Affiliate attribution: last click is lying to you

One affiliate account is producing 40% of the program’s attributed revenue. Nobody at the brand has spoken to them, there is no content anywhere with their name on it, and the traffic arrives with no referring page.

It is a browser extension. It fires at the moment a shopper clicks into the discount code field, which is roughly four seconds before the order is placed. (Composite, drawn from programs we have audited.)

The partner who only appears at checkout

Last click awards the sale to whoever touched the customer most recently. That sounds neutral and is not, because it systematically rewards proximity to checkout rather than contribution to the decision.

Whoever sits closest to the buy button wins. Coupon extensions and cashback sites occupy that position deliberately, and they occupy it after every real acquisition channel has already done its work.

The shopper in question saw an ad on Tuesday, searched the brand name on Thursday, opened an email on Saturday, and installed a coupon extension eleven months ago. Last click says the extension acquired them.

Where the interception happens

The mechanic is simple and mostly invisible.

A shopper reaches checkout and clicks the discount code field, which for many people is a reflex. An extension detects the field, opens in the background, tries a list of codes, and in the process fires a redirect that sets a last-touch cookie.

The purchase decision was already made. The extension inserted itself between the decision and the transaction, which is a real service to the shopper and not an acquisition.

Cashback sites do a milder version of the same thing. The shopper deliberately routes through them to claim cashback on a purchase they had already decided on, which is a last click that follows intent rather than creating it.

What the earlier touches actually were

Modelled on 1,000 orders that last click assigned to an affiliate.

Earlier touch	Share of last-click affiliate orders
Paid social	31%
Organic or brand search	22%
Email	14%
Creator or influencer	9%
No earlier touch at all	24%

Seventy-six percent had an earlier touch from a channel that received no credit.

The split by affiliate type is where the decision lives. Extension-attributed orders had an earlier touch a modelled 89% of the time. Content-link affiliates, the ones who wrote a review or made a video, came in at 52%.

Those are different businesses inside one line item. Paying them the same commission is the actual error, and last click is what conceals it.

Why codes make it worse

A discount code is a string, and a string can be republished.

Issue a code to a partner, and within days it appears on aggregator sites, browser extensions and community threads. At that point the code no longer identifies the partner it was issued to. It identifies whoever found it.

The consequence is that code-based attribution degrades over time in a way that looks like partner performance. A code that produced genuine referral traffic in month one is producing intercepted traffic by month four, with the same partner still collecting.

This is why the answer is not a better code policy. It is fewer public codes, and offers gated on something a shopper cannot type at all.

The fixed priority order

Competing claims are guaranteed. The resolution has to be a written order applied identically every month, not a judgment call made when somebody queries a number.

Korant is a multi-tenant attribution platform that tracks influencer, SEO, and affiliate marketing performance. Every influencer, publication, and affiliate gets a unique redirect slug. Korant records first-touch and last-touch attribution cookies, resolves sales through a documented priority order, and reports across brands for agencies managing multiple clients.

The order that works for most brands, resolving in sequence and stopping at the first match:

1. Discount code issued to a named influencer
2. Discount code issued to a named affiliate
3. Last-touch cookie identifying an influencer
4. Last-touch cookie identifying an affiliate
5. Cookie identifying a publication

Anything reaching the bottom without matching is unattributed and stays that way.

Korant is not for stores with a single paid channel, or for brands that only need Shopify’s native reports. With one channel nothing competes, and the whole problem in this article requires at least two parties claiming the same order.

What each step is doing

Codes rank above cookies because an entered code is an explicit act by the shopper while a cookie is an inference about them.

That only holds while codes stay non-public. The moment a code is republished, it stops being an explicit act by that partner’s audience and becomes exactly the interception this article is about, which is why step one carries a maintenance obligation rather than being set once.

Influencer ranks above affiliate because creator touches happen earlier in the journey and would otherwise be crowded out by anything sitting closer to checkout.

Publication ranks last because publication cookies are the loosest signal, frequently set by syndicated content the publisher did not directly place.

Store first-touch separately at every step. Overwriting it is what makes an interception invisible, and a stored first-touch value turns the hijack into a discrepancy you can count.

Retiring a leaked code

Build the check into the monthly routine. Search for your brand name plus the word coupon, look at what appears, and compare against the codes you issued.

Any code found on an aggregator gets retired and replaced. The partner keeps their slug and their cookie-based attribution, so their genuine traffic keeps counting, and the leaked string stops paying anybody.

Expect resistance from partners who liked the code. The honest framing is that a leaked code was never measuring their audience, so retiring it removes credit they were not earning rather than credit they were.

What the priority order still cannot tell you

It assigns credit and it does not establish cause. An order resolved to a content affiliate at step four means their cookie was present, not that they produced the sale.

The 24% with no earlier touch is the closest thing here to a genuinely affiliate-acquired population, and even that is a floor rather than a measurement, since plenty of touches leave no record.

The only instrument that answers the causal question is a holdout: pause a partner type in a matched geography and compare total orders rather than attributed ones. Most programs never run one, which is why the commission rates in this channel tend to be set by negotiation rather than by evidence.