Raiffeisen Bank, one of the leading financial institutions in the Russian Federation, recently underwent a comprehensive investigation into its digital acquisition channels after internal audits revealed a significant discrepancy between marketing expenditures and actual revenue growth. The bank’s marketing department observed an abnormal surge in the costs associated with affiliate traffic, specifically within its Cost Per Action (CPA) campaigns. Despite the rising payouts to affiliate partners, the overall conversion volume remained stagnant. Furthermore, technical logs indicated a pattern of interrupted user sessions during the application process on the bank’s official website. These anomalies led the bank’s analysts to suspect a sophisticated form of attribution fraud known as traffic source substitution, or "cookie stuffing," orchestrated through malicious or deceptive browser extensions.
To address this challenge, Raiffeisen Bank collaborated with OWOX BI, a specialized data analytics firm, to implement a robust tracking and reporting system capable of identifying fraudulent activities in near real-time. The resulting investigation not only confirmed the bank’s suspicions but also provided the necessary evidence to terminate contracts with dishonest affiliates, leading to a significant optimization of the bank’s digital marketing budget.
The Mechanics of Attribution Hijacking
The fraudulent activity suspected by Raiffeisen Bank involved a complex interaction between users, browser extensions, and affiliate tracking cookies. The hypothesis centered on the use of "coupon" or "discount" browser extensions that users frequently install to find better deals while shopping online. When a user began the checkout or application process on the Raiffeisen website, the extension would trigger a popup window offering a discount or special offer.
If the user clicked the link within this popup, the extension would execute a script to terminate the current session and immediately redirect the user back to the same page through an affiliate link. This process, often happening in less than a minute, effectively rewrote the traffic source data in the user’s browser cookies. Consequently, even if the user had originally found the bank through organic search or a paid search (CPC) campaign, the credit for the final conversion—and the accompanying commission—was diverted to the affiliate. This "last-click" attribution model, while standard in many marketing circles, was being exploited to "rob" legitimate channels of their attributed revenue.
Limitations of Standard Web Analytics
A primary obstacle for Raiffeisen was the limitation of standard web analytics tools. Using the standard version of Google Analytics, the bank’s marketing team was unable to access the granular, hit-level data required to prove that session breaks were being artificially induced. Standard analytics often utilize data sampling, which can obscure the specific sequences of individual user actions, especially when those actions occur within seconds of each other.
To gain the necessary transparency, the OWOX BI team recommended a shift to a high-security, cloud-based data warehouse. The solution involved streaming raw data from the bank’s website directly into Google BigQuery using the OWOX BI Pipeline. This approach ensured that Raiffeisen could access unsampled, hit-level data with precise timestamps for every interaction. By bypassing the limitations of standard reporting, the bank was able to track the exact sequence of events across multiple sessions for a single user, providing a "forensic" view of the customer journey.
A Three-Step Chronology of the Investigation
The investigation was structured into three distinct phases: data collection, technical processing, and reporting/action.
Step 1: Raw Data Aggregation and Streaming
The first priority was ensuring that all user interactions were captured without loss or sampling. By utilizing the OWOX BI Pipeline, the bank began streaming hit-level data into Google BigQuery. Unlike standard reports, this raw data included the client_id (a unique identifier for the browser), the hit_timestamp, and the specific traffic_source for every page view and event. This allowed analysts to construct a timeline for every user who interacted with the bank’s application forms. For example, the team could now identify a user who landed on a promotional page via a paid search ad at 10:00:01 AM and then suddenly appeared to "re-enter" the site via an affiliate link at 10:00:45 AM.
Step 2: Filtering and Identifying Anomalies
Once the data was centralized in BigQuery, the analysts developed SQL queries to filter for specific indicators of fraud. The investigation focused on users who met a very narrow set of criteria:
- The user had at least two distinct sessions within a single day.
- The time elapsed between the end of the first session and the start of the second session was less than 60 seconds.
- The second session began on the exact same page where the first session ended (the checkout or application page).
- The traffic source for the first session was a "clean" channel (such as organic search or direct), while the source for the second session was a specific CPA affiliate.
This filtering process allowed the team to isolate the "stolen" transactions from legitimate affiliate referrals. By analyzing the client_id, the bank could see the exact moment the attribution was hijacked.
Step 3: Reporting and Forensic Evidence
The final step involved exporting this filtered data into a format that the marketing and legal teams could use. Using a Google BigQuery-to-Sheets add-on, the analysts created a pivot table that listed every transaction suspected of being fraudulent. This report included the IDs of the customers, the original traffic source that should have received credit, and the name of the affiliate partner who had claimed the commission.
The report revealed a startling pattern: two specific affiliate partners were responsible for a disproportionate number of these "60-second session breaks." The data showed that these affiliates were not driving new customers to the bank; rather, they were intercepting customers who were already in the final stages of the application process.
Supporting Data and Statistical Context
Affiliate fraud is a growing concern in the global digital economy. Industry reports from organizations like Juniper Research suggest that advertising fraud costs businesses tens of billions of dollars annually, with a significant portion of that coming from attribution manipulation. In the financial sector, where "Cost Per Action" payouts for a successful credit card or loan application can be quite high, the incentive for affiliates to engage in "cookie stuffing" is substantial.
In the case of Raiffeisen Bank, the data provided clear evidence of systemic abuse. The internal report showed that for certain affiliates, nearly 80% of their "referred" transactions followed a session break from a different source within the same minute. This was statistically impossible under normal browsing behavior, as users do not typically exit a banking application and immediately re-enter through a different link while in the middle of filling out sensitive financial information.
Official Responses and Strategic Impact
Following the discovery, Raiffeisen Bank’s digital marketing leadership, headed by Dmitriy Berezin, took immediate action. The bank confronted the affiliate networks involved with the forensic data provided by the OWOX BI analysis. Faced with hit-level evidence of source substitution, the bank was able to justify the immediate termination of contracts with the two dishonest partners.
Dmitriy Berezin noted that the ability to track user actions across sessions in a single, unsampled report was the turning point for the bank’s marketing strategy. By eliminating these fraudulent actors, Raiffeisen was able to reallocate its marketing budget toward high-performing, legitimate channels like CPC and organic search, which had previously been "robbed" of their performance metrics.
Broader Implications for the Banking Industry
The Raiffeisen Bank case study highlights a critical vulnerability in modern digital marketing: the reliance on aggregated, sampled data for high-stakes financial decisions. As financial institutions move more of their acquisition efforts online, the sophistication of fraud increases in tandem.
This event underscores several key takeaways for the industry:
- The Necessity of Hit-Level Data: Standard analytics are sufficient for general trends but inadequate for fraud detection. Real-time, unsampled data is required to identify the granular timing of attribution changes.
- Zero-Trust Attribution: Marketing teams must move toward a more skeptical view of affiliate performance, particularly when "last-click" models are in place. Implementing multi-touch attribution (MTA) can help mitigate the impact of a single hijacked click at the end of the funnel.
- The Danger of Browser Extensions: Companies must be aware that the user’s browser environment is not always "clean." Malicious or aggressive extensions can interfere with site sessions in ways that are invisible to the user but highly damaging to the advertiser.
- Data Sovereignty: By moving data into a private warehouse like BigQuery, companies maintain better control over their information and can perform the deep-dive audits necessary to protect their bottom line.
Raiffeisen Bank’s proactive approach has set a benchmark for other financial institutions in the region. By treating marketing data as a financial asset that requires auditing and protection, the bank successfully defended its budget against sophisticated digital theft and ensured that its marketing investments were driving genuine growth rather than merely subsidizing fraudulent intermediaries.
