Cookie stuffing

Cookie stuffing is a type of affiliate fraud in which a fraudster quietly drops an affiliate program’s tracking cookie into a user’s browser even though the user never clicked a referral link. When that person later buys on their own, the commission goes to the affiliate who stuffed the cookie.

What is cookie stuffing?

In affiliate marketing, the cookie is the proof of which referrer sent the buyer. A user clicks a link, the browser stores a cookie with the affiliate ID, and any order within the cookie window is credited to that ID. Cookie stuffing skips the click.

The Media Rating Council (MRC) lists cookie stuffing as sophisticated invalid traffic (SIVT): inserting, deleting or misattributing cookies to manipulate or falsify a user’s prior activity (MRC, IVT Standards Addendum, June 2020). See also invalid traffic (IVT) and the overview page on ad fraud.

How cookie stuffing works

Many affiliate programs credit the last click. Amazon Associates pays only when a customer clicks your link, and the attribution session ends after 24 hours or when the customer clicks another affiliate’s link (Amazon Associates Program Policies, April 2026). Whoever drops the last cookie wins. Fraudsters exploit that with:

• Hidden frames or images: a page embeds the affiliate link in an invisible element, so the browser loads the link and stores the cookie.
• Pop-unders and redirects: the merchant’s site opens in a window behind the current one, or the user is routed through the affiliate link on the way somewhere else.
• Browser extensions: an extension inserts or swaps affiliate codes on shopping sites.

A widely cited case involved eBay. A large eBay affiliate built free web applications that caused visitors’ browsers to receive a cookie carrying his company’s affiliate ID, even though they never clicked an eBay link. The company received about $5.2 million in commissions, of which $200,000 to $400,000 was found to be fraudulent. He pleaded guilty to wire fraud and was sentenced to 15 months in prison (U.S. Department of Justice, August 2014).

On March 11, 2025, the Chrome Web Store tightened its rules: an extension may add affiliate codes or cookies only when the user gets a clear benefit, such as a discount or cashback, and only after a related user action each time. Quietly replacing an affiliate code already in the URL is a violation (Chrome Web Store, Affiliate Ads, March 2025).

Warning signs

• An affiliate shows an unusually high conversion rate, or far more clicks than real visitors.
• Clicks arrive with no clear referrer, and the gap between click and purchase stretches over many days.
• Analytics shows customers arriving direct or from your own ads, yet the order is credited to an affiliate.

The pattern resembles click flooding in mobile apps: spray clicks, then wait for organic orders to land.

How merchants can protect themselves

1. Spell out in your affiliate terms that hidden frames, pop-unders, automatic redirects and code-injecting extensions are banned. Amazon also refuses to pay on redirecting links that require no click from the customer.
2. Reconcile affiliate orders against analytics before approving commissions.
3. Consider a shorter cookie window: the longer it is, the more time a stuffed cookie has to wait for an order.
4. Open a suspect affiliate’s page in a private window, click nothing, then check your browser’s developer tools to see whether your cookie was set.

Hypothetical example

A cosmetics shop pays a 10% commission on an average order of VND 400,000, or VND 40,000 per order. Affiliate X is credited with 1,500 orders, worth VND 60 million in commissions. Analytics shows 900 of those orders came from customers who typed the address or clicked the shop’s own ads, but whose browsers already held X’s cookie. Without filtering, the shop pays VND 36 million for orders that would have happened anyway.

Cookie stuffing vs. a similar scheme

Frequently asked questions

Is cookie stuffing illegal?

In the U.S., the eBay case was prosecuted as a crime. At the very least, affiliates lose their commissions and get their accounts closed for breaking program terms.

Can apps be hit by cookie stuffing?

Apps don’t credit installs or orders with browser cookies. The app equivalent is sending fake clicks to the measurement platform.

If you want to review how affiliate orders are attributed and how commissions are reconciled, take a look at Adtek’s Brand Commerce page.