admin
In an era where digital acquisition costs are under constant scrutiny, Raiffeisen Bank’s Russian division recently identified a sophisticated pattern of affiliate marketing fraud that was siphoning marketing budgets into the hands of dishonest webmasters. The discovery, made in collaboration with web analytics firm OWOX BI, highlights a growing trend of "attribution theft" within the financial services sector, where browser extensions and malicious scripts are used to hijack legitimate traffic and claim unearned commissions. By leveraging raw data processing through Google BigQuery, the bank was able to isolate fraudulent sessions, terminate contracts with bad actors, and reallocate its marketing spend toward high-performing, legitimate channels.
The Genesis of the Investigation: Anomalies in Acquisition Costs
The investigation began when Raiffeisen Bank’s marketing team, led by Dmitriy Berezin, Head of Online Sales, noticed a troubling divergence in their performance metrics. While the bank’s expenditure on affiliate traffic—specifically within the Cost Per Action (CPA) model—was increasing at an abnormal rate, the corresponding revenue and conversion rates remained largely stagnant. Under a standard CPA model, a bank pays an affiliate only when a specific action is completed, such as a customer successfully submitting a credit card application.
However, the team observed a secondary, more technical symptom: an unusual frequency of session breaks. Customers who were in the middle of filling out application forms on the bank’s website were experiencing abrupt interruptions. These technical glitches, combined with the rising costs, led the bank to suspect that external agents were interfering with the user journey to manipulate the attribution of sales.
The Mechanics of Attribution Theft and Cookie Stuffing
The primary suspicion centered on a practice known as "cookie stuffing" or "source substitution," facilitated by third-party browser extensions. In this scenario, a user might install a browser extension designed to find coupons or discounts. When that user visits a high-value site like Raiffeisen’s to apply for a financial product, the extension detects the checkout or application URL.
The extension then triggers a popup window offering a discount or a special offer. If the user clicks this popup, the extension executes a script that refreshes the page or redirects the user through an affiliate link. This process overwrites the original traffic source data stored in the user’s cookies. For example, a user who originally arrived at the site via an organic search or a paid search ad (CPC) would suddenly be tagged as having arrived via an affiliate. When the user completes the application, the affiliate network claims the commission for a lead they did not actually generate, effectively "robbing" the budget from the bank’s organic and paid search channels.
A Chronology of the Technical Resolution
To expose this fraudulent activity, Raiffeisen Bank required a level of data granularity that standard analytics tools could not provide. The bank partnered with OWOX BI to implement a robust data pipeline and analysis framework.
Phase 1: Moving Beyond Sampled Data
The bank’s reliance on the standard version of Google Analytics presented a significant hurdle: data sampling. To detect fraud occurring within seconds, the team needed unsampled, hit-level data. OWOX BI set up a data stream from the bank’s website directly into Google BigQuery. This move allowed the bank to collect data in near real-time, meeting the high security and compliance standards required by the Russian financial sector. Unlike standard analytics, this pipeline captured the exact timestamp of every hit, enabling the reconstruction of precise user sequences across multiple sessions.
Phase 2: Defining Fraudulent Patterns
Analysts from both Raiffeisen and OWOX BI established a set of criteria to identify "rewritten" traffic sources. They focused on identifying instances where a user’s session was terminated and a new session was initiated on the exact same page within a window of less than 60 seconds. In these cases, the second session would invariably show a change in the traffic source to a specific affiliate ID.
Phase 3: Data Processing and Querying
Using SQL queries within Google BigQuery, the team filtered millions of rows of raw data to find users who visited a promotional page, were interrupted, and then immediately "returned" via a CPA affiliate link. This allowed the bank to see exactly which affiliate partners were triggering the session breaks and claiming credit for existing traffic.
Phase 4: Reporting and Action
The processed data was exported into Google Sheets for the marketing team to review. The final reports provided a "smoking gun," listing specific affiliate IDs, the number of transactions they had hijacked, and the original channels (such as Organic or CPC) that should have received the credit. This transparency allowed Raiffeisen to confront the CPA networks with empirical evidence of fraud.
Supporting Data: The Impact of Source Substitution
The data revealed a stark reality for the bank’s marketing efficiency. Analysis showed that a significant percentage of "affiliate-driven" conversions were actually the result of users who were already on the site and deep into the conversion funnel.
For instance, the bank identified cases where a user arrived via a Google Search (Organic), spent three minutes filling out a form, and then, within a 10-second window, saw their session source change to a CPA affiliate. By quantifying these instances, Raiffeisen discovered that two specific affiliate partners were responsible for the bulk of the fraudulent activity. These partners were not providing incremental value; they were merely tax-collecting on traffic the bank had already earned.
Official Responses and Strategic Outcomes
Following the investigation, Raiffeisen Bank took decisive action to protect its marketing ROI. Dmitriy Berezin noted that the ability to monitor statistics on affiliates in such detail allowed the company to "bring to light the cases of fraud in CPA networks."
The bank immediately ceased cooperation with the two identified dishonest partners. This move did not result in a drop in total applications; rather, it led to a significant reduction in the cost per acquisition, as the bank stopped paying unearned commissions. The marketing budget was subsequently reallocated to legitimate channels that demonstrated true incremental growth.
Victoriia Pashchenko, Web Analyst at OWOX BI, emphasized that this case serves as a blueprint for other high-stakes industries. She noted that when the cost of a single conversion is high—as it is in banking and insurance—the incentive for affiliates to engage in source substitution is immense. The only defense is a transition from high-level "black box" analytics to transparent, raw data ownership.
Broader Impact and Implications for the FinTech Industry
The Raiffeisen case highlights a critical vulnerability in the digital advertising ecosystem. As financial institutions increasingly move their services online, the complexity of the "ad-tech" stack provides numerous shadows for fraudulent actors to hide in.
- The Necessity of First-Party Data: This incident underscores why banks are moving away from third-party attribution models. By owning their data in a private cloud like BigQuery, they can verify the integrity of the user journey without relying on the self-reporting of affiliate networks.
- The Evolution of CPA Networks: CPA networks are now under increased pressure to police their own webmasters. If networks cannot guarantee the "cleanliness" of their traffic, they risk losing large-scale institutional clients who now have the tools to audit every click.
- The Rise of "Privacy-First" Fraud: Interestingly, as browsers become more privacy-centric and restrict third-party cookies, some forms of affiliate fraud may become harder to track using traditional methods. This will necessitate even more advanced server-side tracking and machine learning models to identify anomalous behavior patterns.
- Economic Efficiency: For Raiffeisen, the optimization was not just about saving money; it was about data integrity. Accurate attribution ensures that the bank understands which marketing messages truly resonate with customers, allowing for better product development and more personalized customer experiences.
In conclusion, Raiffeisen Bank’s proactive approach to identifying affiliate fraud demonstrates that in the modern digital landscape, data is both the target of fraud and the primary weapon against it. By investing in a sophisticated analytical infrastructure, the bank successfully defended its marketing budget and set a new standard for transparency in the Russian digital banking sector. This case remains a pertinent reminder that in the world of online acquisition, what you see in a standard dashboard is often only the surface of a much deeper, and sometimes more deceptive, story.
