You open GA4 and look at where last month's purchases came from. "Direct" is huge. There's a line for paypal.com. Maybe shop.app or a bank's 3D Secure domain. Meanwhile, the campaigns you pay for look like they barely convert.
The ads probably did their job. Somewhere between the click and the confirmation page, the visitor's session broke, and the sale got credited to whatever site they passed through last.
What's actually happening
Analytics ties a purchase to a traffic source using a session. When a visitor leaves your site for a payment provider and comes back, a few things can go wrong:
- The return is treated as a new visit. The provider's domain becomes the "referrer," so the order is attributed to it instead of your ad.
- Tracking identifiers get lost. Click IDs and campaign parameters from the original landing page may not survive the trip, so ad platforms can't match the order to the click.
- The domain changes mid-journey. If checkout runs on a different domain or subdomain than your storefront, the browser can treat it as a separate site unless tracking is configured to link them.
The result is inflated "direct" and "referral" traffic, and paid channels that look weaker than they are.
Where the break usually happens
1. Redirect payment methods. PayPal, buy-now-pay-later providers, and bank authentication steps send customers to another site and back. Each trip is a chance to lose the session.
2. Wallets and accelerated checkouts. Express options can move customers through flows that behave differently from the standard checkout, and your tags may not see the same data.
3. Cross-domain setups. Storefront and checkout on different domains need cross-domain measurement configured. If it isn't, the session splits at checkout.
4. Unwanted referrals not excluded. GA4 lets you list domains that shouldn't count as referral sources. If your payment providers aren't on that list, they can steal credit.
5. Landing-page parameters never saved. If the original click ID and UTM values exist only in the first page's URL, they're gone by the time the order is placed.
6. Missing consent at return. If the visitor's consent state isn't carried through the redirect, tags may behave as if consent was denied, and the purchase can go unattributed.
How to confirm it's your problem
You don't need a developer for the diagnosis.
- Check your top sources for purchases. In GA4, look at purchase events by source and medium. Payment providers or bank domains near the top are a red flag.
- Compare "direct" before and after. Did direct purchases rise while paid-channel purchases fell, with Shopify's order total unchanged?
- Look at the landing page of purchase sessions. If many purchase sessions begin on your checkout or confirmation page, the session restarted there.
- Place a test order with a redirect payment method. Use your own ad link with UTM parameters. Watch the session in GA4 DebugView or your browser's Network tab.
- Compare against another data source. Shopify's own order-level data shows the landing page and referrer it recorded. If those look right while GA4 looks wrong, the break is in your tracking layer.
How to fix it
- Add payment providers to the unwanted referrals list. In GA4's data stream settings, exclude the domains your customers pass through. Check Google's current documentation for exactly how this works.
- Configure cross-domain measurement if checkout lives on a different domain from your storefront, so the session carries across.
- Capture attribution data early and keep it. Store UTM parameters and click IDs when the visitor first lands, for example in first-party storage or as cart attributes, so the values are available when the order is placed.
- Attach that saved data to the purchase event. For server-side or offline-style reporting, include the stored identifiers so ad platforms can match the order to the click.
- Carry consent through the flow. Make sure the consent state is still set correctly when the visitor returns from the payment provider.
- Retest every payment method. Each redirect behaves differently, so one passing test doesn't prove the rest.
What to expect afterward
Even a well-configured store won't get perfect attribution. Ad blockers, consent choices, cross-device journeys, and attribution windows all create gaps. The goal is narrower:
- Payment providers stop appearing as top traffic sources
- "Direct" purchases fall back to a believable share
- Paid channels regain credit for orders they actually influenced
- Remaining gaps are small enough to explain
Compare a few weeks of data before and after. Short windows are noisy.
A quick checklist
- [ ] Top purchase sources reviewed for payment-provider domains
- [ ] Unwanted referrals list updated
- [ ] Cross-domain measurement configured, if checkout is on another domain
- [ ] UTM parameters and click IDs saved on first landing
- [ ] Saved values attached to purchase events
- [ ] Consent state confirmed after payment redirects
- [ ] Test orders completed with each payment method you offer
- [ ] Dated notes kept on what changed, so later report shifts are explainable
Where tools can help
Doing this by hand means editing GA4 settings, capturing and storing parameters, wiring them into events, and testing every payment path. If that's more than you want to manage, a tracking app that handles this as part of the setup can save time.
For example, Webgarh GTM Assistant lists client-side and server-side tracking through Google Tag Manager, event deduplication, Consent Mode v2 support, and tag diagnostics. It's newer than some alternatives and has a smaller review base, so run a test order through each payment method you offer and check that the source, campaign, and click ID arrive correctly before relying on it.
The short version
If "direct" and payment providers are taking credit for your sales, the session likely broke during checkout. Check your sources, exclude payment domains, connect domains if needed, save attribution data on landing, and carry it through to the purchase. Then test every payment method. Your paid campaigns may turn out to be doing better than your reports suggested.
