rifanmuazin
In an era where digital transformation dictates the competitive landscape of the banking sector, Raiffeisen Bank’s Russian division recently undertook a comprehensive investigation into its digital acquisition channels to address a growing discrepancy between marketing expenditures and actual revenue growth. The initiative, spearheaded by Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, and supported by Victoriia Pashchenko, a prominent Web Analyst at OWOX BI, revealed a sophisticated scheme involving affiliate fraud. By utilizing advanced data streaming and high-granularity analytics, the bank successfully identified and terminated partnerships with dishonest affiliates who were manipulating traffic source data to claim unearned commissions.
The investigation began when Raiffeisen’s internal marketing team observed a concerning trend: the costs associated with affiliate traffic—specifically through Cost Per Action (CPA) networks—were escalating at an abnormal rate. Despite this surge in costs, the bank’s net revenue remained stagnant. Furthermore, customer experience data indicated a recurring technical anomaly: a significant number of users were experiencing "session breaks" while navigating the application forms on the bank’s official website. These red flags suggested that the bank’s attribution model was being compromised, leading to a deep-dive analysis of the bank’s digital funnel.
The Mechanism of Attribution Theft
The core suspicion centered on a practice often referred to in the digital marketing industry as "cookie stuffing" or "attribution hijacking." Raiffeisen suspected that certain CPA affiliates were employing browser extensions to interfere with the customer journey. The hypothesized scenario involved users who had installed third-party browser extensions, often under the guise of providing discount codes or price comparisons.
When a user reached the bank’s checkout or application page, these extensions would trigger a pop-up window offering a discount. If the user interacted with this pop-up, the extension would execute a script that automatically rewrote the traffic source data stored in the user’s browser cookies. By doing so, the extension would terminate the original session—which might have originated from an organic search or a paid search (CPC) campaign—and initiate a new session attributed to the fraudulent affiliate. This allowed the affiliate to claim a commission for a customer that the bank had already acquired through other, often more expensive, marketing channels.
Technical Implementation and Data Chronology
To prove this hypothesis, Raiffeisen Bank required a level of data granularity that standard web analytics tools could not provide. At the time, the bank utilized the standard version of Google Analytics, which, while robust for general reporting, lacked the raw, unsampled data necessary for forensic-level session analysis. To bridge this gap, the bank partnered with OWOX BI to implement a specialized data pipeline.
The technical solution involved three primary phases:
- Data Ingestion and Streaming: Using the OWOX BI Pipeline, the team established a real-time stream of hit-level data from the Raiffeisen website directly into Google BigQuery. This move was strategic, as Google BigQuery provides the high-security standards required by financial institutions while allowing for the storage of unsampled data. Unlike standard analytics platforms that aggregate data, this pipeline captured the exact timestamp of every single user interaction (hit), providing a transparent view of the user’s journey.
- Forensic Querying: With the raw data available in BigQuery, analysts could reconstruct the sequence of user actions across multiple sessions. They specifically looked for instances where a user visited a promotional page, appeared to drop off, and then immediately reappeared via a CPA affiliate link. The ability to track the actual timestamp of each hit was critical in identifying the "micro-breaks" in sessions that signaled automated interference.
- Data Visualization and Reporting: The processed data was then exported to Google Sheets via specialized add-ons to create pivot tables and reports accessible to the bank’s marketing specialists. These reports highlighted the specific Affiliate IDs associated with suspicious session behaviors.
Detailed Methodology for Fraud Detection
The analysts established a specific set of parameters to filter the data and isolate fraudulent activity. The primary objective was to identify users whose sessions were terminated and restarted within a window of less than 60 seconds while remaining on the same URL.
The filtering conditions were rigorous. First, the team identified the "Previous Session Source" (the original channel that brought the user to the site) and the "Current Session Source" (the channel claiming the conversion). They then calculated the time difference between the end of the previous session and the start of the new one. In a legitimate browsing scenario, a session break usually occurs due to inactivity or the user closing the browser. However, in the cases flagged by Raiffeisen, the sessions were breaking and restarting almost instantaneously while the user was actively filling out an application form.
The resulting data provided a "smoking gun." The reports demonstrated that for a specific segment of users, the traffic source was being switched from "Organic" or "Paid Search" to "Affiliate" mid-transaction. This confirmed that the bank was essentially paying twice for the same customer: once for the original acquisition and a second time for a fraudulent commission.
Supporting Data and Findings
The analysis revealed that two specific affiliate partners were responsible for a disproportionate number of these session-rewrite events. By examining the "stolen" transactions, the bank was able to quantify the financial impact. The data showed that a significant percentage of the affiliate commissions paid out over the preceding months were for transactions that should have been attributed to organic search or the bank’s own CPC campaigns.
For example, in a sample dataset used for the report, it was found that out of a specific cluster of transactions, nearly 15% showed evidence of source rewriting. This not only inflated the marketing budget but also skewed the bank’s understanding of its Return on Ad Spend (ROAS). The "robbed" channels—organic and CPC—were appearing less effective than they actually were, which could have led to poor strategic decisions regarding future budget allocations.
Official Response and Strategic Adjustments
Upon receiving the evidence, Raiffeisen Bank took immediate action to safeguard its marketing investments. Dmitriy Berezin noted that the ability to monitor statistics on affiliates in near real-time was a turning point for the bank’s digital strategy.
"The bank managed to optimize the ad budget by ceasing cooperation with two dishonest partners that rewrote the traffic sources and unreasonably overbilled Raiffeisen," the bank stated in its internal review. By terminating these relationships, the bank was able to immediately reduce its CPA expenditures without seeing a corresponding drop in actual customer acquisitions.
Furthermore, the bank implemented new protocols for its affiliate network management. These protocols include regular audits of session data and the use of the OWOX BI dashboard to monitor for spikes in session-break anomalies. This proactive approach ensures that the bank’s marketing budget is directed toward legitimate growth rather than being siphoned off by malicious actors.
Broader Impact and Industry Implications
The Raiffeisen Bank case study serves as a critical warning for the broader financial services industry and any organization heavily reliant on affiliate marketing. Ad fraud remains a multi-billion dollar problem globally, with CPA networks being particularly vulnerable to sophisticated attribution manipulation.
There are several key takeaways from this event:
- The Limitation of Standard Analytics: For large enterprises, standard web analytics are often insufficient for fraud detection. The sampling of data can hide the very anomalies—such as 60-second session breaks—that signal fraudulent activity. Moving to a "Big Data" approach with hit-level logging is becoming a necessity for fraud prevention.
- The Importance of First-Party Data: By owning their data in a cloud environment like BigQuery, companies can perform deep forensic analysis that is not possible within the walled gardens of traditional ad platforms.
- The Rising Threat of Browser Extensions: As consumers increasingly use extensions for privacy, discounts, and productivity, the potential for these tools to be weaponized for affiliate fraud grows. Companies must monitor the "mid-funnel" experience to ensure that the user’s path to conversion remains untampered.
- Strategic Budget Allocation: Fraudulent data leads to poor decision-making. If a bank believes its affiliate channel is performing better than its organic channel due to stolen attributions, it may incorrectly cut funding to SEO or brand awareness campaigns, causing long-term damage to its market position.
In conclusion, Raiffeisen Bank’s collaboration with OWOX BI highlights the vital intersection of web analytics and cybersecurity. By treating marketing data with the same level of scrutiny as financial transactions, the bank was able to uncover a hidden drain on its resources. As digital marketing continues to evolve, the ability to verify the integrity of every click and every conversion will remain a cornerstone of successful and secure online operations.
