Click Fraud and Cookie Stuffing in Affiliate and Influencer Tracking: How to Spot and Prevent It

What is click fraud and cookie stuffing?

Click fraud is the umbrella term for deliberately manipulating the click- or cookie-based tracking system that affiliate and influencer tracking runs on, so that someone gets credit for a sale they didn't actually generate. Cookie stuffing is the most common and most-prosecuted technique within click fraud: a tracking cookie gets placed in a user's browser without the user ever clicking a genuine affiliate link. That's a fundamentally different situation from attribution stacking, where two real, valid signals both genuinely touch the same order — with cookie stuffing, there was never a real click to compete against in the first place.

How cookie stuffing actually works, technically

A genuine affiliate click happens when a user deliberately clicks a link, and the link sets a tracking cookie in the browser before the user lands on the merchant's site. Cookie stuffing bypasses that deliberate click entirely. The most documented techniques are: hidden iframes that embed the merchant's tracking pixel on an entirely unrelated page without the user seeing anything; automatic redirects (via HTTP status codes or JavaScript) that briefly bounce the browser through a tracking page before it lands where it was actually headed; and malicious or hijacked browser extensions that set a tracking cookie or redirect the browser themselves, without the user's knowledge. What all three methods share: the cookie gets set without the user ever taking a deliberate action — the user often has no idea an affiliate relationship is even involved in a purchase they'd already decided to make on their own.

A real case: eBay's two top affiliates were convicted for it

Cookie stuffing isn't a theoretical risk. Starting in June 2006, the FBI and eBay ran a joint investigation codenamed "Trip Wire" targeting eBay's two largest affiliate partners. According to press releases from the U.S. Attorney's Office for the Northern District of California, Shawn Hogan pleaded guilty to wire fraud in December 2012 and was sentenced in May 2014 to five months in federal prison and a $25,000 fine; his tool, "Geo Visitors," had, per the case record, planted roughly 650,000 unauthorized eBay cookies. Brian Dunning pleaded guilty to wire fraud on April 15, 2013, and was sentenced to 15 months in prison; per his own plea agreement, his company, Kessler's Flying Circus, received approximately $5.2 million in commissions from eBay's domestic Affiliate Program between May 2006 and June 2007 through a similar tool, "WhoLinked." Combined, the two men are reported to have earned around $35 million through schemes eBay and the FBI determined were fraudulent. A separate, smaller case out of the Southern District of Alabama shows the same pattern at a smaller scale: per a press release from that U.S. Attorney's Office (USAO-SDAL), a man from Oregon pleaded guilty to conspiracy to commit wire fraud after using so-called "forced clicks" that set cookies on unsuspecting shoppers' browsers without their knowledge, crediting him and his co-conspirators for sales they hadn't actually generated.

The point of both cases isn't that click fraud is a US-only or eBay-only phenomenon — it's that it's documented, prosecuted, and technically well-established, not a speculative risk.

What the major networks say they do about it

The largest affiliate networks publicly describe their own anti-fraud efforts — and take genuinely different approaches.

Neither network describes cookie stuffing or click fraud as a solved problem — both frame it as an ongoing effort. If you run a third network or a Shopify app, check that platform's own documentation for what it actually does about it rather than assuming it covers the same ground.

Red flags to watch for without an open network

If you work directly with creators in a curated deal, with no network's automatic fraud detection in between, spotting it is on you. This is Make Influence's own operational experience, not a documented checklist — but these patterns are worth reacting to:

• Unusually short time from click to purchase, repeated across several orders from the same creator
• Orders with no matching engagement on the creator's own channel — no comments, no shares, nothing suggesting a real audience behind the click
• A geographic mismatch between the order's IP location and the creator's known following
• A sudden burst of conversions right after a new "creator" with a very small or non-existent visible following is added to the program

Decision framework

• IF you run an open affiliate network → review the network's own fraud-detection documentation before going live, and ask for access to compliance reporting on your own program — see how to set up an affiliate program for the rest of what to check during setup.
• IF you work directly/curated with no network → build at least one of the red flags above into a manual spot-check, e.g. monthly.
• IF you spot a pattern that resembles cookie stuffing → pause payout of that specific commission and ask for documentation of the traffic that supposedly generated the sale before you pay it out. See also how commission clawbacks already describes how to handle a commission that turns out not to be real.
• IF you're unsure whether a signal is a genuine conflict or outright fraud → a genuine, competing signal (as in attribution stacking) always comes from another traceable click or code; cookie stuffing typically has no traceable, genuine click to point to at all.

Worked example (hypothetical)

The numbers below are hypothetical and for illustration only. This is not a real Make Influence customer case, and none of the figures are benchmarks.

A brand runs an affiliate program with an average order value of DKK 600 and an agreed 15% commission = DKK 90 per order. Assume an undetected cookie-stuffing operation manages to push 40 fraudulent orders through over one quarter before it's caught.

The amount itself is often small in any single quarter — the point is that an undetected scheme can keep running quarter after quarter, and the real damage also lands on the genuine creators whose clicks actually deserved the credit.

Make Influence's operational perspective

Make Influence's model is curated: you know every creator in the program, and unknown third parties aren't automatically let in the way an open network allows. That reduces exposure substantially, but it doesn't remove it — particularly if part of your tracking still runs through an open network as one component of a broader setup. Our recommendation follows the same discipline as the rest of the Academy's tracking articles: write down how a suspicious commission gets handled before you need the rule, not after.

FAQ

Is cookie stuffing illegal?

In the US, it has been prosecuted as wire fraud under 18 U.S.C. § 1343, which carries a statutory maximum of up to 20 years in prison — the actual sentences in the cases above were far shorter. Outside the US, publicly documented prosecution of cookie stuffing specifically is rarer; seek your own legal advice if you suspect fraud in your own program.

What's the difference between click fraud and cookie stuffing?

Click fraud is the umbrella term for deliberately manipulating click- or cookie-based tracking. Cookie stuffing is the specific, most common technique within click fraud in an affiliate context: setting the cookie with no genuine click at all.

Can click fraud happen in a curated deal with no open network?

Yes, in theory — but the risk is substantially lower, because you know every creator in the program and aren't automatically letting unknown third parties into it the way an open network does.

Is this the same thing as attribution stacking?

No. Attribution stacking is a conflict between two genuine, valid signals from two different creators. Cookie stuffing has no genuine signal to begin with — the cookie is set with no real click behind it.

Does Awin's and impact.com's fraud detection also cover influencer-specific programs?

Yes, per their own pages, their general compliance and traffic tools cover their entire partner/publisher base, which influencer-based programs typically run through — but neither publishes separate figures for influencer-specific fraud alone.

What should I do if I suspect a creator of cookie stuffing?

Pause payout of that specific commission, document the pattern (timestamps, IP data, engagement data), and contact the network or platform if you use one — they typically have a formal process to investigate and, if warranted, decline a suspicious commission before it's paid out.