Digital transformation in the banking sector has necessitated a rigorous approach to marketing attribution, particularly as financial institutions increasingly rely on Cost Per Action (CPA) networks to drive customer acquisition. Raiffeisen Bank, one of Russia’s leading financial institutions, recently encountered a sophisticated challenge within its digital ecosystem: a significant spike in affiliate marketing costs that did not correspond with an increase in actual revenue. Through a strategic partnership with OWOX BI, a leading provider of marketing analytics solutions, the bank uncovered a systemic pattern of affiliate fraud involving the manipulation of traffic source data via browser extensions.
The investigation revealed that certain affiliates were utilizing malicious or "gray-area" browser extensions to hijack the attribution process. These extensions would monitor when a user began a checkout process on the Raiffeisen website and trigger a pop-up offering a discount or promo code. When a user clicked the offer, the extension would refresh the session and rewrite the cookie data, effectively "stealing" the attribution from organic or paid search channels and redirecting the commission to the fraudulent affiliate. This practice not only inflated marketing costs but also degraded the user experience by causing session breaks during the critical application phase.
The Landscape of CPA Fraud in Modern Banking
The banking industry operates on high-value conversions, where the acquisition of a new credit card holder or mortgage applicant can justify significant affiliate payouts. This high-value environment makes banks prime targets for attribution fraud. In a standard CPA model, the bank pays an affiliate only when a specific action—such as a completed application—is performed. However, the integrity of this model relies on the accuracy of the "last-click" attribution system.
In the case of Raiffeisen Bank, the internal marketing team noticed an anomaly: while the volume of applications remained stable, the percentage of those applications attributed to CPA partners was rising at an unsustainable rate. Simultaneously, technical logs indicated that users were experiencing frequent session timeouts or "breaks" while filling out forms. This suggested that the user’s journey was being interrupted by external scripts or browser-level interventions.
Chronology of the Investigation and Implementation
The project to identify and mitigate this fraud followed a structured timeline, beginning with the identification of the anomaly and ending with the restructuring of the bank’s affiliate partnerships.
- Initial Detection (Month 1): Raiffeisen’s marketing analysts identified a disconnect between affiliate spend and net customer growth. They observed that traffic from high-performing organic and CPC (Cost Per Click) channels appeared to be "leaking" into affiliate buckets.
- Hypothesis Formulation (Month 1, Week 3): Based on user feedback regarding session breaks, the team hypothesized that browser extensions were injecting affiliate links during the checkout process, a tactic often referred to as "cookie stuffing" or "attribution hijacking."
- Strategic Partnership (Month 2): Raiffeisen engaged OWOX BI to move beyond the limitations of standard web analytics. The primary goal was to gain access to unsampled, hit-level data that could track the exact sequence of user interactions.
- Data Infrastructure Setup (Month 2, Week 2): The team implemented the OWOX BI Pipeline to stream data from the Raiffeisen website directly into Google BigQuery. This allowed for real-time data processing and the retention of precise timestamps for every user action.
- Analytical Deep Dive (Month 3): Analysts executed complex SQL queries to identify "impossible" user journeys—specifically, instances where a session source changed mid-application within a timeframe too short for a natural exit and re-entry.
- Action and Remediation (Month 4): Armed with granular reports, Raiffeisen confronted the CPA networks, identified the specific dishonest partners, and terminated their contracts, leading to an immediate stabilization of the marketing budget.
Technical Methodology: From Google Analytics to BigQuery
A primary hurdle for Raiffeisen was the limitation of the standard version of Google Analytics (GA). Standard GA often uses data sampling for large datasets, which can obscure the minute details required for fraud detection. Furthermore, standard GA does not easily allow for the analysis of session-to-session transitions at the hit level with millisecond precision.
To solve this, the OWOX BI team facilitated a migration to a Google BigQuery-based environment. By using the OWOX BI Pipeline, the bank was able to bypass GA’s sampling limits and stream raw data directly into a secure cloud warehouse. This setup provided several critical advantages:
- Unsampled Data: Every single hit, click, and page view was recorded, ensuring no data points were lost to statistical approximation.
- Real-Time Streaming: Data was available for analysis in near real-time, allowing for the rapid detection of emerging fraud patterns.
- Enhanced Security: Google BigQuery’s compliance with international security standards was a mandatory requirement for a financial institution of Raiffeisen’s stature.
The analytical team focused on a specific metric: the time elapsed between two sessions for a single user ID on the same URL. In a legitimate scenario, a user might leave a site and return via a different channel over several hours or days. In the fraudulent scenario, the transition happened in less than 60 seconds.
Analyzing the Mechanics of Attribution Hijacking
The fraud was executed with surgical precision. When a potential customer reached the Raiffeisen application page, a browser extension—often disguised as a "coupon finder" or "price comparison tool"—would detect the URL. The extension would then display a pop-up window. If the user interacted with this pop-up, the extension would force a page refresh or a redirect through an affiliate link.
This action had two immediate effects:
- The Session Break: The original session (e.g., from an Organic Search) was terminated, and a new session was initiated.
- The Cookie Overwrite: The new session carried the UTM parameters of the affiliate. Because the bank’s system used a "last-click" attribution model, the affiliate was credited with the entire conversion value, even though the bank had already "earned" that user through other marketing efforts.
The report generated by OWOX BI highlighted the severity of the issue. By filtering for users who had two sessions on the same page within a 60-second window where the second session was attributed to a CPA partner, the bank identified hundreds of hijacked transactions. The data proved that the affiliates were not "acquiring" new customers but were simply "taxing" the bank’s existing traffic.
Official Responses and Strategic Outcomes
Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, emphasized that the objective was not merely to save costs but to protect the integrity of the bank’s data. "We needed to understand the true path our customers were taking," Berezin noted during the analysis phase. The bank’s stance was that marketing budgets must be allocated based on genuine value creation rather than technical manipulation.
Victoriia Pashchenko, a Web Analyst at OWOX BI, highlighted the importance of technical transparency in affiliate relationships. According to Pashchenko, the ability to join hit-level data with session data in BigQuery was the "smoking gun" that allowed the bank to see exactly how the traffic source values were being rewritten.
The results of the project were definitive:
- Identification of Bad Actors: The bank identified two major affiliate partners whose traffic consisted almost entirely of hijacked sessions.
- Budget Optimization: By terminating these partnerships, Raiffeisen was able to reallocate funds to higher-performing, legitimate channels like CPC and SEO.
- Improved User Experience: By identifying the cause of the session breaks, the bank’s technical team was able to implement measures to harden the application form against external script interference.
Broader Implications for the Digital Marketing Industry
The Raiffeisen Bank case study serves as a cautionary tale for any organization utilizing CPA or affiliate networks. It underscores a growing trend in digital advertising where "attribution fraud" is becoming as prevalent as "click fraud." As browser extensions and third-party plugins become more sophisticated, the "last-click" model becomes increasingly vulnerable.
This case highlights the necessity for "Marketing Analytics 2.0," where companies no longer rely on the pre-packaged reports provided by analytics platforms but instead build custom data pipelines. The use of BigQuery and SQL-based analysis allows for a level of scrutiny that can distinguish between a natural user journey and one manipulated by malicious software.
Furthermore, the incident points toward a shift in how brands must manage their affiliate relationships. Moving forward, "trust but verify" is the required mantra. Financial institutions, in particular, must demand transparency from their CPA networks, requiring them to provide more than just conversion numbers. They must be able to prove the origin of their traffic and demonstrate that they are providing incremental value rather than merely capturing existing demand.
In conclusion, Raiffeisen Bank’s proactive approach to data analysis allowed it to turn a significant financial drain into an opportunity for optimization. By moving their data to a more granular environment and applying rigorous logic to user journeys, they successfully defended their marketing ecosystem against sophisticated digital fraud. This sets a benchmark for other institutions in the Russian and global markets to follow in the ongoing battle for attribution integrity.
