admin
Raiffeisen Bank’s Russian division recently completed a comprehensive investigation into its digital marketing expenditure, uncovering a sophisticated scheme of affiliate marketing fraud that had been inflating acquisition costs while stagnating real revenue growth. In collaboration with data analytics firm OWOX BI, the financial institution identified and terminated relationships with dishonest Cost Per Action (CPA) affiliates who were utilizing browser extensions to hijack traffic sources. This strategic intervention has not only preserved the bank’s marketing budget but has also established a new framework for data-driven transparency in the Russian banking sector’s digital ecosystem.
The investigation began when Dmitriy Berezin, Head of Online Sales at Raiffeisen Bank, and his team noticed a troubling divergence in their performance metrics. Despite a significant increase in the budget allocated to affiliate traffic, the actual conversion revenue remained flat. Furthermore, technical logs indicated that customers were frequently experiencing unexplained session breaks while completing high-value application forms on the bank’s website. These anomalies suggested that the bank was paying commissions for customers who would have likely converted through organic or direct channels, a phenomenon often referred to in the industry as "cookie stuffing" or "source substitution."
The Mechanics of Affiliate Source Substitution
The fraudulent activity suspected by Raiffeisen Bank involved the exploitation of user-side software, specifically browser extensions. The suspected mechanism functioned as follows: a user would navigate to the Raiffeisen website, perhaps through a search engine (Organic) or a paid advertisement (CPC). As the user reached the checkout or application page, a third-party browser extension—often marketed as a tool for finding discounts or coupons—would detect the bank’s URL.
The extension would then trigger a pop-up window offering a discount or a special deal. If the user clicked this link, the extension would instantly refresh the session or redirect the user through an affiliate link. This process effectively rewrote the traffic source data stored in the user’s browser cookies. From the perspective of standard analytical tools, the original source (such as Google Search) was erased and replaced with the affiliate’s ID. Consequently, when the user completed the application, the bank’s system would credit the affiliate with a commission for a sale they did not actually generate.
Chronology of the Investigation and Implementation
The resolution of this issue required a multi-stage approach involving the migration of data to a more robust analytical environment and the implementation of granular tracking protocols.
The first phase involved the recognition of the limitations of standard web analytics. Raiffeisen Bank utilized the standard version of Google Analytics, which, while powerful, often employs data sampling for high-traffic sites and lacks the real-time, hit-level granularity necessary to detect millisecond-level session hijacking. To circumvent these limitations, the bank partnered with OWOX BI to create a specialized data pipeline.
The second phase focused on data infrastructure. The team established a system to stream raw, unsampled data from the Raiffeisen website directly into Google BigQuery. This move was critical for two reasons: first, Google BigQuery meets the rigorous security and compliance standards required by the financial services industry; second, it allowed the bank to collect the actual timestamp of every single "hit" or user interaction. By capturing the precise sequence of actions, analysts could identify patterns that were previously invisible.
The third phase was the analytical deep dive. Analysts from both Raiffeisen and OWOX BI focused on identifying "session breaks." They looked for instances where a user’s session was terminated and a new session was initiated on the exact same page within a window of less than 60 seconds. When the second session carried a different traffic source value—specifically from a CPA affiliate—it served as a "smoking gun" for source substitution.
Data Processing and Technical Methodology
To validate their suspicions, the analysts developed a set of specific criteria to filter the raw data stored in BigQuery. The objective was to isolate users who exhibited "unnatural" browsing behavior. The data points prioritized included unique User IDs, the specific pages where sessions ended and began, the timestamps of those transitions, and the traffic source values for both the preceding and succeeding sessions.
The technical team applied a logic filter to the data:
- Identify sessions that ended on a conversion-critical page (like a credit card application form).
- Locate the subsequent session for that same User ID.
- Calculate the time difference between the end of the first session and the start of the second.
- Flag cases where the time difference was under one minute and the traffic source had changed from a non-affiliate channel to an affiliate channel.
Using an OWOX BI add-on, this processed data was imported into Google Sheets to create accessible reports for the marketing department. These reports revealed a clear pattern of "robbed" transactions, where organic and CPC (Cost Per Click) channels were being systematically stripped of their attribution in favor of specific affiliate partners.
Findings and Official Response
The results of the data analysis were definitive. The report generated by the OWOX BI pipeline demonstrated that a significant portion of transactions credited to certain affiliates were, in fact, the result of source rewriting. The data showed that these affiliates were not introducing new customers to the bank but were instead intercepting existing customers at the final stage of the funnel.
Following the investigation, Raiffeisen Bank took decisive action. The bank identified two specific affiliate partners who were acting in bad faith. By presenting the data-backed evidence of fraud, the bank was able to terminate these partnerships immediately. This move allowed the marketing team to stop the leakage of funds and reallocate that budget toward genuine customer acquisition channels that provided a measurable Return on Ad Spend (ROAS).
Dmitriy Berezin noted that the ability to track sequences of user actions across sessions in a single report was the turning point. "The company managed to optimize the ad budget by ceasing cooperation with two dishonest partners that rewrote the traffic sources and unreasonably overbilled Raiffeisen," the report concluded.
Broader Implications for the Digital Advertising Industry
The Raiffeisen Bank case highlights a growing challenge in the digital marketing landscape: the sophistication of ad fraud. As financial institutions move more of their customer acquisition efforts online, they become primary targets for CPA fraud, which is estimated to cost advertisers billions of dollars annually worldwide.
This event underscores several critical trends in marketing technology:
- The Move Toward Raw Data: Standard analytics dashboards are no longer sufficient for fraud detection. Large enterprises are increasingly moving toward "data democratization" and raw data warehousing in environments like BigQuery to gain full ownership and visibility of their information.
- The Vulnerability of the Last-Click Model: The "last-click" attribution model, which rewards the final source before a conversion, is highly susceptible to hijacking. This case may encourage more firms to adopt multi-touch attribution (MTA) models that distribute credit across the entire customer journey, making it harder for a single fraudulent "last-minute" interaction to claim the full commission.
- The Role of Browser Security: The fact that browser extensions can so easily manipulate cookie data poses a broader security and privacy question. While Raiffeisen solved this through analytical detection, the industry may see a push for stricter browser permissions regarding the modification of third-party cookies.
- Transparency in Affiliate Networks: This investigation serves as a warning to CPA networks. To maintain their reputation, networks must implement more stringent monitoring of their affiliates’ methods. The ability for a client like Raiffeisen to independently verify traffic sources puts the onus on networks to ensure their partners are providing genuine value.
Analysis of Financial Impact
For a major institution like Raiffeisen Bank, the financial implications of such fraud are substantial. CPA commissions for banking products—such as credit cards, mortgages, or personal loans—are among the highest in the affiliate marketing world. By eliminating even a small percentage of fraudulent claims, the bank saves millions of rubles in unnecessary payouts.
Furthermore, the "session breaks" identified during the investigation were not just a financial drain; they were a customer experience issue. When a browser extension forces a page refresh or a session break, it can lead to data loss in form fields, causing frustration and leading to potential lead abandonment. By cleaning up the affiliate ecosystem, Raiffeisen simultaneously improved the technical stability of its conversion funnel and the overall user experience.
Conclusion
The collaboration between Raiffeisen Bank and OWOX BI represents a successful application of big data analytics to solve a complex commercial problem. By moving beyond surface-level metrics and diving into raw hit-level data, the bank was able to uncover a hidden layer of inefficiency and dishonesty in its marketing operations. As digital acquisition costs continue to rise, the ability to distinguish between genuine growth and fraudulent inflation will remain a competitive necessity for leaders in the financial services sector. The framework established by Berezin and Pashchenko provides a blueprint for other organizations seeking to safeguard their digital investments against the evolving tactics of bad actors in the affiliate space.
