Also known as:Cookie Dropping, Cookie Bombing, Forced Cookies
What is Cookie Stuffing?
Cookie stuffing is a fraudulent affiliate technique that secretly plants a broker's tracking cookie in a visitor's browser without any genuine click on the affiliate's link — so if that person ever opens an account, the fraudster wrongfully claims the referral commission.
Affiliate tracking normally works on last-click attribution: when a user actually clicks your link, a cookie is set, and if they convert within the cookie window you get credited. Cookie stuffing subverts this by force-setting cookies for large numbers of visitors who never engaged with your promotion. Because attribution is last-click, a stuffed cookie can also overwrite the cookie of the honest affiliate who genuinely referred the trader.
Key takeaways
Cookie stuffing sets tracking cookies without any real click, then steals the conversion credit.
It exploits last-click attribution to overwrite honest affiliates' cookies.
Executed via hidden pixels, iframes, or on-load scripts — invisible to the user.
Detection triggers instant bans, withheld payouts, and possible criminal liability.
Shady third-party plugins can implement it on your site without your knowledge.
It is typically executed with hidden techniques — an invisible 1x1 pixel image or iframe, an auto-loading hidden frame, or JavaScript that fires the affiliate link on page load rather than on a real click. The visitor sees nothing; their browser silently receives tracking cookies from one or many programs at once.
For example, a fraudster embeds an invisible iframe on a high-traffic forum that drops a broker's affiliate cookie on every one of 50,000 monthly visitors. If even a handful later open a trading account for unrelated reasons, the fraudster collects CPA commissions on referrals they never actually generated — stealing credit from legitimate partners and defrauding the broker.
How it works
The mechanism exploits how HTTP cookies are set. A browser will accept a cookie from any resource it loads, so if a page silently loads the broker's tracking URL — via a hidden image, iframe, or script — the cookie lands without the user ever clicking. The fraudster's affiliate ID rides along, so the attribution system treats that browser as "referred by" them.
Because most affiliate programs use last-click or last-cookie-wins attribution, a stuffed cookie set today can overwrite a genuine referrer's cookie from last week. When the user converts, the fraudster wins the payout. Stuffing at scale — across thousands of unwitting visitors — turns a tiny natural conversion rate into meaningful stolen commission.
Brokers and networks detect it by watching for abnormal patterns: enormous click or impression counts with implausibly low engagement, extremely poor click-to-registration ratios, cookies set without a referring click event, and traffic sources that do not match declared promotional channels. The landmark enforcement case — the eBay affiliate prosecution that led to criminal convictions — established that cookie stuffing can be treated as wire fraud, not merely a terms violation.
1
Fraudster hides the trigger
An invisible pixel, iframe, or on-load script is embedded on a high-traffic page so the affiliate link fires without a real click.
2
Cookies drop silently
Every visitor's browser receives the broker's tracking cookie — often overwriting an honest affiliate's genuine cookie.
3
A visitor converts
Some fraction of the mass-cookied users later open an account for reasons unrelated to the fraudster.
4
Wrongful credit is claimed
Last-click attribution assigns the commission to the stuffed cookie, paying the fraudster for referrals they never made.
5
Detection and enforcement
The broker spots the abnormal click-to-conversion ratio, withholds payouts, bans the account, and may pursue legal action.
Why it matters for partnership: Cookie stuffing is theft dressed as marketing: it siphons commissions from honest affiliates and defrauds the broker. Detection means instant bans, withheld payouts, and potential legal action. Even inheriting it from a shady plugin or sub-affiliate puts your account and reputation at risk.
Real World Example
In the widely cited eBay affiliate fraud case, two operators used cookie stuffing to claim commissions on sales they never legitimately referred, ultimately facing US federal wire-fraud charges. In brokerage, the equivalent is an "affiliate" reporting 200,000 clicks a month against a 0.01% registration rate on a Pepperstone-style program — a ratio so implausible it flags the account for stuffing and freezes the payout.
Cookie stuffing vs legitimate tracking
Aspect
Legitimate tracking
Cookie stuffing
Trigger
User clicks the affiliate link
Hidden load with no user click
Visibility
User sees the ad or link
Invisible pixel or iframe
Attribution
Credits the real referrer
Overwrites the honest referrer
Status
Compliant
Fraud — bannable and prosecutable
Pro Tip
Audit your site and tracking links regularly and confirm cookies fire only on an explicit user click — never on page load — so no rogue plugin quietly turns you into a cookie stuffer.
Common Pitfalls
Installing questionable third-party plugins or coupon widgets that silently drop affiliate cookies on page load, exposing you to a fraud ban even though you never intended it.
FAQ
Is cookie stuffing illegal or just against the rules?
It is both. It always violates affiliate terms, and courts have treated large-scale cookie stuffing as wire fraud, producing criminal convictions in at least one landmark affiliate case. Treat it as a legal risk, not a gray area.
How is cookie stuffing different from click fraud?
Click fraud inflates clicks on ads or links to burn budget or claim CPC payouts. Cookie stuffing sets tracking cookies with no click at all to hijack conversion credit. Different mechanism, same fraudulent intent.
Can I be penalized for stuffing I didn't intend?
Yes. Brokers act on the behavior, not the intent, so a rogue plugin or sub-affiliate dropping cookies on your account can still get you banned and unpaid. You are responsible for what fires under your affiliate ID.
How do brokers detect cookie stuffing?
They watch for implausible click-to-registration ratios, cookies set without a referring click event, sudden huge impression volumes, and traffic that doesn't match your declared channels. Those patterns trigger manual review and payout holds.
Does cookie stuffing still work with modern browsers?
It is far less effective. Third-party cookie blocking, ITP in Safari, and stricter attribution have gutted the technique, and detection has improved. It remains a fast route to a permanent ban rather than a viable tactic.
What should I do if I suspect a partner is stuffing under my program?
Report it to the broker's affiliate manager with the suspicious traffic data. Protecting the pool of legitimate conversions keeps your own attribution clean and preserves the program's payout integrity.
How to structure, track, and disclose two or more broker sponsorships at once so each partnership reads as deliberate, not scattered, to your audience.
A client you referred deposits three months later, and someone else gets paid. Here is how cookie windows and attribution models decide who earns the commission, …
