admin
In an era where digital acquisition costs are under constant scrutiny, Raiffeisen Bank’s Russian division recently identified and dismantled a sophisticated affiliate marketing fraud scheme that was inflating their Cost Per Action (CPA) expenditures while stagnating real revenue growth. The investigation, conducted in partnership with the data analytics firm OWOX BI, revealed that several affiliate partners were utilizing browser extensions to intercept organic and paid search traffic, effectively "stealing" attribution through the unauthorized rewriting of traffic source data. This case highlights a growing vulnerability in the digital banking sector, where complex application forms and multi-session user journeys provide cover for malicious actors to manipulate attribution models.
The Discovery of Attribution Discrepancies
The investigation began when the digital marketing team at Raiffeisen Bank, led by Dmitriy Berezin, Head of Online Sales, noticed a series of statistical anomalies in their performance reports. Despite a significant surge in the volume of traffic attributed to CPA (Cost Per Action) networks, the bank’s total revenue and the number of successfully issued credit products remained flat. Furthermore, the marketing team observed an unusual pattern of session breaks occurring exactly when users were in the middle of filling out sensitive application forms on the bank’s website.
In a typical digital banking environment, a session break during a high-intent action—such as entering personal data for a loan—is a red flag for technical errors or user experience friction. However, the frequency of these breaks, coupled with the rising costs from affiliates, suggested a more deliberate interference. Raiffeisen suspected that certain affiliate marketers were employing a tactic known as "source rewriting" or "cookie stuffing," leveraging browser-based tools to claim credit for conversions that would have occurred regardless of their involvement.
The Mechanics of Modern Affiliate Fraud
The specific fraud mechanism suspected by Raiffeisen involved the use of third-party browser extensions, often marketed to consumers as "coupon finders" or "discount aggregators." When a user began the checkout or application process on the Raiffeisen website, the extension would trigger a popup window offering a discount or a promotional code. If the user clicked any link within this popup, the extension would execute a script that automatically rewrote the traffic source data in the user’s browser cookies.
By injecting their own affiliate IDs into the session data at the final moment of conversion, these dishonest partners ensured that the bank’s analytics system would attribute the final sale to the affiliate channel rather than the original source, such as organic search or a paid Google Ads (CPC) campaign. This not only resulted in the bank paying commissions for customers they had already acquired through other means but also obscured the true ROI of their various marketing channels.
Technical Implementation: Bridging Google Analytics and BigQuery
To validate these suspicions, Raiffeisen Bank required a level of data granularity that standard web analytics tools often fail to provide. Because the bank utilized the standard version of Google Analytics, they faced limitations regarding data sampling and the inability to view raw, unsampled hit-level data. To circumvent these hurdles, Victoriia Pashchenko and the OWOX BI team implemented a robust data pipeline to stream raw website data directly into Google BigQuery.
The choice of Google BigQuery was strategic, as it meets the high-security standards required for financial institutions while allowing for the processing of massive datasets in near real-time. By utilizing the OWOX BI Pipeline, the bank was able to collect the actual timestamp of every hit and track the exact sequence of user actions across multiple sessions. This transition from aggregate reporting to raw data analysis was the critical turning point in the investigation, providing the "forensic" evidence needed to identify fraudulent patterns.
The Investigative Framework: Identifying Rewritten Traffic Sources
With the raw data successfully integrated into BigQuery, the analysts established a specific methodology to identify fraud. They focused on identifying instances where a user’s session was abruptly terminated and replaced by a new session with a different traffic source within a very narrow timeframe. The analysts filtered the data based on several key criteria:
- Session Proximity: Instances where two consecutive sessions from the same user occurred within less than 60 seconds.
- Page Consistency: Both sessions had to occur on the same URL, specifically the application or checkout page.
- Source Transition: The first session was attributed to a non-affiliate source (Organic, Direct, or CPC), while the second session was attributed to a CPA partner.
By writing SQL queries to isolate these specific parameters, the team could visualize the exact moment an affiliate extension "hijacked" a session. The data revealed a startling pattern: a significant portion of customers who were supposedly brought in by affiliates had actually arrived on the site via organic search or paid advertisements, only to have their source value changed seconds before completing an application.
Quantifying the Financial Impact and Partner Culpability
The final stage of the investigation involved exporting this filtered data into Google Sheets via a specialized add-on to create actionable reports for the marketing department. These reports identified the specific affiliate IDs responsible for the source rewriting and calculated the exact number of "stolen" transactions.
The findings were definitive. The analysis showed that two major affiliate partners were systematically rewriting traffic sources. In these cases, the "second" session (the fraudulent one) was initiated almost immediately after the user interacted with a browser extension popup. By cross-referencing transaction IDs, the bank could see exactly which channels were being "robbed." Organic search and CPC campaigns were the primary victims, with their conversion credit being siphoned off by the dishonest CPA affiliates.
Strategic Implications for the Digital Banking Sector
The resolution of this case had immediate financial and strategic benefits for Raiffeisen Bank. Upon receiving the evidence, the bank promptly terminated its relationship with the two dishonest partners. This action allowed the marketing team to reallocate a significant portion of the budget that was previously being wasted on fraudulent commissions back into legitimate, high-performing channels.
Beyond the immediate cost savings, the investigation underscores several broader implications for the industry:
- The Limitations of Last-Click Attribution: This case serves as a cautionary tale for organizations relying solely on last-click attribution models. Fraudulent actors exploit the "last-click" logic by ensuring their tag is the final one recorded before a conversion.
- The Necessity of Raw Data: Standard analytics interfaces are often too high-level to catch sophisticated fraud. Financial institutions must invest in data warehousing (like BigQuery) to perform deep-dive forensics.
- The Rise of Browser-Level Interference: As server-side tracking becomes more common, fraudsters are moving "closer to the user" by utilizing browser extensions and client-side scripts to manipulate data before it ever reaches the server.
- Vendor Transparency: The ability to monitor affiliate behavior in real-time is no longer a luxury but a necessity for maintaining a healthy digital ecosystem.
Conclusion and Future Outlook
The collaboration between Raiffeisen Bank and OWOX BI demonstrates that while affiliate fraud is becoming more sophisticated, it is not invisible. By leveraging cloud-based data processing and rigorous analytical filtering, companies can defend their marketing budgets against bad actors. For Raiffeisen, the project did more than just stop a leak in their budget; it provided a blueprint for ongoing monitoring and a more transparent relationship with their legitimate marketing partners.
Dmitriy Berezin emphasized that the ability to track the sequence of user actions across sessions in a single report was the key to their success. As digital banking continues to evolve, the integration of advanced web analytics and big data tools will remain the primary defense against the increasingly complex landscape of online ad fraud. This case stands as a landmark for how traditional financial institutions can adopt agile, tech-forward strategies to protect their digital investments and ensure that every marketing dollar spent is driving genuine growth.
