PropFirmMatch Cookie Stuffing: The Full Story Behind the Scandal

In late October 2026, a single screen recording showed that PropFirmMatch, one of the largest prop firm comparison sites, was quietly sending visitors through its own affiliate links when they clicked something else. Within about a day, at least 22 prop firms had ended their relationships with the platform. This article explains exactly how the redirect worked, how long it ran, what PropFirmMatch gained, what its apology said and left out, and the legal and commercial risks that follow.

What Happened at PropFirmMatch in October 2026

PropFirmMatch ran JavaScript that, on a visitor’s first click of a firm profile or “copy code” button each day, opened the requested page in a new tab and sent the original tab through PropFirmMatch’s affiliate link to the prop firm. The prop firm’s tracking then credited PropFirmMatch with the referral, even though the visitor never clicked an affiliate link.

PropFirmMatch is operated by Prop Firm Match Global FZCO, a company registered in a Dubai free zone. The site compares prop trading firms, publishes reviews and discount codes, and earns commission when traders buy evaluation challenges through its links or codes.

How Trader Kane Exposed the Hidden Redirect

On 29 October 2026 at 20:33 UTC, a trader posting on X as @traderkane published a video showing the behavior on PropFirmMatch’s site. He used MyFundedFutures as the example and said the same thing happened on most firms listed on the site. His post pointed out that PropFirmMatch’s own affiliate rules ban this practice for people who promote PropFirmMatch.

The claim was easy to dismiss at first, because many people who tried to reproduce it saw nothing unusual. That changed once researchers pulled PropFirmMatch’s own JavaScript files from the Internet Archive, which saves copies of the code a website serves to visitors.

“Are we still on the "deceitful marketing algo"? Hey @PropFirmMatch, did you knowingly push an update that stuffs cookies when people aren’t clicking links advertised in the code as external websites?Here’s what happens: someone clicks the profile page or copy code link that… pic.twitter.com/yhw9uWMsap— kane🧪 (@traderkane) October 29, 2026”

How Fast PropFirmMatch Switched the Redirect Off

The redirect was disabled within hours of the video. In the copy of PropFirmMatch’s code that the Internet Archive saved at 00:23 UTC on 30 October 2026, less than four hours after the post, the redirect function still exists by name but simply returns false. The line that sent the original tab to the affiliate link is gone.

PropFirmMatch replied publicly on X at 03:14 UTC the same day, saying it was looking into the questions and would share a full statement within 24 hours. One minute later, Apex Trader Funding announced it had terminated its affiliate relationship with PropFirmMatch.

How the PropFirmMatch Affiliate Redirect Actually Worked

The redirect lived in a function named useAffiliateRedirect, attached to the copy-code button and, from April 2026, to internal firm links. The function used the browser’s local storage to remember which firms had already been redirected that day, then swapped the visitor’s tab to the firm’s affiliate URL. We opened the archived files for November 2025, September 2026 and 30 October 2026 and confirmed the code described below.

The Five Steps Inside the useAffiliateRedirect Function

Each click on a wired button or link ran the same sequence. The archived September 2026 version shows it plainly, even in minified form.

1. The script checked that the firm’s affiliate URL was valid and that a redirect was allowed for that listing.
2. It read a record stored in the browser under the key affiliate_redirects, holding today’s date and a list of firms already redirected.
3. If the firm was already on today’s list, it stopped, and the click behaved normally.
4. If not, it added the firm to the list and opened the page the visitor actually wanted in a new tab with window.open.
5. It then set window.location.href to the firm’s affiliate URL, sending the original tab, now in the background, through PropFirmMatch’s referral link.

Browsers usually switch focus to the newly opened tab, so the visitor kept reading what they expected. The tab they left behind loaded the prop firm’s site through the affiliate link, and the firm’s tracking cookie recorded PropFirmMatch as the source.

Why the Once-Per-Day Rule Made Retests Look Clean

The redirect fired only once per firm, per browser, per day. The date came from toISOString(), which means the “day” reset at midnight UTC, not local time.

That detail explains why so many people could not reproduce Kane’s video. Anyone who clicked a firm, noticed nothing, and clicked again to test it was already on that day’s list, so the second click behaved normally. A clean retest proved nothing. The September 2026 version also attached a sub7 parameter carrying a checkout session ID to some affiliate links, which ties the background visit to a specific PropFirmMatch session.

The Cookie Banner Test That Raised Consent Questions

One independent test suggests the redirect ignored cookie consent. A writer who runs a competing comparison site, PropFirmTrend, reported clicking “Decline” on PropFirmMatch’s cookie banner in a private browser window, then clicking a firm in the comparison table. The original tab still went to the firm through PropFirmMatch’s referral link.

She also reported that when she later reached the same firm through Google and started checkout, PropFirmMatch’s discount code was already filled in. This is one person’s test, published by a competitor who disclosed that interest, so it should be treated as a reported finding rather than a confirmed one. If it holds, it matters for privacy law, covered further below.

How Long the PropFirmMatch Redirect Was Running

Archived copies of PropFirmMatch’s JavaScript show the redirect live from at least 30 November 2025 until it was switched off on 30 October 2026, a period of about 11 months. Captures up to 14 October 2025 do not show it, though two files from that date were not archived.

Date (UTC)	What the record shows
30 November 2025	Earliest archived version with the redirect on the copy-code button
April 2026	Internal firm links wired to the same redirect function
3 September 2026	Redirect still live, with a session ID added to some links
24 October 2026, 01:32	Redirect still live in the archived code
29 October 2026, 20:33	Trader Kane posts the video on X
30 October 2026, 00:23	Archived code shows the redirect switched off
30 October 2026, 03:14	PropFirmMatch promises a full statement within 24 hours
31 October 2026	PropFirmMatch publishes its statement on X

The archive proves what code PropFirmMatch served on those dates. It does not show how many visitors the redirect fired for, how many purchases it affected, or exactly when it was first deployed between October and November 2025.

“Pulled @PropFirmMatch own javascript from the internet archive. here’s what it shows:nov 2025: livesep 2026: still live30 oct, 4h after @traderkane’s post: switched offone line opens your page in new tab. next send the tab you left via affiliate link. once per firm, per day pic.twitter.com/i6z7QyEBn0— Prop Radar (@PropRadarLive) October 30, 2026”

Is a Forced Click the Same as Cookie Stuffing

Strictly, PropFirmMatch’s redirect is a forced click, a close cousin of classic cookie stuffing. Classic cookie stuffing sets an affiliate cookie with no click at all, usually by loading the tracking link invisibly when a page opens. A forced click waits for the visitor to click something unrelated, then fires the affiliate link they never chose.

For the affiliate programs involved, the difference rarely matters. Most programs only count a referral when the visitor deliberately interacts with the affiliate’s tracking link. A trader copying a discount code or opening a firm’s review page has not chosen to be referred, so the tracking that followed does not meet that standard.

PropFirmMatch’s own rules make the comparison awkward for the company. Its affiliate terms, issued by Prop Firm Match Global FZCO for people promoting PropFirmMatch, forbid “hidden iframe redirects, forced affiliate cookies” and ban software that overwrites cookies. Its user terms say it may earn commission through affiliate links or codes provided on the site, but say nothing about opening affiliate links in a background tab.

What PropFirmMatch Gained From Redirecting Traders

The direct benefit was commission. Prop firms pay affiliates when a referred trader buys an evaluation, and most firms credit the most recent affiliate cookie in the browser. By firing its own link on routine clicks, PropFirmMatch placed its cookie last, at the moment a trader was most likely to be shopping.

Last-Click Attribution and the Overwritten Creator Cookie

The people most exposed were other affiliates, especially creators and educators whose links traders had already used. Under last-click attribution, a newer cookie replaces an older one, so PropFirmMatch’s background click could take credit for a trader someone else had sent.

Here is a hypothetical example to show the mechanics. A trader watches a YouTube educator, clicks the educator’s link to a firm, and the firm sets the educator’s cookie. Before buying, the trader checks PropFirmMatch to compare rules and clicks “copy code.” The redirect fires, the firm’s site sets PropFirmMatch’s cookie, and the trader buys a $100 challenge later that day.

If the firm pays 10% commission on last click, PropFirmMatch receives $10 and the educator receives nothing, even though the educator introduced the trader. The trader pays the same price either way, which is why traders lost nothing directly. Vest, one of the firms that cut ties, said PropFirmMatch’s commissions “undeniably include siphoning commissions from others” for exactly this reason.

The Scale of Commissions Involved

Only one firm has published a number. Goat Funded Trader said its PropFirmMatch commissions for the month totaled $20,000 and pledged that amount to a trader prize pool. That figure covers one partner for one month, and PropFirmMatch’s archived page data listed affiliate URLs for dozens of firms.

No public data shows how much of PropFirmMatch’s commission income came from forced clicks rather than deliberate ones. Each firm can only answer that from its own affiliate records.

Paid Listings and the Ranking Questions Raised by Topstep

The scandal also exposed how PropFirmMatch’s listings were funded. Michael Patak, founder of Topstep, posted that Topstep had no discount code with PropFirmMatch but paid it $10,000 a month to be listed, that its best rank was sixth, and that he had heard the top spot cost $100,000 a month. The $100,000 figure is secondhand, and PropFirmMatch has not commented on listing prices.

Khaled, the CEO of FundingPips, added a separate claim. He said FundingPips caught the cookie practices in August, took action, and then dropped from first to tenth in PropFirmMatch’s best-seller ranking, and that he was told traders choosing FundingPips over other firms cost PropFirmMatch money. Taken together, the two posts raise a question PropFirmMatch’s statement does not address: whether its rankings reflected merit, payment, or commission.

Which Prop Firms Cut Ties With PropFirmMatch

As of 31 October 2026, at least 12 prop firms have publicly ended affiliate partnerships or paid listings with PropFirmMatch, most within 24 hours of the video. Their reasons ranged from a general “review of referral tracking practices” to Vest’s explicit “confirmation of cookie stuffing.” The list below covers firms that announced their decision publicly.

Firm	What the firm said or did
Apex Trader Funding	Terminated the affiliate relationship and disabled tracking codes after reviewing compliance with its affiliate agreement
Lucid Trading	Ended the partnership after investigating PropFirmMatch’s cookie practices
Take Profit Trader	Terminated the affiliate relationship and disabled tracking codes
FundingPips	Terminated the partnership, forfeited the month’s commissions, and said financial claims will be pursued
Vest	Disabled the code citing confirmed cookie stuffing; commissions moved to a trading competition prize pool
Blue Guardian	Ended the relationship and deactivated links and codes
Alpha Capital Group	Terminated after investigating cookie practices; codes deactivated
Goat Funded Trader	Terminated and pledged $20,000 in commissions to traders
BrightFunded	Ended the partnership after an internal investigation
Tradeify	Said PropFirmMatch broke its affiliate terms; PropFirmMatch’s Premier Trading League sponsorship ended
Topstep	Dropped its $10,000-a-month paid listing
FXIFY	Ended the partnership after reviewing how sales were attributed

Two firms went further than terminating. FundingPips and Vest both withheld commissions already accrued, which is the fastest form of enforcement available to a merchant, because the money never leaves its account.

The Major Prop Firms That Have Stayed Silent

As of 31 October 2026, FTMO, The5ers and FundedNext had not made public statements about PropFirmMatch. All three sit near the top of PropFirmMatch’s own most-favorited list, and affiliate URLs for FundedNext and The5ers appear in PropFirmMatch’s archived page data.

Silence is not evidence of anything. A large firm may be auditing months of affiliate data before deciding, and the presence of its link in PropFirmMatch’s code means it may have paid for referrals it did not earn, not that it did anything wrong. Readers should check each firm’s official channels for updates.

What PropFirmMatch’s Official Statement Said and Left Out

PropFirmMatch published its statement on X on 31 October 2026, roughly in line with its 24-hour promise. The post went out from the company’s official account. It admitted the redirect, said it “should not have happened,” took full responsibility, and said it had contacted each partner to “reconcile any inaccuracies.”

The statement opened with two paragraphs of company achievements before the admission. It cited over 25 million website visits, more than 370,000 members, over $1.4 million in free challenge accounts given away, and more than 100 firms applying to be listed each year through what it called one of the industry’s most rigorous compliance processes.

“Three years ago, Prop Firm Match launched. Two traders saw a gap in the market for a platform providing simplicity and transparency for prop firm traders. We developed new features not seen before: verified reviews, payout tracking across all payment methods, live spreads, rule…— Prop Firm Match (@PropFirmMatch) October 31, 2026”

Where the Statement Contradicts the Archived Code

The statement describes the mechanism inaccurately. It says that when someone clicked a firm or code, “a new tab would open the firm’s site through our affiliate link.” The archived code does the reverse: the new tab opened PropFirmMatch’s own page, and the original tab, the one the visitor had just left, went through the affiliate link.

The difference is not cosmetic. A visible new tab opening a firm’s site is something a visitor would notice. A background tab silently changing is the reason the behavior went largely unnoticed for months.

Questions the Statement Did Not Answer

The statement says the behavior ran “until yesterday” but does not say when it started, though the archive shows at least 11 months. It does not explain who built the feature, why it was limited to once per firm per day, or why it was extended to internal links in April 2026.

It gives no figure for how many visitors or purchases were affected and says nothing about compensating the creators and affiliates whose referrals were overwritten. It also does not address the consent question raised by the cookie banner test or the listing-price claims made by Topstep’s founder.

Trustpilot’s Warning on PropFirmMatch’s Profile

As of 31 October 2026, PropFirmMatch’s Trustpilot page shows a warning that its rating is unavailable due to a breach of Trustpilot’s guidelines, with a note that Trustpilot removed a number of fake reviews. Trustpilot does not say who wrote the removed reviews or when the warning was added, so it should not be read as proof that PropFirmMatch wrote them. It does mean the platform’s public rating is currently suspended.

“a prop firm review site getting flagged for fake reviews on a review site. you can’t make this uphttps://t.co/6rRgrpGR7N pic.twitter.com/u4PXHz4bWy— Prop Radar (@PropRadarLive) October 30, 2026”

Legal Risks PropFirmMatch Could Face Moving Forward

As of 31 October 2026, no lawsuit, regulatory action or criminal charge has been publicly filed against PropFirmMatch. The realistic near-term risk is commercial: lost partners, withheld commissions and contract claims. Criminal exposure is possible in principle but faces large practical hurdles. This section is general information, not legal advice.

Contract Claims and Commission Clawbacks From Partners

Affiliate agreements typically define what counts as a valid referral and give the merchant the right to withhold or reverse commissions for invalid traffic. Because firms hold the money, many will not need a court at all. FundingPips has already forfeited a month of commissions and said it will pursue financial claims, and Vest has redirected PropFirmMatch’s commissions to traders.

Claims for past commissions are where the money is. Any firm can compare PropFirmMatch-credited sales between 30 November 2025 and 30 October 2026 against periods before and after, and look for orders where a trader used another partner’s code but the sale was credited to PropFirmMatch’s cookie.

Wire Fraud Precedent From the eBay Affiliate Cases

Cookie stuffing has been prosecuted in the United States as wire fraud under 18 U.S.C. § 1343, which carries a maximum sentence of 20 years in prison plus fines. The best-known cases involved eBay’s two largest affiliates. Shawn Hogan pleaded guilty and was sentenced to five months in federal prison, and Brian Dunning received a 15-month sentence.

Those cases differ from PropFirmMatch’s in important ways. They involved cookies set with no click at all, at very large scale, with prosecutors proving intent. A forced click on a comparison site has no court record, and no US authority has shown any interest in PropFirmMatch as of this writing.

GDPR Exposure for Tracking European Visitors

The European Union’s General Data Protection Regulation (GDPR) applies to non-EU companies that offer services to people in the EU or monitor their behavior, under Article 3(2). Fines under Article 83 can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations.

The GDPR question depends on the cookie banner test. If the redirect fired after a visitor declined cookies, that is the kind of consent failure European regulators act on. Enforcement against a small non-EU company with no EU office is rare, so the risk is real on paper and limited in practice.

Why a Dubai Base Complicates Enforcement

Prop Firm Match Global FZCO is registered in Dubai, which shapes every legal route. Contract claims follow the governing law and forum named in each affiliate agreement, so location matters less there. Criminal action is different: a US prosecution would require the conduct to touch the United States substantially and, in practice, extradition or arrest during travel.

The most direct criminal route would run through the company’s home jurisdiction. The UAE’s Federal Decree-Law No. 34 of 2021 on combating rumors and cybercrimes covers online fraud, but any case there would need a complaint filed locally by a firm or affiliate.

Long-Term Effects on Prop Firm Affiliate Marketing

The PropFirmMatch case is likely to change how prop firms run affiliate programs. Tradeify said it will look closely at all of its affiliates going forward, and firms that relied on browser cookies alone now have a public example of how easily the last cookie can be manipulated.

Expect more firms to move toward server-side tracking, to give coupon codes priority over cookies when the two conflict, and to require that a referral start from a click on a clearly labeled outbound link. Comparison sites will face closer audits of their JavaScript, and partners will ask for proof that tracking only fires on deliberate clicks.

For PropFirmMatch, the damage goes beyond lost commissions. Its business depends on firms paying to be listed and traders trusting the rankings, and both relationships are now under strain. Its traffic is real, but traffic alone does not bring partners back if they believe the referrals were inflated.

What Traders Should Check Before Buying a Challenge

Traders did not pay more because of the redirect, but they can make sure their referral goes to whoever actually helped them. The checks below take a minute and work on any prop firm checkout.

• Check the discount code at checkout before paying, and change it if it is not the code you meant to use.
• Clear cookies and site data for the prop firm’s website before buying if you visited a comparison site recently.
• Use the link or code of the creator, educator or site that genuinely helped you decide.
• Treat a site’s rankings as one input, and check how that site says it earns money from the firms it lists.

Frequently Asked Questions About the PropFirmMatch Scandal

Did PropFirmMatch admit to cookie stuffing?

PropFirmMatch did not use the term, but its 31 October 2026 statement admitted that clicks on firms or codes sent visitors through its affiliate link, said this should not have happened, and accepted full responsibility. Vest is the firm that publicly described it as confirmed cookie stuffing.

Did traders lose money from the PropFirmMatch redirect?

Traders paid the same challenge price and received the same discount, so they lost nothing directly. The losses fell on affiliates whose referrals were overwritten and on prop firms that may have paid commissions for referrals PropFirmMatch did not earn.

Is the PropFirmMatch redirect still active today?

No. The archived code from 00:23 UTC on 30 October 2026 shows the redirect function returning false, and PropFirmMatch’s statement says the behavior stopped. As of 31 October 2026, there is no public evidence that it has returned.

Why could some people not reproduce the redirect?

The redirect fired only on the first click per firm, per browser, per UTC day. Anyone testing twice in the same browser saw normal behavior the second time, and after 30 October 2026 it did not fire at all.

Can PropFirmMatch face criminal charges for cookie stuffing?

It is possible in principle, since US prosecutors have treated cookie stuffing as wire fraud, but no charges have been filed. The company’s Dubai base, the lack of precedent for forced clicks, and the need to prove intent make criminal action unlikely in the near term.

What the PropFirmMatch Scandal Means for Industry Trust

The PropFirmMatch case came down to one design choice: sending visitors through an affiliate link in the tab they were no longer looking at, once a day, so the behavior was hard to catch. A trader with a screen recorder caught it anyway, and the Internet Archive kept the evidence.

The firms that left made a commercial judgment as much as a moral one, because every forced click was a commission they paid for a referral they did not get. What happens next depends on whether PropFirmMatch publishes the numbers its statement left out, and on whether the large firms that stayed quiet decide the traffic is worth the risk.