Nepo baby scandal?

Was this newsletter forwarded to you? Sign up to get it in your inbox.

Bloomberg published a second investigation into Phia last week, and this time the leaked Slack messages made the story much harder for the company to explain away.

Phia, in case you missed the first round, is the AI-powered shopping app that Phoebe Gates (daughter of THE Bill Gates) founded with her Stanford roommate Sophia Kianni, and which has raised $43.5 million from a cap table that includes Kleiner Perkins, Khosla Ventures, Kris Jenner, Hailey Bieber, Sydney Sweeney and roughly thirty other cultural or venture names. In July, Bloomberg reported that the app had been injecting its own affiliate cookies into online purchases at Nike, Gap, Nordstrom and thousands of other retailers, then billing those retailers for sales it hadn't sent. A Phia spokesperson said the company had only learned of the issue in the past 24 hours. Last week's follow-up, based on internal Slacks, showed that the founders had known since December 2025.

The revenue number is what to focus on. When Phia turned the offending feature off on 7 July, its daily takings dropped from about $80,000 to somewhere between $10,000 and $28,000. A Phia data scientist estimated internally that roughly half of what the company had billed brands for in June was work it hadn't actually done. Phia disputes the methodology behind that specific figure but not the revenue drop, which is in its own internal chart.

What I want to write about isn't the scandal itself, which has been well covered elsewhere. It's the fact that this went on for seven months at a company working with the biggest retailers in the world, backed by some of the most sophisticated venture investors in Silicon Valley, and nobody with commercial exposure to it noticed. If the affiliate compliance teams at Nike and Gap couldn't catch it, that says something troubling about the affiliate model itself.

How the affiliate model actually works, and what the halo looked like

Affiliate marketing, briefly, works on the last-click principle: when a shopper lands at a retailer's checkout, whichever affiliate cookie was dropped into their browser most recently gets credited with the sale, and paid a commission on it. It's an attribution convention that has always been gameable at the edges, and Phia gamed it centrally. Its extension surreptitiously injected its own cookie at the moment of purchase, overriding whichever affiliate had actually sent the shopper, and collected the commission.

The Phia pitch, viewed from anywhere other than an affiliate compliance desk, was a good one. Two Stanford-educated female founders in their early twenties, one of them a Gates. An AI-powered shopping agent, launched at the moment every venture firm in California had decided AI agents were the next platform shift. A community-first go-to-market that reached 1.5 million users, 2.7 million social followers and a claimed one billion views inside a year. Time named the app one of its Best Inventions of 2025. Nearly 10,000 retail brand partners signed up. Kleiner Perkins led the $8 million seed in September 2025. Notable Capital and Khosla Ventures led the $35.5 million Series A in January 2026, valuing the company at $185.5 million.

None of this is to say the investors were wrong to back the company, or that celebrity capital is inherently bad signal. It's to point out that the surface features brands and investors used to evaluate Phia, the young founders, the cultural cachet, the viral growth, the AI story that fit the moment, were also the surface features Phia was optimising for. The parts that would have revealed the problem sat several layers below.

Not just Phia

Phia is not the first company to do this. In December 2024, a YouTuber called MegaLag published a video accusing Honey, the coupon browser extension PayPal bought for $4 billion in 2019, of doing essentially the same thing: swapping other affiliates' tracking cookies for its own at the moment of purchase, and collecting the commission on sales it hadn't sent. Within a week, LegalEagle's Devin Stone filed a class action in the Northern District of California on behalf of content creators. On 22 June 2026, Judge Beth Labson Freeman denied PayPal's motion to dismiss the second amended complaint, sending every claim into full discovery.

Since MegaLag's original video, Honey has reportedly lost about 7 million users and 7,000 merchant partnerships. Its coupon inventory, according to third-party analysis cited in MegaLag's August follow-up, has fallen from roughly 90,000 to around 50,000. Google's Chrome Web Store updated its policies to ban extensions from taking commissions without actually providing a discount. PayPal disputes the characterisation and the scale, but the direction of travel is not really in question.

So this is a category problem, not a Phia problem. Puck's Lauren Sherman reached the same conclusion in July, framing her Line Sheet coverage around whether Phia's affiliate model could survive the scandal at all. The wider numbers support the concern. Anura, an ad-fraud detection firm, estimates the affiliate channel has a fraud rate of around 45%. Juniper Research put global ad-fraud losses at $84 billion in 2023, roughly 22% of digital ad spend. Statista's figure for the same year was $88 billion, projected to reach $172 billion by 2028. The numbers are contested at the edges, as fraud numbers always are, but the range they describe is not small.

Who's actually doing the checking

The Phia scandal wasn't caught by any of the brands paying Phia commission. It wasn't caught by Impact.com, the affiliate network distributing the money. It was caught by two Bloomberg reporters working with Ben Edelman, a former Harvard Business School faculty member who spent weeks testing the extension across more than 50 websites. Before that, it took MegaLag's viral 23-minute video to force any consequence at Honey.

That is the actual bar for detecting affiliate misattribution from outside a platform. Weeks of forensic testing by an independent expert, or a well-produced investigation by a journalist with enough time and legal cover to publish it. Almost nobody in-house at a brand has that capability. Nike, Gap and Nordstrom certainly didn't. It is not really a question of resources. It is a question of whether the people who would need to look have any incentive to look hard at a channel that appears, most of the time, to be growing nicely.

What varies with scale is what happens after someone else catches it for you. A brand with a lot of spend running through a platform has contractual leverage, a legal function that can chase refunds, and enough commercial weight to make the platform care about the conversation. A brand with less spend on the same platform has thinner recourse across all three. Phia has said it is reversing transactions and Impact.com is auditing. How those refunds actually get distributed, and to whom, will be an interesting story to follow.

The affiliate model, as currently constructed, asks brands to trust platforms to accurately report on their own performance. Ben Dutter, chief strategy officer at Power Digital, has written that platform-reported figures 'systematically flatter the platforms'. This is not really an affiliate problem, though. It's the affiliate version of a problem that has arrived with media fragmentation. When brands ran their advertising through three or four channels they mostly understood, they could sanity-check the numbers themselves. Now they run it through fifteen or twenty channels they mostly can't, and the platforms in each channel have every commercial reason to report favourably on themselves. NIQ's CMO Outlook for 2026 found that a third of CMOs now use between six and fifteen separate tools to measure marketing ROI, with some using more than fifteen.

What would need to change

The Honey case has already pushed one part of the system to move. After MegaLag's video, Google updated its Chrome Web Store policies to ban extensions from claiming commission without actually delivering a discount. That is a useful precedent because it puts the enforcement burden on the distribution platform rather than the individual brand. Chrome doesn't have to trust Honey or Phia to behave. It can refuse to host extensions that don't meet a technical standard and let its own review process do the work.

The affiliate networks are the other obvious pressure point. Impact.com suspended Phia after Bloomberg's first report, which was the right response but a response, not a prevention. The networks have the technical capability to detect cookie-stuffing patterns at scale. A publisher whose share of attributed conversions swings from 20% to 51% in six months is a visible anomaly in the data the network already holds. Whether the networks have the commercial appetite to run that kind of monitoring aggressively is a different question, because their revenue depends on transaction volume flowing through their publishers and enforcement action reduces that volume in the short term. This is a version of the problem you get with any marketplace that takes a cut of what it polices.

On the brand side, the changes are less about detection and more about what happens contractually before the deal is signed. Audit rights on affiliate reporting are unusual in standard contracts but not unreasonable to ask for. A named compliance contact at the platform, and a defined process for raising misattribution disputes, are both cheap to negotiate at the point of signing and expensive to retrofit once the relationship is a year in. Independent attribution reviews, on some cadence, cost money but cost less than discovering nine months of misattributed commission after the fact. None of this is exotic. It's the sort of thing procurement teams do routinely with technology vendors and don't tend to do with marketing platforms, mostly out of habit.

There is a useful precedent from the last time the industry had this argument. In 2020, ISBA published its Programmatic Supply Chain Transparency Study, conducted with PwC and the Association of Online Publishers. The study mapped the flow of money through the programmatic ad supply chain for the first time and found that only 51% of spend reached publishers, with a further 15% classed as an 'unknown delta' that could not be accounted for at all. Phil Smith, then director general of ISBA, described the exercise as 'the first time anywhere in the world that an attempt has been made to map a system which is not capable of being audited'. Six years on, the resulting industry taskforce has driven some standards and improved some contract terms, but nobody involved would claim the transparency problem in programmatic is solved. The affiliate channel is roughly at the stage programmatic was at in 2018, which is to say the problem is now visible and the incentives to fix it are still weaker than the incentives to grow through it.

The harder change is cultural, and it is bigger than affiliate. Marketing has spent the past decade being told that measurement is what separates it from the amateur era, and platforms across every fragmented corner of the media landscape have been happy to supply the measurement. The Phia and Honey cases are a reminder that platform-supplied measurement is a category of number that should be treated with the same scepticism marketers used to reserve for agency-supplied creative research. It is useful, it is often directionally right, and it should not be the only thing anyone relies on to know whether the money is working.

Phia will not be the last company caught doing this. It will be the one that made the next ten harder to sell in. That is probably a good outcome for the affiliate channel in the medium term, because a category built on trust that turns out to have very little enforcement behind it either fixes itself or shrinks. Both are healthier than the current arrangement, which is a lot of money moving through a system that mostly runs on the assumption that everyone will behave.

The narrower lesson is that any platform asking you to trust its own numbers is asking for something the recent history of the affiliate channel says you shouldn't give. Ask what independent verification looks like before signing. Ask what happens if it turns out the numbers were wrong.

Looking for a new agency? DCA cuts through the noise to connect brands with agencies that fit

• We cover all types of projects and disciplines, from strategy and creative to performance and tech.

• Our editorial team vets every agency, so you skip the pitch theatre and get straight to capable partners.

• We offer consultancy, pitch management, or a complimentary shortlisting service if that's all you need. Submit a brief today

Amar Chohan, Founder and CEO - Department of Creative Affairs.