I downloaded Phia the week it launched, excited out of my mind. AI, shopping, two young women building consumer tech: my exact corner of the internet. I wanted it to be brilliant.
Instead it kept throwing itself over my shopping. Pop-over after pop-over, always in the way, never earning the interruption. I kept waiting for the moment of value. It never came. Stranger still, nobody else seemed to find it either. Not one “girls, this found me the dress for $40 less,” especially not in Australia. The only Phia news that ever reached me was funding news. When a product’s word of mouth is entirely about its cap table, that’s a tell.
Before we go further: this is not a dunk. Two young women built a consumer app, raised real money from serious funds, and got 1.5 million people to install it. I know how rare that story is, I spend my life trying to make more of them exist. But this week they landed in the worst news cycle of their lives, and the lesson is bigger than Phia. The product was never good. That was the signal.
For anyone who missed the hype: Phia is a browser extension that combs the internet while you shop, comparing prices across retail and secondhand to surface the right buy at the right moment. On paper, one of the most exciting startups you could back in the age of agentic commerce. Under the cover, an affiliate marketing business. Hold that thought.
The search was rudimentary. The price comparisons were often just wrong. App Store reviewers said out loud what I was thinking: “essentially a worse version of Google Shopping.” And yet the company kept getting more valuable. An $8 million seed. A $35.5 million Series A at a $185.5 million valuation, led by Notable Capital, Khosla Ventures and Kleiner Perkins, with Kris Jenner, Hailey Bieber, Sydney Sweeney and Khloé Kardashian on the cap table. 1.5 million users. 9,600 retail brand partners.
A product that mediocre doesn’t become worth $185.5 million on what it does for the user. The value had to be coming from somewhere else. This week, Bloomberg offered an answer.
What the investigation alleges, fluff-free
On July 9, Bloomberg published an investigation, backed by testing from affiliate-fraud researcher Ben Edelman (remember that name) and rival Capital One Shopping. In plain English:
Phia makes money through affiliate marketing, the deal underneath every “free” shopping tool: a publisher recommends a product, a user clicks, the user buys, the retailer pays a commission. The one non-negotiable rule is that the click is real. In Edelman’s words, the rules don’t allow fake clicks, simulated clicks, imaginary clicks or hypothetical clicks.
The investigation alleges Phia was faking the click. Shop at a retailer with Phia installed, even if you got there on your own, and the app could open a hidden tab and fire its own affiliate link without you touching anything. At checkout, its code could take credit for a sale it did nothing to create. In one Bloomberg test, clicking a Wirecutter link to Nordstrom triggered a background tab that swapped Wirecutter’s affiliate credit for Phia’s.
The industry calls it cookie stuffing. Any girl who’s worked a commission retail floor knows it by another name: the assistant who never served you leaning over the register to punch her staff number into your sale.
The fallout was fast. Impact.com, one of the biggest affiliate platforms going, suspended them. Phia told Bloomberg it was a bug in “a recent release,” now fixed. Bloomberg verified the fix.
And that would be the end of the story, if the receipts agreed with the word “recent.” Or the word “bug.”
The part that made me sit back in my chair
Edelman published his full technical breakdown, test videos, code and network traffic included. This is where “unfortunate bug” gets hard to sustain.
→ Per his findings, the behaviour was a named, built feature: enable_coupon_auto_drop. It does what it says, drops the affiliate link with no user action. You don’t accidentally write a feature, name it, and ship it.
→ It shipped in December 2025 and ran roughly seven months, including the entire holiday season. That’s a lot of releases between “a recent release” and now.
→ It was switched on for iOS users only, off for Chrome. Edelman’s read: most affiliate-fraud testers test on desktop. Whatever the intent, the behaviour lived exactly where the auditors weren’t looking.
→ My personal favourite. Phia’s own telemetry logged an event literally named AFFILIATE_COOKIE_COMPETITOR_DETECTED when a user arrived via someone else’s affiliate link. It saw the other publisher’s claim, wrote it down, then took the commission anyway. It knew. It’s in the logs.
To be fair, and to be clear: these are allegations from Edelman’s testing and Bloomberg’s reporting, nothing court-tested, and Phia disputes the framing. They told industry bloggers Kris and Sarah they’ve been “reviewed and verified as compliant” by their affiliate networks. Edelman’s response, in short: networks can fail to find violations, they can’t certify the absence of them.
Why “the UX was bad” was the whole tell
The cookie stuffing is the symptom. Here’s the disease.
When a consumer product is free, the business model is the product. Phia’s pitch was Google Flights for shopping: comparison, dupes, discount codes. But the revenue was never coming from you. It comes from retailers paying commissions, so every incentive in the building points at one metric: get the Phia cookie onto as many checkouts as possible. Not “find her the best price.” Not “make search good.” Get. The. Cookie. Dropped.
Suddenly the bad UX makes sense. The search didn’t need to be good. The prices didn’t need to be right. The extension just needed to be installed and present at checkout. The user was never the customer. She was the distribution.
It wasn’t the first signal, either. Back in November, NowSecure found an earlier version of the extension sending snapshots of pages users visited, sensitive ones included, back to Phia’s servers, well beyond what was disclosed. Fortune covered it, Phia updated the product, the news cycle moved on. But look at the shape: data overreach in November, forced clicks in July. Both are value quietly extracted from her browser while she thinks the app is working for her.
My rule: when a free product is bad at its job and still getting more valuable, follow the money until the maths makes sense. It always makes sense. Just usually not in your favour.
We have literally seen this movie
This movie has a prequel with actual prison time. In the 2000s, eBay’s two biggest affiliates were caught stuffing cookies at scale, one after collecting more than $28 million in commissions. eBay went to the FBI. Both men pleaded guilty to wire fraud and served prison time. The researcher who caught them? Edelman. The same man who just spent his July inside Phia’s code.
The modern sequel: PayPal bought Honey for $4 billion. In December 2024, YouTuber MegaLag accused Honey of the exact same two behaviours: hijacking creators’ commissions and standing down for no one. It detonated the category. Honey is still in class action litigation with creators including LegalEagle.
That’s what makes the Phia timeline hard to watch. Honey was the loudest story in this exact category, twelve months before auto_drop shipped. Everyone building a shopping extension in 2025 knew where the line was. The internet had just drawn it in permanent marker.
Now look at who pays, because this is the part that should make you furious. Publishers and creators. Wirecutter has journalists, salaries, actual costs. The girl doing affiliate links in her newsletter has rent. She spent months building the trust that made someone click buy. Phia’s contribution, per the findings, was a background tab.
Sit with the maths. A $185.5 million company with half of Hollywood on the cap table, allegedly taking checkout credit from women earning their first few hundred dollars online. The exact women it was branded for. The industry rule is called “standing down”: when someone else drove the sale, you back off. Every dollar taken by ignoring it comes out of a creator’s pocket, and this community is full of women building exactly that revenue line. This isn’t abstract. It’s your bag.
Don’t file this under American problems either. The same rails run our cashback economy: every ShopBack click, every “shop via the app” bonus is this exact plumbing. We know how fragile the category is, we just lost our homegrown player: Cashrewards, eleven years, two million members, switched off overnight last September in an ANZ restructure. A category built on trust deserves players who protect it. Not ones who treat the rules as optional.
The agentic elephant in the room
Now zoom out, because this is bigger than one app, and this part is my actual day job.
AI already shops for you. Agentic checkout is live in Australia, with THE ICONIC, Adore Beauty, Bunnings, Kogan and Petbarn signed on. The whole premise: you delegate the click, the comparison, the purchase, to software acting on your behalf.
Here’s the law of that world: whoever holds the payment holds the trust. Old-way shopping distributed trust, you saw the store, the reviews, the price, the checkout, and verified every step with your own eyes. Delegate to an agent and it all collapses into one question: do I trust whatever is executing the transaction? You don’t see the shelf. You don’t see the comparison. You see the receipt.
Checkout stops being plumbing and becomes the relationship. PayPal didn’t pay $4 billion for coupons; it paid to own the moment money moves. UCP fights to keep the retailer as retailer of record for the same reason. It’s also why the Phia allegations are worse than skimming: checkout was the one moment the shopper couldn’t see, the moment she trusted the tool completely, and per the findings, that’s exactly where the value was extracted. The deal broke at its most sacred point.
Phia is the first big trust scandal of the shopping-agent era. Break trust anywhere and you lose a customer. Break it at the payment and you break agentic shopping itself, because delegation only works when the thing you delegate to is provably on your side.
Get the incentive design wrong now, while the category is young, and we’ll automate this exact behaviour at planetary scale and call it innovation. The agents are coming either way. The question is whose side they’re on, and the answer is written in the business model, not the brand campaign.
What I’d actually say to the founders
If Phoebe or Sophia ever read this: the comeback is available, and it’s not a PR strategy. It’s building the boring version of this company. Take credit only for sales you drive. Back off when a creator got there first. Make the product so good the commission is earned, not engineered. It’s slower, it looks worse at a board meeting, and it’s the only version of Phia that deserves the 1.5 million women who installed it.
For the rest of us:
→ If a product is free, work out who’s paying. Their interests steer the roadmap.
→ If a free product is bad at its job and still winning, that gap is information. The UX tells you where the value is flowing.
→ If you earn affiliate income, check your attribution reports from the last seven months, especially the holidays.
→ If you’re building with real money behind you: hot-cap-table growth pressure is exactly when “auto_drop” gets shipped. Decide who you’re building for before the Series A decides it for you.
The girls in that app deserved a product that was actually for them. The whole point of building for women is that she’s the customer, not the inventory.
So, my question. What’s in your browser right now that’s free, a bit bad, and worth hundreds of millions, and have you ever asked why?
Reply, I want to know.
Brooke x
Sources: Bloomberg’s investigation, Ben Edelman’s technical breakdown, TechCrunch on the suspension, TechCrunch on the Series A, Fortune on the data collection, NowSecure’s analysis, Engadget.
Really enjoyed reading your piece Brooke! Agentic commerce is such an important part of this conversation and not many people are talking about it. An agent can execute a purchase without knowing you (it just won't be good at it) so I think your profile like what you browse, what you buy, your size, etc matters just as much as the payment does. Wrote about this in a little more detail recently. Curious to hear your thoughts!
https://gurmankalkat.substack.com/p/ai-was-supposed-to-change-how-you?r=26sfaa&utm_campaign=post&utm_medium=web
What an incredibly thorough and thoughtful piece breaking down all of the controversy. Bravo, seriously, I’ve been devouring all of the Phia commentary, and I have to say your piece here might be the best one out there. 🙌