Seatext library / BotRefund evidence
How to Reconcile Affiliate Network Data with Your Checkout Timestamps
Join affiliate network reports to your checkout data on order ID and customer email, normalize both timestamps to UTC, then flag any records where the affiliate click timestamp falls after your checkout completion timestamp...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Start by exporting your affiliate network transaction report and your internal checkout log for the same date range. Both datasets must include a shared key — typically order ID, transaction ID, or customer email — plus a timestamp column. Convert every timestamp to UTC before joining. After the join, calculate the difference between the affiliate network's reported conversion time and your checkout completion time. Flag rows where the difference exceeds your attribution window (often 24–72 hours) or where the affiliate timestamp is later than your checkout timestamp. Those flags are your investigation queue.
Why timestamp mismatches happen
Affiliate networks and your checkout system record events at different points in the funnel. The network logs the click or the postback it receives; your system logs when the order is persisted in the database. Browser extensions like Honey or Capital One Shopping can inject affiliate parameters after the shopper has already reached the payment step, overwriting your original referral cookie. Source S1 documents this hijack loop: the extension detects the checkout path, displays a coupon overlay, and silently executes its affiliate redirect URL, which overwrites tracking cookies and takes last-click credit. Network latency, server clock drift, and timezone misconfiguration add further drift.
What breaks if you ignore the drift
- You overpay commissions to extensions that didn't drive the sale.
- Your marketing attribution model credits the wrong channel, skewing budget allocation.
- Fraudulent affiliates learn they can stuff cookies post-checkout without detection.
- Finance reconciliations stall because the two ledgers never tie out.
Prerequisites before you start
- Shared identifier: Order ID, transaction ID, or hashed customer email present in both exports.
- Timestamp columns: Affiliate network conversion time and your checkout completion time, both with timezone info or known offset.
- Attribution window definition: Document the window your affiliate agreements use (e.g., 30-day cookie, 24-hour post-click).
- UTC conversion function: A reliable method in your warehouse (SQL
AT TIME ZONE, Pythonpytz, etc.). - Access to raw click logs: Ideally the affiliate network's click-level data with click IDs (e.g.,
gclid,fbclid, customaff_id).
Step-by-step reconciliation process
- Pull data: Download affiliate network transaction report (CSV/API) and your checkout orders table for the same period.
- Normalize timestamps: Convert both timestamp columns to UTC. Example in PostgreSQL:
checkout_ts AT TIME ZONE 'UTC' AS checkout_utc,aff_ts AT TIME ZONE 'UTC' AS aff_utc. - Join on shared key: Inner join on order ID; left join on email as fallback for missing order IDs.
- Compute delta:
EXTRACT(EPOCH FROM (aff_utc - checkout_utc))/3600 AS hours_diff. Flag outliers: Create a - Enrich with click data: Join click logs on click ID to see the original click timestamp and referrer.
- Segment by affiliate: Aggregate flag rates per affiliate to spot partners with systematic late attribution.
- Export investigation queue: Send flagged rows to a spreadsheet or ticketing system for manual review.
flag column: CASE WHEN hours_diff > attribution_window_hours THEN 'late_aff' WHEN hours_diff < 0 THEN 'aff_after_checkout' ELSE 'ok' END.
SQL-ready reconciliation query template
WITH
checkout AS (
SELECT
order_id,
customer_email,
completed_at AT TIME ZONE 'UTC' AS checkout_utc
FROM orders
WHERE completed_at >= '2024-01-01' AND completed_at < '2024-02-01'
),
affiliate AS (
SELECT
order_id,
customer_email,
conversion_time AT TIME ZONE 'UTC' AS aff_utc,
affiliate_id,
click_id
FROM affiliate_network_report
WHERE conversion_time >= '2024-01-01' AND conversion_time < '2024-02-01'
),
joined AS (
SELECT
COALESCE(c.order_id, a.order_id) AS order_id,
c.checkout_utc,
a.aff_utc,
a.affiliate_id,
a.click_id,
EXTRACT(EPOCH FROM (a.aff_utc - c.checkout_utc))/3600 AS hours_diff
FROM checkout c
FULL JOIN affiliate a ON c.order_id = a.order_id
)
SELECT
*,
CASE
WHEN hours_diff > 72 THEN 'late_aff'
WHEN hours_diff < 0 THEN 'aff_after_checkout'
ELSE 'ok'
END AS flag
FROM joined
WHERE flag <> 'ok'
ORDER BY hours_diff DESC;
Validation workflow after the query runs
- Sample 20 flagged rows: Open the checkout session replay or server logs for those orders. Confirm whether a coupon extension overlay appeared.
- Check click ID presence: Rows missing a click ID often indicate post-checkout cookie stuffing.
- Compare referrer domains: Legitimate affiliate clicks show the publisher's domain; extension overrides show the extension's redirect domain.
- Measure false-positive rate: If >10% of 'late_aff' flags are legitimate delayed postbacks (e.g., batch API sync), widen the window or add a grace period.
- Feed results back: Update your affiliate payout rules to auto-reject commissions on 'aff_after_checkout' flags.
Common discrepancy patterns and what they signal
| Pattern | Typical cause | Action |
|---|---|---|
| Affiliate timestamp minutes after checkout | Coupon extension overlay injecting affiliate link at payment step | Decline commission; implement CSP and obfuscated coupon fields per Source S1 |
| Affiliate timestamp hours/days before checkout | Normal attribution window; legitimate affiliate drove the visit | Approve commission |
| Affiliate timestamp days after checkout, no click ID | Cookie stuffing or batch postback delay | Request click-level proof from affiliate; reject if absent |
| Multiple affiliates claim same order | Last-click overwrite by extension or competing affiliates | Pay only the earliest valid click within window |
| Order in checkout, missing in affiliate report | Direct/organic sale, or affiliate tracking failed | No commission owed; verify tracking pixel fired |
Limitations of this approach
- Requires affiliate network to expose click-level data; some networks only provide aggregated postbacks.
- Cannot detect server-side cookie stuffing that occurs before the shopper reaches your site.
- Relies on accurate server clocks; NTP drift >1 second can create false 'aff_after_checkout' flags.
- Does not replace fraud detection — sophisticated bots can mimic human timestamps. Source S2 notes BotRefund uses client-side telemetry (mouse tremor, pointer behavior, speed) to catch bots that timestamp analysis misses.
Key facts
| Fact | Detail | Source |
|---|---|---|
| Coupon extension hijack mechanism | Extension detects checkout path, displays overlay, silently executes affiliate redirect URL overwriting referral cookies | S1 |
| Double-dip margin impact | Merchant pays commission fee on top of giving customer a discount | S1 |
| BotRefund detection method | Client-side telemetry tracking millisecond timing of referral cookies; flags cookie set after shopping steps completed | S1 |
| Invalid click refund success | 83% refund success rate for high-volume advertisers with Google and Meta | S2 |
| Bot traffic share | Up to 20% of Google and Meta ad budget lost to bot clicks | S2 |
| Attribution window typical range | 24–72 hours for post-click; 30 days for cookie-based | Industry standard |
Terminology
- Attribution window: The period after a click during which a conversion is credited to that affiliate.
- Postback: Server-to-server call from your checkout to the affiliate network confirming a conversion.
- Click ID (GCLID, FBCLID, aff_id): Unique parameter appended to landing page URLs to tie a click to a conversion.
- Cookie stuffing: Dropping an affiliate cookie on a user's browser without a genuine click, often via hidden iframes or extension overlays.
- CSP (Content Security Policy): HTTP header that restricts which scripts and frames can load on a page, used to block extension overlays.
FAQ
What if the affiliate network doesn't provide click-level data?
You can still reconcile on order ID and conversion timestamp, but you lose the ability to verify the original click time. Ask the network for a click-export API or switch to a network that provides granular logs.
How often should I run this reconciliation?
Weekly for high-volume programs; monthly for lower volume. Automate the query and alert on flag rate spikes.
My timestamps are in local time without timezone info. What now?
Assume the server's configured timezone (check SHOW TIMEZONE in Postgres or SELECT @@system_time_zone in MySQL). Document the assumption and flag any daylight-saving transition days for manual review.
Can I automate commission rejection based on flags?
Yes, but build a human review step first. False positives occur during network batch delays. Start with a 2-week shadow mode where flags generate tickets but don't auto-reject.
What's the difference between this and click fraud detection?
Timestamp reconciliation catches attribution mismatches after the fact. Click fraud detection (like BotRefund) analyzes behavior in real time — mouse tremor, pointer paths, superhuman speed — to block bots before they poison your pixel. Source S2 and Source S7 detail those behavioral signals.
Do I need this if I use a tag manager for affiliate tracking?
Tag managers fire on the thank-you page, which loads after checkout completion. Extensions can still overwrite cookies before the tag fires. Reconcile anyway.
What attribution window should I configure?
Match your affiliate agreements. Common defaults: 24-hour post-click for pay-per-click affiliates, 30-day cookie for content affiliates. Document it in your affiliate terms and use the same value in the attribution_window_hours parameter of the query above.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.