A referral or affiliate program runs on one promise: whoever actually brought the customer gets the credit. The common way referral links are tracked breaks that promise by design, because it hands the credit to whichever link touched the browser last, not to whoever did the work of bringing the customer in the first place.
How last-click referral tracking gets hijacked
Most referral tracking stores the code from the link a visitor clicked in a long-lived cookie, and overwrites it every time a new one is seen. That single design choice is what a well-known class of browser extensions exploits: install one, and it silently opens its own affiliate link in the background right before checkout, overwriting whatever code was already stored. The extension's owner collects the commission. The influencer, affiliate or partner who actually convinced the customer to buy gets nothing, and typically never finds out.
This is not a rare edge case. It is a documented, common pattern in affiliate marketing, and it is a direct consequence of "last link wins" being the default.
The fix: first link wins, and it's locked
The alternative is to credit the first valid referral code a visitor arrives through, not the last, and to make that credit permanent the moment the visitor becomes a customer:
- Within a single visit, the first code captured wins. A second referral link opened later in the same session is ignored outright, extension or not.
- Once a customer places an order, the code is written onto their profile and never overwritten again, for the life of that customer. Every future order they place, next week or next year, keeps counting toward the same referral.
The only way that changes is a deliberate, manual change in the underlying data. No link clicked afterward, by anyone, can take it.
Why the capture window matters too
Tracking the code in a long-lived cookie has a second cost: it follows visitors around for weeks, quietly, whether or not they ever come back. A session-scoped capture, held only while the browsing session lasts and gone the moment the tab closes, avoids that entirely. It still catches the case that matters, a visitor who arrives through a link and buys in that same visit, without the privacy cost of a tracker that outlives the visit.
What good referral tracking should report
Beyond the anti-hijack lock itself, a referral system worth using should tell you, per link:
- Arrivals: how many visitors came through it and were tracked.
- Customers: how many of those actually bought.
- Revenue, for the customer's lifetime, not just their first order. A partner who brings a customer who orders four times over a year brought you all four orders, and the number attributed to them should say so.
The technical detail, first-touch instead of last-touch, locked instead of overwritable, is small to describe and large in consequence. It is the difference between a referral program partners can trust and one where the payout depends on whether a coupon extension happened to run.