Cookie Stuffing Explained: Affiliate Fraud, Attribution & What Creators and Brands Need to Know
Affiliate marketing is built around a deceptively simple idea:
You help make the sale. You get a share of the sale.
A creator shares a product they genuinely love. Someone clicks their link, makes a purchase, and the creator earns a commission. The brand gains a customer, the creator earns money, and everyone understands why the transaction happened.
Someone creates the connection between a person and a product — and affiliate tracking gives that person credit.
At least, that's how it's supposed to work.
But what happens when someone gets credit for a sale they didn't actually generate?
Or when the person who did introduce the customer gets quietly pushed out of the transaction at the very last moment?
That's where things get complicated.
First, let's make affiliate tracking less mysterious
If you've ever looked at a link containing a string of random letters and numbers and thought “What exactly is happening here?”—you're not alone.
An affiliate link is essentially a trackable referral.
Let's say a creator named Maya partners with a sustainable clothing brand.
She shares: “I've been wearing this linen set all summer. Shop it here.”
Her link contains information that tells the brand—or the affiliate network managing the program—that the visitor came from Maya.
The shopper clicks.
Depending on the program's technology, a tracking cookie or another form of tracking identifier may be stored or associated with that shopper's browser.
The shopper buys.
The system connects the purchase to Maya.
Maya earns a commission.
That's the intended exchange.
Maya created the referral. The brand got the customer. Maya gets rewarded.
Simple enough — until someone starts manipulating the tracking.
So, what is cookie stuffing?
Cookie stuffing is the practice of placing an affiliate tracking cookie on a user's browser without a legitimate qualifying referral or interaction, with the goal of receiving credit for a purchase the affiliate did not actually generate.
TLDR: Someone puts their name on the sale even though they didn't make the introduction.
Think about a real-world referral.
You tell your friend: “You have to try this restaurant.”
Your friend goes.
The restaurant owner gives you a free entrée because you sent them the customer.
Now imagine someone standing outside the restaurant putting a sticker on every person's jacket that says: “I referred this person.”
They didn't. But when the customer walks inside, the restaurant sees the sticker and pays that person instead.
That's essentially the problem cookie stuffing creates. The technology is different. The principle isn't.
Cookie Stuffing vs. Affiliate Hijacking vs. Last-Click Attribution
This is where affiliate conversations can get muddied.
These terms describe different things, even though they can sometimes produce a similar outcome: the wrong affiliate gets paid.
Cookie stuffing
An affiliate tracking cookie is placed or triggered without a legitimate referral.
The problem: the affiliate creates attribution where there wasn't a legitimate referral.
Affiliate hijacking
An affiliate or technology provider intercepts, overwrites, or replaces another affiliate's tracking information and claims the commission.
The problem: someone else may have actually generated the referral, but another party takes the credit.
Last-click attribution
The affiliate program gives credit to the last qualifying affiliate interaction before the purchase.
The problem: last click is not inherently fraudulent, but it can produce questionable outcomes when the final interaction adds little or no incremental value.
A shopper may genuinely discover a product through a creator and then intentionally click a coupon site or cashback service before purchasing. If the program says the last qualifying interaction receives the commission, that affiliate may legitimately receive it.
The bigger industry question is whether that final interaction created value or simply captured attribution that was already in motion.
Cookie Stuffing Examples: eBay, Honey & Phia
Recent allegations involving Phia, the shopping platform co-founded by Phoebe Gates and Sophia Kianni, have put cookie stuffing back in the spotlight. But Phia isn't an isolated story. From the eBay affiliate fraud cases of the 2000s to the much more recent controversy surrounding PayPal's Honey browser extension, the affiliate industry has been wrestling with the same fundamental question for years: Who actually deserves credit for a sale?
The Phia Controversy: when affiliate attribution becomes the product
In 2026, affiliate attribution became a major topic of conversation after reporting raised allegations about Phia, the AI-powered shopping platform co-founded by Phoebe Gates and Sophia Kianni.
According to reporting from Bloomberg and subsequent coverage, Phia was accused of using technology that could override existing affiliate tracking and attribute purchases to Phia, even when another affiliate had originally referred the shopper. Phia subsequently said it disabled the features in question and began reviewing and reversing transactions it determined had been inaccurately attributed.
The allegations are particularly significant because Phia operates at the intersection of affiliate marketing, shopping technology, and automated purchasing behavior.
And the controversy illustrates an important point:
Cookie stuffing doesn't have to look like an old-school scam.
Affiliate fraud can happen through increasingly sophisticated technologies like browser extensions, apps, shopping tools, redirects, scripts, and automated experiences.
The underlying question remains the same: Did this affiliate actually earn the referral?
It's also important to distinguish the Phia allegations from a settled legal finding. The reporting and allegations are still part of an evolving situation, and Phia has disputed aspects of the reporting. So the lesson for the affiliate industry isn't “Phia is guilty” but rather:
Affiliate technology needs to be transparent enough that brands, creators, and consumers can understand where a conversion actually came from.
But haven't we seen this before?
Yes. Cookie stuffing isn't new.
The eBay example
One of the most well-known examples dates back to the mid-2000s.
Affiliate marketers Shawn Hogan and Brian Dunning were involved in schemes that used cookie stuffing to generate affiliate commissions from eBay.
In Dunning's case, he admitted to a scheme that generated approximately $5.2 million in eBay affiliate commissions, with prosecutors determining that a portion of those commissions resulted from the fraudulent cookie-stuffing activity. He ultimately pleaded guilty to wire fraud and was sentenced to 15 months in prison.
The mechanics were different from today's shopping apps and browser extensions, but the fundamental problem was exactly the same in that the tracking system was manipulated to credit an affiliate for activity the affiliate didn't legitimately generate.
And then there's Honey
More recently, the debate shifted toward browser extensions.
In late 2024, creator and YouTuber MegaLag published an investigation alleging that PayPal-owned Honey could replace or overwrite affiliate tracking associated with creators' links when users interacted with Honey during the purchasing process.
That triggered significant controversy and multiple lawsuits from creators and other plaintiffs who argued that Honey was taking commissions away from affiliates who had actually driven the sales.
Honey and PayPal have disputed the allegations and argued that their practices comply with industry norms, including last-click attribution. Some related lawsuits have also been dismissed, meaning the allegations should not be treated as established legal facts.
But the controversy exposed an important weakness in traditional affiliate attribution. “Last click” doesn't necessarily mean “most valuable influence.”
Imagine this:
Creator posts → consumer clicks creator's affiliate link → consumer researches product → consumer returns later → coupon extension activates → extension gets last click → extension gets commission.
Under an affiliate program with simplistic last-click model, the extension may win.
But the creator was who actually introduced the customer to the product.
This is why cookie stuffing and affiliate hijacking deserve slightly different terminology even though they can create a similar outcome.
Cookie stuffing generally refers to illegitimately placing or manipulating tracking cookies to claim referrals.
Affiliate hijacking can involve overwriting or intercepting an existing affiliate referral and taking the commission.
For creators, both can be a frustration aspect of affiliate marketing. Even though the creator provided quality promotion and marketing for a product, someone else got paid.
Why cookie stuffing is bad for everyone
For creators
Affiliate income is often treated as “passive income,” but there is nothing passive about building the trust that generates a purchase.
Creators spend time:
discovering products
testing products
creating content
educating their audience
building trust
answering questions
recommending alternatives
driving traffic
If another affiliate can swoop in at the end of the customer journey and claim the commission, creators have less incentive to invest in affiliate content.
That ultimately weakens the entire creator economy.
For brands
Brands aren't simply losing the commission itself.
They're potentially paying for false attribution.
If a brand believes Affiliate A generated $100,000 in revenue, it may increase that affiliate's commission, renew their contract, or allocate more budget toward that channel.
If the attribution is manipulated, the brand's marketing decisions are being made using bad data.
And bad attribution can become very expensive.
For consumers
Consumers may not see the affiliate mechanics happening behind the scenes, but they are still part of the ecosystem.
Affiliate marketing works best when consumers understand that recommendations may generate commissions.
The FTC recommends that affiliate relationships be disclosed clearly and conspicuously so consumers understand the financial connection behind a recommendation.
How Creators Can Avoid Affiliate Marketing Fraud
The good news? Most creators don't need to worry about accidentally becoming a cookie stuffer.
If you're creating genuine content and using affiliate links normally, you're already operating within the basic structure of affiliate marketing.
Still, a few best practices can protect both your audience and your commissions.
1. Only use affiliate links where you've actually earned the referral
Your affiliate link should correspond to a genuine recommendation, resource, or piece of content.
Don't use scripts, redirects, hidden links, forced clicks, or other technology designed to place tracking cookies without meaningful user interaction.
A good rule of thumb: If you wouldn't feel comfortable explaining exactly how the click happened to the brand's affiliate manager, don't do it.
2. Don't hide affiliate links behind deceptive buttons or redirects
Your audience should understand what they're clicking.
Avoid techniques that automatically redirect someone through an affiliate link when they haven't intentionally clicked or requested a product recommendation.
3. Disclose your affiliate relationship
The FTC specifically recommends that affiliate relationships be disclosed clearly and conspicuously.
“Affiliate link” alone may not be enough because consumers may not understand what that means. The FTC suggests straightforward language such as:
“I may earn a commission if you purchase through links in this post.”
The disclosure should be close enough to the recommendation and link that consumers can easily connect the two.
4. Follow your network's rules—not just your own interpretation
Every affiliate network and brand program can have its own rules around:
paid search
coupon codes
trademark bidding
browser extensions
incentivized traffic
link cloaking
redirects
email
loyalty programs
sub-affiliate networks
promotional methods
Read the terms.
“Everyone else does it” is not an affiliate compliance strategy.
5. Keep records
Creators should keep basic records of:
which networks they're part of
which brands they've been approved for
affiliate links they've created
content where links appear
disclosures
major changes to their affiliate setup
This becomes especially useful if a brand questions a conversion or a network flags your account.
How Brands Can Detect Cookie Stuffing & Affiliate Fraud
Brands have a bigger challenge because affiliate fraud can hide inside otherwise impressive performance reports.
A huge sales number doesn't automatically mean something is wrong. But unusual attribution patterns deserve investigation.
Here are some things to watch.
1. An affiliate suddenly becomes your top performer
Especially if their traffic, content, audience, or promotional activity hasn't changed.
Ask: What actually changed?
If revenue skyrocketed without a corresponding increase in legitimate traffic or promotional activity — investigate.
2. Massive conversions with very little visible traffic
A healthy affiliate relationship should generally have some logical relationship between:
exposure → click → conversion
If an affiliate produces enormous revenue but you can't understand where the customers came from, that's a reason to dig deeper.
3. Extremely high conversion rates
An affiliate with a conversion rate dramatically above your program average isn't automatically fraudulent. They may genuinely have an exceptionally qualified audience.
But unusually high conversion rates combined with unexplained traffic patterns, low engagement, or other anomalies can warrant an audit.
4. Affiliate cookies appearing without meaningful clicks
This is one of the biggest technical warning signs. Brands and affiliate networks can monitor whether affiliate cookies are being placed following genuine user interactions or appearing through unexpected mechanisms.
If an affiliate appears to receive credit when users never meaningfully interacted with the affiliate's content, investigate.
5. Conversions happening immediately after another affiliate's click
If Affiliate A consistently appears to lose conversions to Affiliate B moments before purchase, that's worth investigating.
Particularly if Affiliate B is a:
coupon site
browser extension
cashback platform
toolbar
shopping app
loyalty platform
sub-affiliate network
The issue isn't that these business models are inherently bad. It's whether they're adding value or simply intercepting attribution.
6. Unexpected changes in other affiliates' performance
Sometimes the strongest signal isn't the suspicious affiliate. It's everyone else.
If several legitimate creators suddenly see their commissions decline while one technology partner's revenue increases, look at the attribution chain.
7. An affiliate can't clearly explain its traffic source
Brands should be able to ask: “How are you driving this traffic?” And receive a specific answer.
If the response is vague—particularly around technology, browser extensions, redirects, or sub-affiliate relationships—ask more questions.
Brands: build your affiliate program so fraud is harder
You don't need to wait for a scandal to start monitoring attribution.
A healthy affiliate program should include:
Clear program terms
Define prohibited practices explicitly, including cookie stuffing, forced clicks, unauthorized redirects, brand bidding, misleading promotions, and other forms of attribution manipulation.
Regular affiliate audits
Don't only review affiliates when something looks wrong.
Periodically review your highest-volume partners, traffic sources, conversion rates, promotional methods, and attribution behavior.
Network transparency
Understand what your affiliate network can—and cannot—see.
Your network is part of your measurement infrastructure. Don't treat its reporting as a black box.
Sub-affiliate visibility
If an affiliate is using another network, technology provider, or sub-affiliate underneath them, understand who is actually interacting with the customer.
Attribution analysis beyond last click
Last-click attribution is easy to understand, but it doesn't necessarily tell the whole story.
Look at the customer journey. Who introduced the customer? Who assisted the customer? Who closed the transaction? And who simply happened to be there at the end?
What happens when things go wrong?
For affiliates, consequences can range from:
commission reversals
withheld earnings
removal from a program
account termination
network bans
reputational damage
civil claims
and, in serious cases, criminal liability
The eBay case is a useful reminder that intentionally manipulating affiliate attribution can go far beyond breaking a program's terms.
For brands, falling victim can mean:
paying commissions for customers you didn't actually acquire through that affiliate
underpaying legitimate creators
making poor budget decisions
misreading channel performance
damaging creator relationships
and losing trust in your own affiliate data
But there's another consequence that doesn't show up neatly in a dashboard:
Everyone becomes a little less willing to trust the system.
The bigger problem isn't the cookie. It's the incentive.
Affiliate marketing has always had an attribution problem. The industry has historically needed a relatively simple answer to a very complicated question: Who gets credit for this purchase?
Last click has been the historical standard attribution. But today's customer journeys are messier.
A person might discover a product through a creator, research it through Google, watch three TikToks, read Reddit reviews, click a newsletter, activate a browser extension, use a coupon, and finally purchase through a retailer's app.
Which interaction deserves the commission?
There isn't always an obvious answer. And technology is increasingly capable of inserting itself into that journey. That's why cookie stuffing matters. Because the technology determining attribution can also determine who gets paid. And whenever the ability to measure value becomes the ability to manufacture value, incentives get complicated.
The Faire Onda rule of affiliate marketing
At its best, affiliate marketing is beautifully simple:
You create value → someone takes action → you get rewarded for the value you created.
That's the model worth building.
Not: You find a way to get the cookie → you claim the sale → everyone else loses.
For creators, that means building affiliate revenue around genuine recommendations, transparent disclosures, and clean tracking practices.
For brands, it means treating affiliate attribution as something that needs to be managed—not merely measured.
And for both sides, it means remembering that the goal isn't to win the attribution game. It's to make sure the right person gets credit for creating the value. Because a healthy affiliate ecosystem shouldn't reward whoever manages to get the last cookie. It should reward whoever actually helped make the sale.