Key takeaways
- Affiliate fraud like cookie-stuffing (inserting affiliate codes via hidden background tabs, with no user action) can go undetected for months inside standard attribution reporting.
- Last-click attribution is structurally blind to this problem — it records a credited conversion either way, making fraud nearly impossible to spot from platform dashboards alone.
- Even without outright fraud, a large share of affiliate spend — particularly cashback and loyalty sites — tends to ride on purchases that would have happened anyway.
- A time-based incrementality test (turning a channel off for a defined period and measuring the revenue impact) can reveal whether affiliate partners are actually driving growth.
- When we ran this test with a global direct-to-consumer (DTC) brand, revenue didn't move when affiliate loyalty partners were switched off — confirming the spend was non-incremental and freeing budget for channels that actually convert new customers.
Affiliate fraud is having a moment in the press. A recent Bloomberg investigation, amplified by researcher Ben Edelman, surfaced a troubling pattern: a popular shopping browser extension was allegedly opening hidden background tabs during checkout — no click, no user action — to insert its own affiliate code and overwrite whatever legitimate referrer was already in place. Classic cookie-stuffing, and a clear violation of affiliate network terms of service.
The code that enabled this behavior was reportedly added in December, meaning it ran live for months before scrutiny caught up with it. Whether that was deliberate or a bug that got exploited may never be fully resolved — but for advertisers, the outcome is the same either way: you paid commissions on sales you didn't actually need help closing.
If you manage an affiliate or influencer program, the instinct is probably to audit your extensions. That's a reasonable first step — but it's not sufficient. Cookie-stuffing is only part of the problem. The deeper, quieter issue is that a large share of affiliate spend is structurally non-incremental, even when nobody is doing anything technically wrong.
Here's why that matters, and what you can actually do about it.
Why last-click attribution can't protect you
Marketing attribution works by crediting a conversion to the most recent (or most weighted) touchpoint before purchase. The problem is that last-click models record a credit regardless of whether the touchpoint influenced the decision. If a customer had already decided to buy and then a coupon extension fired an affiliate code in the background, last-click attribution sees a conversion with an affiliate referrer — and counts it.
From a reporting standpoint, fraud looks identical to a legitimate affiliate referral. Both show up as credited conversions. Both inflate the channel's apparent return. And if your measurement stack is built primarily on marketing attribution — whether first-touch, last-touch, or multi-touch — you have no structural way to tell the difference between a sale your affiliate drove and a sale your affiliate simply took credit for.
This is the core failure mode of correlation-based measurement: it tells you what happened near a conversion, not what caused it. Affiliate fraud is specifically designed to exploit that gap.
The attribution problem that predates fraud
Even setting fraud aside, affiliate channels — particularly cashback and loyalty sites — have a well-documented incrementality problem. These partners tend to activate at the very end of the purchase journey, often after a customer has already decided to buy. They insert themselves at checkout with a coupon code or cashback offer, collect the commission, and show up as a top performer in last-click reports.
The question attribution can't answer: would that customer have bought anyway?
For many brands, the honest answer is yes. Cashback and rewards sites are typically capturing intent that already existed — not creating new demand. That's not necessarily a reason to eliminate them entirely (they can serve retention or basket-size goals), but it is a reason to question how much incremental revenue they're actually generating and price the relationship accordingly.
This is exactly the problem incrementality testing is built to solve.
How a time test exposes non-incremental affiliate spend
The design challenge with affiliate incrementality testing is that you can't randomize users or geographies across coupon and cashback platforms the way you can with paid social or search. Affiliate partners either show up in a session or they don't — you can't serve them to half your audience.
The practical workaround is a time-based test: turn off your affiliate loyalty partners in one market for a defined window, and measure what happens to revenue. If the affiliate channel is genuinely driving incremental sales, revenue should fall during the off period. If it isn't, revenue stays flat — and you've just found budget to reallocate.
We ran this exact design with a global DTC brand that was allocating a significant portion of its marketing budget to cashback and rewards sites. Despite affiliate appearing as a top performer in Google Analytics, the team suspected last-click was overstating its impact.
Using a hybrid time series and geo experiment, we deactivated all affiliate loyalty partners in the US for seven weeks. The other seven countries the brand operated in remained on and served as the synthetic control group, letting us isolate the US revenue trend from broader seasonal or market movements.
The result: no measurable change in US revenue during the shutoff. Google Analytics affiliate share dropped — as expected — but total sales didn't move. We also ran a product-level check: if affiliate spend were genuinely incremental, products with higher pre-test affiliate share should have seen a relative sales decline during the off period. They didn't. High-affiliate-share stock-keeping units (SKUs) performed no differently than low-affiliate-share SKUs.
The brand significantly reduced its US affiliate investment. Revenue stayed flat, and the recaptured budget was redirected to channels with demonstrated incrementality, improving overall customer acquisition costs.
You can read the full details in the Affiliate on/off test reveals the incrementality of loyalty case study.
What this means for fraud detection specifically
Time tests don't just diagnose organic non-incrementality — they can surface fraud patterns too. If cookie-stuffing or other injection schemes are inflating your affiliate credits, switching off the channel entirely and watching for a gap between Google Analytics-reported conversions and actual revenue creates a clear signal. Fraud-inflated attribution collapses immediately when the affiliate codes stop firing. True incremental revenue, if it exists, shows up in the revenue gap.
Put simply: if your reported affiliate conversions drop sharply when you turn the channel off but your revenue doesn't, that's the shape of a non-incremental — or fraudulent — program. Attribution diverges from outcome, which is exactly what you're looking for.
This is also why auditing extensions alone isn't enough. An audit tells you whether bad code exists. A time test tells you whether the spend was ever working in the first place.
Getting started
If you're running affiliate or influencer programs and haven't tested their incrementality, the steps are more straightforward than they might seem:
1. Pick a market to pause. Choose a geography large enough to generate a readable signal but not so central that pausing it would create business disruption. The US is often a practical choice for brands with international operations, since other markets can serve as the control.
2. Define your window. Seven to eight weeks is typically enough to separate the treatment effect from normal week-to-week noise. Shorter windows can work for larger programs with higher transaction volumes.
3. Build a counterfactual. The cleanest approach is a synthetic control — using comparable markets that remained on to model what US revenue would have looked like without the shutoff. This controls for seasonality and macro trends.
4. Check both aggregate and product-level results. Aggregate revenue is the headline metric, but product-level analysis provides a useful robustness check and makes the finding harder to dismiss.
If you're new to experiment design, the Getting started with incrementality testing guide walks through the fundamentals — and Incrementality: The fundamentals goes deeper on the causal logic behind why control groups matter.
The bottom line
The Bloomberg investigation is a useful reminder that affiliate fraud is real and can sit undetected inside standard attribution reporting for a long time. But the more pervasive problem — non-incremental affiliate spend — doesn't require anyone to be doing something wrong. It just requires marketers to trust last-click numbers they shouldn't.
Time-based incrementality tests are one of the most practical tools available for cutting through that noise. They don't require user-level randomization, they work within the constraints of how affiliate channels actually operate, and they produce the kind of clean causal evidence that platform-reported metrics simply can't.
If your affiliate program looks great in attribution but you've never tested whether turning it off would cost you revenue — now is a good time to find out.
Frequently asked questions
What is cookie-stuffing and why is it hard to detect?
Cookie-stuffing is a fraud technique where an affiliate code is inserted into a user's browser — via a hidden background tab, for example — without any click or action by the user. It's hard to detect because last-click attribution records a credited conversion either way. Fraudulent referrals look identical to legitimate ones inside standard platform dashboards, and the behavior can run for months before scrutiny catches up with it.
Why can't multi-touch attribution solve this problem?
Whether you use first-touch, last-touch, or multi-touch attribution, every model in that family shares the same structural flaw: it records what happened near a conversion, not what caused it. Because fraudulent affiliate codes appear in session data just like legitimate referrers do, no form of correlation-based attribution can reliably tell the difference between a sale an affiliate drove and a sale it simply took credit for.
Are cashback and loyalty affiliates always fraudulent?
No. There's an important distinction between outright fraud and structural non-incrementality. Cashback and loyalty sites can be non-incremental — activating after a customer has already decided to buy — without anyone doing anything technically wrong. That's not necessarily a reason to eliminate them entirely, since they can serve retention or basket-size goals, but their commissions should be priced to reflect what they're actually delivering rather than what last-click reports suggest.
How does a time-based incrementality test work for affiliate channels?
Because you can't split affiliate traffic across user or geographic segments the way you can with paid social or search, the practical approach is an on/off test: deactivate your affiliate loyalty partners in one market for a defined window — seven to eight weeks is a common duration — and measure what happens to revenue. Other markets that remain on serve as the synthetic control group, letting you separate the treatment effect from seasonality or broader market movements.
What did the global DTC brand case study find?
When we deactivated all affiliate loyalty partners in the US for seven weeks, there was no measurable change in US revenue. Google Analytics showed a drop in affiliate-attributed share, but total sales didn't move. A product-level check confirmed the finding: SKUs with high pre-test affiliate share performed no differently during the shutoff than SKUs with low affiliate share. The brand reduced its US affiliate investment; revenue stayed flat, and the recaptured budget was redirected to channels with demonstrated incrementality.
Can a time test distinguish between fraud and ordinary non-incrementality?
A time test surfaces both. If cookie-stuffing or another injection scheme is inflating affiliate credits, switching the channel off causes attribution-reported conversions to drop sharply while actual revenue holds steady — because the fraud was generating credited conversions, not real sales. That divergence between attributed conversions and revenue is the same signal you'd see from a legitimately operating but non-incremental partner. The test can't always determine which cause is responsible, but it does confirm whether the spend was working in either case.
How should I get started if I've never run an affiliate incrementality test?
Start with four steps: pick a market large enough to produce a readable signal (the US is practical for brands with international operations, since other markets can act as controls); plan for a seven-to-eight-week window to separate the effect from normal noise; build a synthetic control using comparable markets that stayed on; and check both aggregate revenue and product-level results as a robustness measure. Our Getting started with incrementality testing guide covers the experimental fundamentals in more detail.
Related reading
