Fraud & invalid traffic · also called Cookie dropping, Attribution theft
Cookie stuffing
Cookie stuffing is secretly planting tracking cookies or click records on a visitor's browser so the fraudster is later credited for sales or clicks they did not cause.
Affiliate and performance marketing pay whoever "referred" the customer, and the referral is usually remembered in a cookie or a Click ID. Cookie stuffing drops that marker without a genuine click, for instance by loading a hidden frame or forcing an invisible redirect. If the person later buys, the fraudster collects the commission. The MRC standards list cookie stuffing among the forms of SIVT.
The link to search arbitrage is attribution. Arbitrageurs optimise campaigns using conversion and revenue signals sent back to the traffic source through a postback or Conversions API. If a partner stuffs cookies or claims sessions it did not create, those signals are polluted: the buying algorithm learns to chase the wrong audience, and reported performance for a source is fiction.
It also damages the advertiser side of the feed. An advertiser who sees search-partner clicks "converting" only because credit was stolen from another channel is being misled about the feed's value.
Signs include conversions with no preceding visible click, extremely short click-to-conversion times, and a source whose reported results vanish when measured independently.
Think of it like this
It is a salesman slipping his business card into the pocket of every person walking past a car showroom, then claiming commission on whoever buys a car.
Related terms
Attribution
Attribution is the process of deciding which ad, click or traffic source gets the credit for a conversion or a piece of revenue.
Fake conversion
A fake conversion is a reported sale, sign-up or other goal that did not really happen or was not made by a genuine customer.
Click spam
Click spam is the mass generation of fake or background clicks in the hope that a few will be credited with real revenue or conversions.
Click injection
Click injection is fraud in which software on a user's device inserts a fake ad click the user never made, usually to steal credit for an action already under way.
Postback (server-to-server tracking)
A postback is a message sent directly from one company's server to another's to report that a tracked click produced a conversion or revenue.
SIVT (sophisticated invalid traffic)
SIVT is invalid traffic designed to look like real people, which can only be found with advanced analysis that compares many signals at once.
Sources: MRC Invalid Traffic Detection and Filtration Standards Addendum (June 2020 update)