Case patterns

What we find, and how it hides.

These are the patterns that come up again and again in affiliate investigations. Each one is composited and anonymised. Client engagements are confidential, but the techniques are not.

Pattern 01 · Retail / ecommerceCookie stuffing

The content partner nobody had ever visited

The situation

A mid-tier content partner climbs steadily into the top five by revenue. Conversion rate is excellent, return rate is normal, and the affiliate team is preparing to offer an improved commission tier.

What the investigation shows

Network captures across the partner’s domains reveal a 1×1 iframe, injected into pages on several unrelated high-traffic sites, that loads the affiliate tracking link on page view. No click, no content, no recommendation. The cookie simply waits in the browser for the customer to buy.

Why it was missed

The network records the cookie as a click. Every dashboard metric looks healthy because the partner is being credited for organic demand that already existed.

Pattern 02 · Subscription / SaaSClick hijacking

The browser extension that arrived two seconds before checkout

The situation

Commission paid to a shopping-assistant partner grows quickly after launch. The partner claims to help shoppers “find the best deal”, and the volume suggests users love it.

What the investigation shows

In a controlled browser with the extension installed, the add-on detects the checkout page, silently loads its affiliate link in the background and overwrites the existing affiliate cookie. The genuine referring partner, who did the real work, loses the commission.

Why it was missed

Nothing appears on screen. The hijack only shows up in network traffic, and only on machines with the extension installed.

Pattern 03 · Travel / hospitalityRetargeting leakage

The retargeting tag that claimed everyone

The situation

A “performance retargeting” partner is paid on a CPA basis through the affiliate network. Their reported sales are consistently strong, and they are one of the largest lines in the channel budget.

What the investigation shows

A tag audit shows the partner’s script, loaded through the tag manager, firing an affiliate tracking pixel on every visit to the product pages. That includes visitors from email, organic search and direct. Many of the “retargeted” sales were never served an ad at all.

Why it was missed

The tag was installed years earlier by a previous agency. No one owned it, and it never appeared in any report as a cookie source.

Pattern 04 · Financial services / lead genLead fraud · Brand bidding

The leads that were all the same person

The situation

A CPL programme sees one sub-network deliver a large volume of applications at a competitive cost per lead. Downstream conversion is weak, but it’s put down to “top-of-funnel” traffic.

What the investigation shows

Device and identity clustering links a large share of the leads to a small set of device fingerprints cycling through residential proxies. Separately, brand-term surveillance shows a sub-affiliate bidding on the brand name with ads shown only outside head-office locations.

Why it was missed

Lead quality issues were treated as a sales problem, and the brand team never saw the geo-cloaked ads from the office.

Recognise any of these?

Find out if it’s happening in your programme.

Every pattern above looks like strong performance until someone looks underneath it.

Request an audit → Estimate your leakage