In a significant move toward greater transparency in digital marketing, Raiffeisen Bank Russia has successfully identified and mitigated a sophisticated affiliate fraud scheme that was siphoning marketing budgets and degrading the online customer experience. By leveraging advanced data processing tools and granular web analytics, the bank’s marketing team, in collaboration with analysts from OWOX BI, uncovered a practice where third-party affiliates were using browser extensions to hijack attribution data. This discovery not only allowed the bank to terminate relationships with dishonest partners but also highlighted a growing vulnerability in the Cost-Per-Action (CPA) marketing model used by financial institutions worldwide.
The investigation began when the digital marketing department at Raiffeisen Bank noticed a troubling trend in their acquisition metrics. Despite a substantial increase in the costs associated with affiliate traffic, the actual conversion rates and subsequent revenue remained stagnant. This discrepancy suggested that the bank was paying for "new" customers who may have already been on the path to conversion through other organic or paid channels. Furthermore, technical reports indicated that users were experiencing unusual session breaks while filling out application forms on the bank’s website, a friction point that threatened to lower overall conversion rates.
The Mechanics of Attribution Hijacking
The fraudulent activity suspected by Raiffeisen involves a technique often referred to as "cookie stuffing" or "source substitution," facilitated by malicious or grey-area browser extensions. In this scenario, a user might install a browser extension designed to find coupons or provide cashback rewards. When that user visits the Raiffeisen website and begins a checkout or application process, the extension detects the activity and triggers a background event.
This event often manifests as a small popup offer or a silent redirect. If the user interacts with the extension or even if the extension simply refreshes the page with its own affiliate parameters, the original traffic source—such as an organic search or a paid search ad (CPC)—is overwritten in the user’s browser cookies. Consequently, when the user completes the application, the affiliate partner claims 100% of the credit for the conversion, and the bank is billed for a commission that the affiliate did not legitimately earn.
A Chronology of the Investigation
The path to uncovering this fraud required a shift from standard aggregated analytics to high-velocity, raw data processing. The investigation followed a structured timeline of technical implementation and data auditing.
First, the team addressed the limitations of their existing analytics setup. Raiffeisen Bank was utilizing the standard version of Google Analytics, which, while powerful, often employs data sampling for high-traffic sites and does not provide the hit-level granularity needed to track millisecond-level changes in session data. To bypass these limitations, the bank partnered with OWOX BI to implement a data pipeline that streamed unsampled data directly from the website into Google BigQuery.
Second, the analysts established a real-time data flow. By using the OWOX BI Pipeline, the team could collect actual timestamps for every "hit" or user action. This allowed them to see the exact sequence of events that occurred when a user was filling out a form. The move to Google BigQuery was also motivated by the bank’s stringent security and compliance requirements, as the platform meets high-level international standards for data protection.
Third, the team conducted a deep-dive analysis of session transitions. They specifically looked for "broken" sessions where a user appeared to end one session and start another while staying on the exact same URL within a timeframe of less than 60 seconds. In a legitimate browsing scenario, a user rarely switches traffic sources in the middle of a single page-load unless an external script or extension intervenes.
Technical Data Processing and Filtering
To isolate the fraudulent actors, OWOX BI and Raiffeisen analysts processed the raw data stored in BigQuery using specific filtering criteria. They focused on three primary data points: the Client ID (a unique identifier for the browser), the session start time, and the traffic source (utm_source).
The data was filtered to identify instances where the following conditions were met:
- A user had at least two sessions recorded within a single day.
- The transition between the first and second session occurred in less than one minute.
- Both sessions were recorded on the same landing page or application form.
- The traffic source changed from a non-affiliate channel (like "Organic" or "cpc") in the first session to a specific CPA affiliate in the second session.
By running SQL queries against the BigQuery dataset, the analysts were able to generate a report that showed a clear pattern of "source rewriting." For example, a user might arrive via a Google Search (Organic), start filling out a credit card application, and suddenly, 15 seconds later, a new session would be recorded under an affiliate’s ID. The data proved that the affiliate was essentially "robbing" the organic channel of its attribution.
Quantifying the Impact of CPA Fraud
The results of the data analysis were definitive. The analysts exported the findings into a pivot table that revealed which specific affiliate partners were associated with these rapid session breaks. The report identified the number of transactions that had been attributed to affiliates via rewritten source values and, perhaps more importantly, identified which legitimate channels were losing their credit.
The data showed that "CPC" (Cost-Per-Click) and "Organic" search were the primary victims of this theft. In several cases, the bank was effectively paying twice for the same customer: once for the initial click-through on a paid advertisement and a second time as a commission to a fraudulent affiliate who had hijacked the session at the final stage of the funnel.
Following the internal review of these reports, Raiffeisen Bank took decisive action. The bank terminated its cooperation with two major affiliate partners who were found to be consistently benefiting from rewritten traffic sources. This immediate severance of ties prevented further budget leakage and allowed the marketing team to reallocate those funds toward more transparent and high-performing channels.
Broader Implications for the Financial Sector
The Raiffeisen case serves as a cautionary tale for the broader financial services industry, where the "Cost-Per-Action" model is a staple of digital acquisition. Because banks often pay high commissions for successful loan or credit card applications, the incentive for affiliates to engage in attribution fraud is significant.
This investigation highlights the necessity of "Hit-Level" data. In the current digital landscape, relying on the "Last Click" attribution model provided by standard analytics tools is no longer sufficient for enterprise-level security and budget management. Without the ability to see the sequence of events within a minute-long window, most marketing teams would remain unaware that their sessions are being hijacked.
Furthermore, the incident underscores the role of browser extensions in the modern ad-tech ecosystem. While many extensions provide value to users, their ability to inject scripts and modify browser cookies poses a persistent threat to the integrity of marketing data. Companies must now consider "attribution security" as a standard part of their digital strategy.
Conclusion and Future Outlook
By integrating Google BigQuery and OWOX BI into their marketing stack, Raiffeisen Bank Russia transitioned from a reactive to a proactive stance against ad fraud. The bank now possesses a robust monitoring system that can flag suspicious affiliate behavior in near real-time, ensuring that marketing spend is directed toward partners who provide genuine incremental value.
Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, and Victoriia Pashchenko, Web Analyst at OWOX BI, have demonstrated that the solution to complex fraud lies in the democratization of raw data. As more organizations move their analytics to the cloud and embrace unsampled data streaming, the window of opportunity for dishonest webmasters continues to close. For the industry at large, the message is clear: transparency is not just an ethical preference but a financial necessity in the increasingly competitive world of online banking.
