Raiffeisen Bank Uncovers Affiliate Fraud and Optimizes Marketing Spend Through Advanced Data Analytics

In an era where digital acquisition costs are under constant scrutiny, Raiffeisen Bank, one of Russia’s leading financial institutions, recently identified and neutralized a sophisticated affiliate marketing fraud scheme that was siphoning off marketing budgets. By collaborating with web analytics specialists from OWOX BI, the bank successfully diagnosed a case of "source overwriting," a practice where dishonest affiliates hijack the attribution of a sale to claim unearned commissions. This investigation not only saved the bank significant capital but also highlighted a growing vulnerability in the Cost Per Action (CPA) marketing ecosystem.

The investigation began when the bank’s marketing department noticed a troubling discrepancy in their performance metrics. While the costs associated with affiliate traffic—typically paid out on a commission basis for successful credit applications or account openings—were rising at an abnormal rate, the actual bottom-line revenue remained stagnant. Furthermore, technical logs indicated that customers were experiencing unusual session breaks while in the middle of filling out application forms on the bank’s website. These anomalies prompted a deep-dive forensic analysis into the bank’s traffic sources and attribution models.

The Anatomy of the Fraud: Browser Extensions and Source Overwriting

The primary suspicion held by the Raiffeisen team was that certain CPA affiliates were utilizing malicious or "gray-area" browser extensions to manipulate traffic data. These extensions, often marketed to consumers as tools to find discounts, promo codes, or cash-back offers, monitor the user’s browsing behavior in real-time. When the extension detects that a user has reached a checkout or application page, it triggers a pop-up window offering a discount.

If the user clicks on this link, the extension executes a script that refreshes the page or redirects the user through an affiliate link. Crucially, this process rewrites the traffic source data stored in the user’s cookies. For example, a user who originally arrived at the bank’s site via an expensive paid search (CPC) campaign or through organic search would suddenly be re-categorized as a "referral" from an affiliate partner. Consequently, when the user completes the application, the bank’s system attributes the conversion to the affiliate, who then receives a commission for a customer the bank had already acquired through other channels.

This practice, often referred to in the industry as "cookie stuffing" or "last-click hijacking," effectively robs other marketing channels of their credit and forces the advertiser—in this case, Raiffeisen Bank—to pay twice: once for the initial acquisition and a second time for a fraudulent affiliate commission.

The Limitations of Standard Analytics Tools

One of the significant hurdles in identifying this fraud was the limitation of standard web analytics tools. Raiffeisen Bank utilizes the standard version of Google Analytics, which, while powerful for general reporting, presents challenges for forensic-level data investigation. Standard Google Analytics often relies on data sampling to handle high traffic volumes, which can obscure the minute-by-minute hit-level data required to track fraud. Furthermore, it does not provide the raw, unsampled timestamps for every interaction, making it difficult to reconstruct the exact sequence of events during a single user session.

To bypass these limitations, the OWOX BI team implemented a more robust data architecture. The solution involved the deployment of the OWOX BI Pipeline, which streams raw, hit-level data directly from the bank’s website into Google BigQuery. Google BigQuery, a cloud-based data warehouse, offers the computational power to process billions of rows of data and meets the stringent security standards required by the financial services industry. By collecting unsampled data in near real-time, the bank was able to access the actual timestamp of every "hit" (every page view or button click), allowing for a precise chronological reconstruction of user behavior.

Chronology of the Investigation and Data Processing

The investigation followed a structured, three-step methodology designed to isolate fraudulent patterns from legitimate user behavior.

Step 1: Raw Data Collection and Integration
The first phase involved establishing a continuous flow of data from the Raiffeisen website to Google BigQuery. This ensured that every interaction—from the moment a user landed on the homepage to the final submission of an application—was recorded with a unique Client ID and a precise timestamp. Unlike standard reporting, this hit-level data allowed analysts to see if a user’s traffic source changed mid-journey.

Step 2: Filtering and Identification of Anomalies
With the raw data in BigQuery, the analysts developed a specific query to identify "unnatural" session transitions. The logic was based on a simple but effective hypothesis: if a user is in the middle of a checkout process and their session ends, only for a new session to begin on the exact same page within a few seconds with a different traffic source, it is highly likely that a browser extension has overwritten the source.

The analysts filtered the data for instances where:

1. A user had two consecutive sessions.
2. The duration between the end of the first session and the start of the second was less than 60 seconds.
3. Both sessions occurred on the same URL (the application or checkout page).
4. The traffic source for the second session was an affiliate channel, while the first was something else (e.g., organic, direct, or CPC).

Step 3: Reporting and Visualization
The final step involved exporting this filtered data into a format that the marketing team could act upon. Using a dedicated add-on to bridge Google BigQuery and Google Sheets, the team created pivot tables that identified the specific Affiliate IDs associated with these suspicious transitions. This report clearly showed which affiliates were "stealing" transactions from other channels and the exact volume of revenue being misattributed.

Supporting Data and Findings

The results of the analysis were definitive. The data revealed that a significant percentage of transactions attributed to certain CPA partners were, in fact, the result of source overwriting. For instance, the report highlighted cases where a user would spend five minutes filling out a form after arriving via an organic Google search. At the four-minute mark, a second session would trigger, attributed to an affiliate, and the transaction would be recorded under that affiliate’s account just seconds later.

The pivot tables generated during the study allowed Raiffeisen to quantify the "robbery." It was discovered that organic search and paid search (CPC) were the most frequent victims of this practice. By identifying the specific Client IDs and affiliate markers involved, the bank was able to build a list of "bad faith" actors within their CPA network.

Official Responses and Strategic Impact

Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, emphasized the importance of this transparency for the bank’s marketing efficiency. By having access to granular, unsampled data, the bank was no longer forced to rely on the self-reported figures of affiliate networks. The bank took immediate action by terminating contracts with two major affiliate partners who were found to be consistently engaging in these dishonest practices.

The OWOX BI team, led by web analyst Victoriia Pashchenko, noted that this type of fraud is becoming increasingly common as browser extensions proliferate. The technical solution provided a repeatable framework for Raiffeisen to monitor affiliate health. Instead of a one-time audit, the bank now possesses a monitoring system that can flag suspicious attribution shifts in real-time, ensuring that the marketing budget is allocated to partners who drive genuine incremental growth.

Broader Implications for the Digital Advertising Industry

The Raiffeisen case serves as a cautionary tale for the broader digital marketing industry. Affiliate fraud is a multi-billion dollar problem. According to industry estimates, invalid traffic and attribution fraud can account for anywhere from 10% to 30% of total ad spend in unmonitored environments.

For the financial sector, where the "bounty" for a new customer can be high, the incentives for fraud are particularly strong. This case highlights several critical trends:

1. The Need for Hit-Level Data: Standard, aggregated analytics are no longer sufficient for fraud detection. Companies must invest in data warehousing solutions like BigQuery to perform forensic analysis.
2. The Vulnerability of Last-Click Attribution: The "last-click" model, while simple, is highly susceptible to hijacking. This investigation encourages a shift toward more complex, multi-touch attribution models that can see through last-minute source changes.
3. First-Party Data Sovereignty: By owning their data pipeline through tools like OWOX BI, Raiffeisen moved away from relying on third-party black-box reports, gaining "data sovereignty" that allowed them to challenge their partners’ claims.

In conclusion, Raiffeisen Bank’s proactive approach to data analytics has set a benchmark for how financial institutions can protect their digital investments. By identifying the specific mechanics of affiliate fraud and utilizing cloud-based processing to uncover it, the bank successfully optimized its advertising budget and ensured that its marketing spend is directed toward legitimate customer acquisition. This move not only improved the bank’s ROI but also sent a clear message to the CPA network ecosystem regarding the bank’s commitment to transparency and data-driven integrity.