 |
| The "dieselgate" principle is applied to honey |
In late 2024, a digital storm erupted that has left the e-commerce world reeling. Popular YouTuber MegaLag dropped an explosive investigation, alleging that the widely-used coupon and cashback extension Honey (owned by PayPal) wasn't just finding savings—it was allegedly running a sophisticated, hidden system to hijack affiliate commissions and deceive its users. The fallout was immediate and stark: Chrome Web Store figures suggest Honey's extension user base plummeted from an estimated 17-20 million to around 12 million in the aftermath.
But what exactly was uncovered? MegaLag, teaming up with renowned security researcher Ben Edelman to verify the technical deep dive, claims to have exposed a scheme so deliberately concealed, he compares it to Volkswagen's "Dieselgate" scandal.
The "Selective Standdown" System: A Digital Cloak for Alleged Manipulation
At the heart of the allegations is what MegaLag dubs the "SSD" (Selective Standdown) system. According to the analysis, this is a hidden logic baked into Honey's source code, designed to act like a digital chameleon. Its purported goal? To recognize and behave differently for industry testers versus regular shoppers.
The reported mechanism is said to be both simple and startling. The extension allegedly checks four key criteria to flag a potential tester:
- Account Age: Newer accounts might be scrutinized.
- Point Balance: Low Honey Gold balances could raise a flag.
- Server-Side Blacklist: Specific IPs or user agents might be blocked.
- Professional Cookies: The presence of cookies from major affiliate networks like CJ or Awin would indicate an industry insider.
If the SSD system suspects a tester is watching, the extension reportedly behaves impeccably—fully compliant with network rules, refusing to overwrite third-party tracking links. However, for the average shopper—especially one with a high loyalty point balance and no professional cookies—the software is alleged to switch to "attack mode." In this state, it supposedly injects its own codes to intercept and claim affiliate commissions that rightfully belonged to influencers, creators, or other marketing partners.
"This is behavior engineered for deception," Edelman states in the coverage, drawing the direct parallel to Dieselgate, where software detected test conditions. "The code shows intentionality. It wasn't a bug; it was a feature designed to avoid detection."
The evidence, extracted directly from the extension's configuration files and JavaScript, suggests this logic has been refined over years. For instance, the point threshold suspected to trigger the alleged commission hijacking reportedly skyrocketed from about 501 points in 2022 to over 65,000 points today, making it virtually impossible for casual observers to spot.
For the investigators, this targeted concealment is the smoking gun. It implies, they argue, that Honey was aware its reported behavior violated affiliate network rules and invested significant effort to avoid getting caught. Traces of this "Selective Standdown" protocol allegedly date back to 2017—prior to PayPal's acquisition of a majority stake in the company.
Beyond Commissions: Artificially Inflated Coupons and Strong-Arm Tactics
The video details another layer of alleged user deception: Honey's coupon database. MegaLag claims that Honey frequently presents expired or non-functional codes as "exclusive" finds, primarily to keep users engaged on the platform.
Critically, during the automated check for a working code, Honey is accused of placing its own affiliate cookie in the background. Even if no valid discount is found, the extension allegedly overwrites the tracking links on the page. This ensures that if a purchase is made, the commission goes to Honey/PayPal, while the original content creator or marketing partner who drove the sale receives nothing.
In a follow-up video, MegaLag further alleged that Honey scrapes user-submitted coupon codes and redistributes them, against the wishes of many retailers. When these retailers attempt to block the practice, they are reportedly pressured into formal partnerships with Honey.
See the Investigation Unfold: Key Videos and Analysis
To fully understand the depth of these allegations, MegaLag's video evidence is crucial. He breaks down the code line-by-line and demonstrates the alleged behavior in real-time.
- Watch the initial explosive exposé: The YouTube video that started it all
- Follow-up with deeper technical proofs: Further evidence and demonstrations
- See the coupon scraping allegations: How codes are reportedly taken and redistributed
- Read the detailed technical audit by security expert Ben Edelman: His full analysis on detecting testers
The Wider Fallout: A Breach of Trust with Real Consequences
The implications of these allegations are severe and multi-sided.
- For Users: It represents a profound breach of trust. Beyond privacy concerns related to extensive data collection, users were potentially used as unwitting tools in a scheme that systematically diverted money away from the content creators they may have been following.
- For Retailers: The unauthorized distribution of private, targeted coupon codes can lead to massive revenue loss and destroyed marketing strategies. The alleged "partner-or-be-bullied" dynamic places them in a difficult position.
- For the Affiliate Industry: It undermines the foundational trust of performance marketing. If a browser extension can silently intercept commissions at the last second, the entire ecosystem for publishers, influencers, and networks becomes unstable.
Honey's behavior, as presented in these investigations, paints a picture of a platform that may have prioritized its own growth and revenue through ethically questionable and allegedly rule-breaking means. While Honey has yet to issue a detailed public rebuttal to these specific code-level claims, the exodus of millions of users suggests the court of public opinion is already in session. The digital shopping landscape, and how we trust the tools within it, may have been permanently altered.