Cookie stuffing (also called cookie dropping) is affiliate fraud in which a tracking cookie is placed in a user's browser without the user knowingly clicking an affiliate link. If that user later buys from the brand on their own, the fraudster is credited with the sale and paid commission for a customer they never referred.
How it works
The fraudster loads the affiliate tracking URL in the background, so the redirect sets the cookie while the user sees something else. Common techniques include:
- hidden 1×1 iframes or images whose source is a tracking link;
- pop-unders and forced redirects;
- browser extensions that open tracking URLs when the user visits a shop;
- scripts planted on unrelated, high-traffic pages.
Because many programs use last-click attribution with a long cookie duration, a stuffed cookie can also overwrite the cookie of an affiliate who genuinely referred the customer.
Cookie stuffing can be prosecuted. In 2014, eBay's top-earning affiliate was sentenced to five months in federal prison for wire fraud tied to a cookie-stuffing scheme, as reported by MarTech.
Example
Example: a hidden iframe on a site with 100,000 daily visitors drops a retailer's 30-day cookie on every visitor. If 1% of them later buy from the retailer on their own, each day of traffic credits the fraudster with about 1,000 sales, without a single real referral.
How to detect and prevent it
- Compare clicks with engagement: stuffed clicks have empty or irrelevant referrers and no landing-page activity.
- Flag affiliates with high click volume, very low conversion rate and long click-to-sale gaps.
- Check where clicks come from (referrer, IP reputation, device fingerprint) and audit the affiliate's pages.
- Ban the practice explicitly in the affiliate agreement and reverse commissions when it is proven.
More techniques are covered in affiliate fraud detection.
Related: click fraud, last-click attribution, cookie duration, commission reversal.