Are you driving traffic, seeing clicks in your tracker, but commissions aren't growing or are attributed to other webmasters? This is not always a platform bug — often it is targeted conversion theft through cookie stuffing and tag substitution. We analyze how this works and provide 6 checks that will help catch the fraudster red-handed.
What is Conversion Theft: Tag Substitution and Cookie Stuffing
Conversion theft in affiliate marketing occurs when a real sale or lead that came through your link is credited to another webmaster. This usually happens in two ways: cookie stuffing and tag swapping (click ID replacement).
Cookie stuffing is the forced installation of an affiliate cookie in the user's browser without them clicking on a real link. The fraudster places an invisible pixel, iframe, or script on a third-party site that "drops" thousands of cookies from different programs simultaneously. When the user later makes a purchase, the system credits the conversion to the cookie that was "last" or "first" — depending on the attribution model, rather than to the one who actually brought the customer.
Tag substitution works differently: the fraudster or dishonest sub-affiliate intercepts the click ID, SubID, or UTM parameters in the link and replaces them with their own before the traffic goes to the advertiser's landing page. As a result, the offer receives foreign traffic, and the commission goes to the one who substituted the tag, even though the actual work of attracting the click was done by someone else.
Both schemes hit the income of honest arbitrageurs and the reputation of affiliate networks: the advertiser sees inflated statistics, the budget is spent inefficiently, and conscientious webmasters lose earnings. For affiliate programs, this also means distorted ROI analytics and incorrect budget allocation among channels.
How Cookie Stuffing Steals Your Commissions
The mechanics of cookie stuffing are based on the fact that most affiliate systems use cookie-based attribution with a window of 24 hours to 90 days. The fraudster does not need the user to click on your link — it is enough for their browser to "catch" a cookie anywhere: on a forum, in a browser extension, on a site with pirated content, or in an ad banner with a hidden 1x1 pixel iframe.
Then simple statistics come into play: if the cookie stuffer has dropped a million cookies in a day, some users will still buy a product on the advertiser's site in the coming weeks — simply because they needed it. The attribution system will see the stuffer's cookie and credit the conversion to them, even though they had no real influence on the purchasing decision.
There are several typical scenarios that occur in CPA and affiliate networks:
- Browser extensions that massively replace existing affiliate cookies with their own when visiting stores — a well-known scheme in cashback services and "shopping assistants";
- Hidden pixels on traffic sites (forums, torrents, streaming) that load dozens of affiliate links in the background without user involvement;
- Malware and adware that embed cookie stuffing code directly into the user's system via malicious installers;
- Overlay iframes on seemingly legitimate sites that trigger upon simply opening the page.
For an arbitrageur who is honestly driving traffic through Facebook Ads or TikTok Ads, cookie stuffing is a direct blow to ROI: the offer shows low EPC, even though the quality of your traffic is actually high, simply because commissions are going to third parties.
Tag Substitution: Click ID, SubID, and UTM at Risk
If cookie stuffing is a mass attack, tag substitution is often more targeted and aimed at a specific affiliate chain. The most common objects of substitution are:
- Click ID — a unique identifier of a click that the tracker sends to the offer for subsequent postback (S2S). Substituting the Click ID results in the conversion being credited to the wrong click that did not actually bring the user;
- SubID — a parameter that arbitrageurs use to break down traffic by sources, creatives, and geo. Substituting the SubID distorts analytics and can redirect the commission to another account in the affiliate program;
- UTM tags — used for attribution in Google Analytics and advertising dashboards. Substituting UTM at the redirect level is found among dishonest intermediaries through which traffic passes (for example, some tracker-proxies or CDN services with open redirects).
Technically, tag substitution is implemented through an intermediate redirect server that modifies the query parameters of the link before the final redirect to the advertiser's landing page. If you work through a chain of several intermediaries (for example, sub-affiliate → tracker → offer), each link in this chain is a potential substitution point.
A separate category of risk is working through shared proxies or cheap datacenter IPs without quality control, which are sometimes used by intermediaries to "run" traffic through their servers with modification of headers and request parameters on the fly.
6 Checks to Identify Conversion Theft
To avoid guessing and accurately determine if your conversions are being stolen, go through these six checks. Each takes from 15 minutes to a couple of hours, but together they provide a complete picture.
Check 1: Time Gap Between Click and Conversion
Open the report on clicks and conversions in your tracker (Keitaro, Binom, RedTrack) and look at the time spread between the click and the credited conversion. If a significant portion of conversions has an anomalously short gap (seconds) or an anomalously long gap with a short cookie window, this is a signal of cookie stuffing — the cookie was dropped in advance, not through a real user click.
Check 2: Referrer and Traffic Source Verification
Check the HTTP referrer of the conversions. If the conversion came from "your" click, but the referrer points to an unfamiliar domain, forum, or browser extension — then the cookie was dropped not on your landing page. A legitimate click should have a referrer corresponding to the platform where you actually placed the ad (Facebook, TikTok, Instagram).
Check 3: Multiple Cookie Records for One User
Cookie stuffing often leaves a digital trace — the same user (by device ID or fingerprint) has multiple active affiliate cookies from different webmasters simultaneously. Request a report from the advertiser or affiliate network on multiple attributes for one device ID over a short period — this is a direct indicator of mass cookie stuffing.
Check 4: Mismatch Between User-Agent and Fingerprint
Compare the User-Agent and fingerprint parameters (screen resolution, time zone, browser language) of the click and the final conversion. If the click was made from a mobile device through TikTok Ads, but the conversion was recorded with a desktop User-Agent and a different time zone — this is a sign of tag substitution through an intermediate server that modifies request parameters.
Check 5: Geographic Discrepancy in IP
Compare the geo IP addresses of the click and the conversion. If your campaign is strictly set for one region (for example, traffic from Germany in Facebook Ads), and conversions come from IPs of other countries without VPN or mobile roaming from real users — tag substitution through third-party servers is likely. For a control check, it is useful to run test clicks through residential proxies from the desired region and compare how the system processes geo-data in both directions of the chain.
Check 6: Postback/S2S Verification with an Independent Tracker
The most reliable check is parallel tracking. Set up an independent server-to-server postback (S2S) through your own tracker instead of relying solely on the reports from the affiliate network. Compare the number and IDs of conversions that your tracker sees with what the affiliate panel shows. A difference in Click ID or the number of conversions is direct evidence that tags are being substituted somewhere in the chain.
| Check | What It Reveals | Time for Check |
|---|---|---|
| Time Gap Click-Conversion | Cookie Stuffing | 15-30 minutes |
| Referrer Verification | Cookie Stuffing, Foreign Platforms | 20 minutes |
| Multiple Cookies on Device ID | Mass Cookie Stuffing | 1-2 hours |
| User-Agent / Fingerprint | Tag Substitution in the Chain | 30-40 minutes |
| Geo Discrepancy in IP | Traffic and Source Substitution | 30 minutes |
| Postback/S2S Verification | Substitution of Click ID at Any Stage | Continuous Monitoring |
Tools for Traffic Auditing and Protection
For systematic auditing of affiliate traffic, arbitrageurs and affiliate program owners use a combination of a tracker, anti-fraud service, and tools for test traffic runs:
- Trackers with S2S Postback — Keitaro, Binom, RedTrack provide independent recording of clicks and conversions that can be compared with the affiliate network's data;
- Anti-detect Browsers — Dolphin Anty, AdsPower, Multilogin, GoLogin are convenient not only for farming ad accounts but also for simulating real user sessions during test runs of funnels with different fingerprint profiles;
- Anti-fraud Platforms — specialized services that analyze click patterns and identify anomalies in traffic sources;
- Proxies for Test Runs — to check how the redirect chain processes geo and IP at different stages, it is useful to run test traffic through IPs from various regions and subnets, without tying to one static address.
For testing the redirect chain for tag substitution, it is convenient to use mobile proxies — they closely mimic the behavior of a real user from a mobile device, which is especially important when checking offers aimed at traffic from TikTok Ads or mobile applications.
Checklist for Protecting Affiliate Conversions
If the checks above confirmed the problem, here are specific steps to protect your commissions and data:
- Switch to last click with a short cookie window where possible — this reduces the effectiveness of cookie stuffing;
- Set up your own S2S postback alongside the affiliate data and reconcile them weekly;
- Use unique, hard-to-predict SubIDs with hashing instead of simple incremental identifiers — this complicates manual tag substitution;
- Request a report from the affiliate network on IP and device ID of conversions if you notice anomalies in checks 3 and 5;
- Avoid working through intermediaries and sub-affiliates without transparent reporting on redirects;
- Regularly test your funnel from clean profiles through an anti-detect browser and proxies to see the redirect chain through the eyes of a real user;
- Document all discrepancies found with timestamps and Click IDs — this will be useful in disputes with the advertiser or affiliate network.
The Role of Proxies in Affiliate Traffic Auditing
Proxies in this story are not a tool for attack, but a tool for diagnostics. To check how your affiliate link is processed at different stages of the redirect chain, you need to emulate real users from different regions and subnets, without tying to your office or home IP, which may be whitelisted by the advertiser and give a distorted picture.
For precise verification of geo-attribution and referrer checks, residential proxies are best suited — they have IPs of real home users and do not raise suspicions with the advertiser's anti-fraud systems, allowing you to see an honest picture of click processing without distortions related to blocking datacenter IPs.
If the task is mass monitoring of a large number of offers and links simultaneously, where speed and volume of requests are more important than perfect anonymity, it is wiser to use datacenter proxies — they are faster and cheaper per IP, which is convenient for regular automated scanning of dozens of affiliate chains for tag substitution.
A combination of different types of proxies for different auditing tasks — datacenter for scale, residential and mobile for accuracy — provides the most complete picture of what happens to your traffic from click to credited conversion.
Conclusion
Cookie stuffing and tag substitution are not a theoretical threat, but a daily reality of affiliate marketing that directly eats into your commissions and distorts advertisers' analytics. Regularly reconciling clicks with conversions through an independent S2S postback, monitoring referrer and geo-attribution, as well as periodic test runs of the funnel through clean profiles help identify conversion theft at an early stage.
If you plan to regularly audit affiliate chains and check the correctness of geo-attribution from different points, we recommend trying residential proxies for precise checks and mobile IPs for simulating traffic from mobile devices — this will give an honest picture of what happens to your conversions at each stage of the affiliate chain.