overall revenue and the number of actual customers remained stagnant. Furthermore, technical logs indicated an unusual pattern of user behavior: customers were experiencing abrupt session breaks while in the middle of filling out application forms on the bank’s website.
"We observed that the efficiency of our affiliate channels was dropping while the invoices were increasing," noted Berezin. "This led us to suspect that the traffic we were paying for wasn’t actually new or unique, but rather a redirection of users who were already on our site."
The Mechanics of Traffic Source Substitution
The hypothesis developed by the Raiffeisen team focused on a practice known as traffic source substitution, often facilitated by browser extensions. These extensions, which users frequently install to find discounts or promo codes, act as "man-in-the-middle" agents.
When a user navigated to the Raiffeisen checkout or application page, the extension would trigger a popup window offering a discount or a special offer. If the user clicked the link within this popup, the extension would execute a script that refreshed the page or redirected the user through an affiliate link. Crucially, this process would overwrite the original traffic source data stored in the user’s browser cookies.
For example, a user who arrived at the site via a Google search (Organic) or a paid ad (CPC) would suddenly be re-categorized as an "Affiliate" referral. Consequently, when the user completed the application, the CPA network would claim a commission, effectively "robbing" the credit from the bank’s own organic or paid search efforts.
Technical Challenges in Detection
Detecting this type of fraud is notoriously difficult using standard web analytics tools. Raiffeisen Bank utilized the standard version of Google Analytics (GA), which presented two major hurdles. First, standard GA often uses data sampling for high-traffic sites, which can obscure the granular details needed to spot fraudulent patterns. Second, the standard version does not provide easy access to raw, hit-level data with precise timestamps for every user interaction.
To overcome these limitations, Raiffeisen partnered with OWOX BI. The goal was to create a transparent data environment where every hit—every click, page view, and event—could be analyzed in chronological order without the distortions of sampling or session aggregation.
Implementing the OWOX BI and Google BigQuery Solution
The technical solution involved the deployment of the OWOX BI Pipeline to stream data from the Raiffeisen website directly into Google BigQuery. Google BigQuery was selected for its ability to handle massive datasets and its compliance with the high-level security standards required by the banking industry.
Victoriia Pashchenko, a Web Analyst at OWOX BI, explained the necessity of this approach: "To catch a fraudster who operates in the milliseconds between a page load and a click, you need unsampled, real-time data. By moving the data to BigQuery, we could see the exact sequence of events. We weren’t just looking at ‘where the user came from’; we were looking at ‘how the source changed’ while the user was already on the site."
The OWOX BI Pipeline allowed the team to collect the actual timestamp of each hit. This enabled the analysts to track sequences of user actions across what Google Analytics would typically define as separate sessions.
The Chronology of the Investigation
The investigation proceeded through three distinct phases:
Phase 1: Raw Data Collection
The team set up a data stream that bypassed the limitations of the GA interface. Every interaction on the bank’s application form was recorded in BigQuery. This provided a "ledger" of activity, including the Client ID (a unique identifier for the browser), the session ID, and the UTM parameters (source, medium, campaign).
Phase 2: Defining the Fraud Signature
The analysts established a specific set of criteria to identify fraudulent activity. They looked for instances where:
- A user had two distinct sessions within a very short window (less than 60 seconds).
- Both sessions occurred on the same URL (the application or checkout page).
- The traffic source of the first session was "Organic" or "CPC," but the source of the second session was changed to an "Affiliate" campaign.
Phase 3: Automated Reporting and Visualization
Using an add-on to bridge Google BigQuery and Google Sheets, the team generated reports that highlighted the specific Client IDs and Affiliate IDs associated with these suspicious session breaks. This allowed the marketing team to see exactly which partners were responsible for the source substitution.
Analysis of the Findings
The data revealed a clear and systematic pattern of bad faith among certain affiliate partners. The pivot tables generated from the BigQuery data showed that a significant volume of transactions attributed to the CPA network were actually "stolen" from other channels.
The reports identified specific affiliates who had high rates of "60-second session breaks." In these cases, the data showed the user arriving via a legitimate channel, only to have an affiliate tag injected moments before the final conversion. This not only increased the bank’s costs but also provided a false sense of the CPA channel’s effectiveness, leading to poor budget allocation decisions.
"The data was undeniable," said Pashchenko. "We could see the exact moment the traffic source was rewritten. It was clear that these weren’t new customers brought in by the affiliates, but existing traffic being intercepted."
Official Response and Budget Optimization
Armed with this evidence, Raiffeisen Bank took decisive action. The bank confronted the affiliate networks and the specific webmasters identified in the report. As a direct result of the investigation, Raiffeisen ceased cooperation with two major dishonest partners.
By terminating these relationships, the bank was able to immediately reduce its "wasted" marketing spend. The budget that was previously being paid out as fraudulent commissions was reallocated to high-performing, legitimate channels like CPC and content marketing.
Furthermore, the bank implemented a permanent monitoring system based on the OWOX BI and BigQuery framework. This allows the marketing team to audit affiliate performance in real-time and flag any future instances of source substitution before significant costs are incurred.
Broader Implications for the Digital Marketing Industry
The Raiffeisen Bank case study serves as a critical warning for the broader digital marketing industry, particularly for high-value sectors like finance, e-commerce, and insurance. As affiliate marketing grows more complex, the tools used by fraudulent actors are becoming increasingly sophisticated.
The reliance on standard "out-of-the-box" analytics is often insufficient for protecting marketing budgets. The move toward "Data Democracy" and raw data access is no longer just a luxury for data scientists; it is a necessity for fraud prevention and financial integrity.
Industry analysts suggest that ad fraud costs global advertisers billions of dollars annually. The technique of using browser extensions for cookie stuffing is particularly insidious because it exploits the user’s own browser, making it appear as a legitimate referral.
Conclusion: The Value of Data Transparency
The collaboration between Raiffeisen Bank and OWOX BI demonstrates that transparency is the most effective weapon against digital fraud. By investing in a robust data infrastructure, Raiffeisen not only saved a significant portion of its marketing budget but also gained a deeper understanding of its customer journey.
Dmitriy Berezin emphasized the long-term benefits of the project: "This wasn’t just about catching two bad actors. It was about changing our approach to data. We now have the tools to ensure that every ruble of our marketing budget is spent on genuine customer acquisition. In a digital-first economy, the ability to trust your data is a competitive advantage."
The project highlights a shift in the role of the web analyst from a reporter of metrics to a guardian of the marketing budget. As more companies follow Raiffeisen’s lead in adopting unsampled, hit-level data analysis, the landscape for affiliate fraud is expected to become increasingly hostile for those operating in bad faith.
