Key takeaways
- Last-click attribution assigns conversion credit based on the final touchpoint before a purchase — making it trivially easy for bad actors, affiliate partners, and browser extensions to claim credit for sales they didn't drive.
- Cookie-stuffing — inserting affiliate codes without any user action — is a known exploit that goes beyond typical last-click gaming and explicitly violates affiliate network terms of service.
- Affiliate channels routinely appear as top performers in platform reporting while driving little to no incremental revenue.
- A controlled on/off incrementality test is one of the most reliable ways to measure whether your affiliate spend is actually moving the needle.
- When we ran that test with a global direct-to-consumer (DTC) brand, turning off affiliate loyalty partners produced no measurable drop in revenue — despite a significant fall in affiliate-attributed share.
The problem with "last click gets the credit"
Imagine a customer who's been planning to buy your product for weeks. They've visited your site, added something to their cart, and they're three seconds away from checking out. At that exact moment, a browser extension quietly drops an affiliate cookie — no click, no coupon, no influence — and claims the commission. Your affiliate dashboard lights up. Another "successful" referral.
This isn't a hypothetical. It's how last-click attribution breaks down in practice, and recent reporting on the shopping app Phia has put a sharp spotlight on just how badly it can go.
A Bloomberg investigation, analyzed by researcher Ben Edelman, found that Phia's browser extension was opening a hidden background tab during checkout — with no user click and no visible action — to insert its own affiliate code and overwrite the legitimate referrer. That's textbook cookie-stuffing, and it violates the terms of service of every major affiliate network.
What makes this case particularly striking is that the code enabling this behavior was reportedly added in December and sat live for months before the investigation surfaced it. Whether it was a deliberate scheme or a bug that got quietly exploited may never be fully resolved — but that distinction will matter enormously in how advertisers, networks, and regulators respond.
The instinct might be to treat this as an isolated scandal. It's an extreme version of a structural flaw that runs through the entire last-click model.
How last-click attribution gets gamed — a short taxonomy
To understand why Phia's situation landed so hard, it helps to map the full range of ways last-click attribution can be exploited.
The Honey problem: legitimate-ish, but still problematic
The earlier controversy around Honey — the PayPal-owned browser extension — illustrated a softer version of this issue. Honey would replace or overwrite influencer or affiliate referral codes at checkout, meaning a creator who genuinely drove a customer to a brand would lose their commission. No fake tabs, no stuffed cookies, but the attribution still got hijacked. The last click went to Honey. The original referrer got nothing.
This is the gray zone of affiliate marketing: technically within the letter of some network rules, but clearly not in the spirit of a system that's supposed to reward whoever actually influenced a purchase.
Cookie-stuffing: outright fraud
Phia's alleged tactic is a different category of problem entirely. Cookie-stuffing means planting a tracking cookie on a user's browser without any genuine interaction — no ad click, no coupon code, no recommendation followed. The extension simply fires in the background and positions itself as the last touchpoint. Because last-click attribution only looks at the most recent cookie, the stuffed one wins.
It's fraud. And the longer it goes undetected, the more affiliate budget flows toward partners who've earned nothing.
The base-rate problem: credit for sales that were happening anyway
Even setting cookie-stuffing aside entirely, there's a deeper issue. A significant portion of affiliate spend — particularly on cashback and loyalty sites — rides on purchases that would have happened regardless. A customer who has already decided to buy searches for a coupon code at checkout, lands on a cashback portal, and clicks through. The sale happens. The affiliate gets credit. But that credit is correlational, not causal. The customer wasn't influenced; they were intercepted.
This is the attribution problem that last-click attribution was never designed to solve, and it's why platform-reported affiliate metrics so often look much rosier than reality.
Why this is a measurement failure
The Phia story is generating headlines as a story about bad actors. But for advertisers, the more important story is what it reveals about incrementality vs. attribution as a measurement philosophy.
Attribution models — including last-click — answer the question: *which touchpoint came last?* They don't answer the question that actually matters for budget decisions: *did this touchpoint cause the purchase?*
When Phia's extension opened a hidden tab to drop a cookie, it didn't need to influence anyone. It just needed to be last. And last-click attribution handed it the credit automatically.
This is the structural vulnerability. Last-click attribution creates a system where whoever controls the final cookie controls the reported outcome — regardless of whether they contributed anything real.
The result is dashboards full of confident-looking numbers that don't reflect causal reality. Channels appear to perform well. Budgets stay committed. And the underlying inefficiency — or outright fraud — goes undetected for months.
What works: testing incrementality in affiliate channels
If last-click attribution can't tell you whether your affiliate spend is working, what can?
Incrementality testing is genuinely hard to design in affiliate channels. You can't randomize users into control and exposed groups the way you can with a paid social experiment — cashback sites and coupon portals don't offer that kind of targeting control.
But it is possible. A time-based on/off test — combined with geo-level controls — can get you to a credible answer.
We ran exactly this kind of test with a global DTC brand that was allocating a meaningful share of its marketing budget to cashback and rewards sites. In Google Analytics, affiliate appeared to be one of its top-performing channels. The team suspected the numbers were inflated and wanted to know the truth.
We worked with the brand to deactivate all affiliate loyalty partners in the US for seven weeks. Using a synthetic control model built on the brand's other seven markets — which remained active throughout — we compared revenue trends between the US treatment group and the comparable control regions.
The result: no change in revenue. Despite a meaningful drop in Google Analytics affiliate share during the shutoff, actual sales were unaffected. We also ran a product-level analysis — if affiliate were genuinely incremental, you'd expect products with higher pre-test affiliate share to be hit harder by the shutoff. They weren't. Products with high affiliate share and low affiliate share performed the same way.
The conclusion was clear: The affiliate loyalty program wasn't driving incremental revenue. It was claiming credit for purchases that were going to happen anyway.
After significantly reducing US affiliate investment, the brand saw no material decrease in revenue — and was able to redirect that budget toward channels that were actually moving the needle. You can read the full details in the affiliate on/off test case study.
What advertisers running affiliate programs should do now
The Phia situation is a useful prompt to audit your browser extensions and affiliate partners for terms-of-service violations. But don't let that be the end of the conversation.
Cookie-stuffing is the dramatic, headline-grabbing version of this problem. The quieter version — affiliate partners claiming credit for purchases that were already going to happen — is almost certainly costing you more over time. And it's invisible inside your current reporting.
A few practical steps:
- Audit your affiliate stack for compliance. Review which partners are active, what codes they're allowed to use, and whether any extensions in your ecosystem have unusual checkout behaviors. This is table stakes after Phia.
- Don't trust last-click affiliate reporting at face value. A strong last-click number is not evidence of incrementality. It's evidence that a touchpoint appeared at the end of a customer journey — nothing more.
- Design an on/off test. If you can't randomize users, a time-based test with a strong synthetic control is the next best option. It's entirely feasible — and the Haus platform is built to help you construct and analyze exactly these kinds of experiments.
- Run the product-level cross-check. As a secondary validation, compare performance for high-affiliate-share stock-keeping units (SKUs) versus low-affiliate-share SKUs during any shutoff period. If affiliate is truly incremental, the high-share products should feel the impact more. If they don't, you have your answer.
The bottom line
Last-click attribution isn't just gameable — it's been getting gamed for years. The Phia investigation is a reminder of how far that gaming can go when there are no causal guardrails in place. But the more pervasive problem isn't fraud. It's the everyday reality that attribution rewards whoever is last, not whoever is responsible.
Incrementality testing may not appear in a splashy headline. But it's the measurement approach that actually protects your budget — because it asks whether your spend caused a sale, not just whether it happened to be nearby when one occurred.
If you're running an affiliate program, that's the question worth answering. Get started with incrementality fundamentals or dig into getting started with incrementality testing to understand how to design a test that works for your channel mix.
Frequently asked questions
What is last-click attribution and why is it easy to game?
Last-click attribution assigns full conversion credit to whichever touchpoint appeared immediately before a purchase. Because the model only looks at the most recent cookie — not at what actually influenced the customer — any actor who can position themselves as the final touchpoint claims the credit, regardless of whether they contributed anything to the sale.
What is cookie-stuffing and is it legal?
Cookie-stuffing means planting a tracking cookie on a user's browser without any genuine user interaction — no ad click, no coupon code, no recommendation followed. The cookie fires in the background and positions the actor as the last touchpoint. Cookie-stuffing violates the terms of service of every major affiliate network and is considered outright fraud, not simply a gray-area tactic.
How is the Honey controversy different from what Phia allegedly did?
Honey replaced or overwrote existing affiliate and influencer referral codes at checkout, redirecting commission credit without involving fake tabs or stuffed cookies. That behavior sits in a gray zone — potentially within the letter of some network rules but not the spirit. Phia's alleged tactic went further: opening a hidden background tab during checkout with no user click in order to insert its own affiliate code, which is textbook cookie-stuffing and a clearer terms-of-service violation.
Can affiliate channels show strong attributed performance and still drive no incremental revenue?
Yes. This is the base-rate problem. When a customer has already decided to buy and simply searches for a coupon code at checkout, any cashback or loyalty site they click through receives last-click credit — even though the customer was intercepted, not influenced. Our on/off test with a global DTC brand demonstrated this directly: turning off all affiliate loyalty partners in the US for seven weeks produced no measurable drop in revenue, despite a significant fall in affiliate-attributed share in Google Analytics.
What is an on/off incrementality test and how does it work for affiliate channels?
An on/off test deactivates a channel or set of partners for a defined period and measures whether revenue changes as a result. Because affiliate channels don't allow user-level randomization the way paid social does, a time-based test combined with geo-level controls and a synthetic control model is used instead. In our case study, the brand's other seven markets — which stayed active throughout — served as the control group, allowing a clean comparison against the US treatment market.
What is the product-level cross-check and what does it reveal?
The product-level cross-check compares performance for SKUs with high pre-test affiliate share against SKUs with low pre-test affiliate share during a shutoff period. If affiliate spend is genuinely incremental, products that relied on it more should feel a greater revenue impact when it's turned off. In our case study, high-affiliate-share and low-affiliate-share products performed identically during the shutoff — confirming that the affiliate loyalty program was not driving incremental purchases.
What should advertisers do if they suspect their affiliate program is not driving incremental revenue?
Start with three concrete steps: audit your affiliate partner stack for compliance issues and unusual checkout behaviors; stop treating strong last-click numbers as evidence of incrementality; and design an on/off test — using a time-based structure with a synthetic control if user-level randomization isn't possible. The Haus platform is built to help you construct and analyze exactly these kinds of experiments.
Related reading
