This is a very common and frustrating issue with SuiteCommerce and GA4 attribution.

You are absolutely right to focus on the referral data, as that’s almost certainly where the problem lies.

The short answer is:

Your massive attribution discrepancy is due to a self-referral issue on your SuiteCommerce site, likely caused by the domain change between the shopping pages and the secure checkout/My Account pages, or a technical hiccup in the Google Tag Manager implementation that causes session breaks.

The original source of the traffic (like a Google Ad click) is being lost and the conversion is being credited to a referral from your own domain, or to Direct traffic.

The immediate fix is implementing Referral Exclusions in your GA4 property for your commerce domain and potentially the secure/checkout domain to prevent this session-breaking self-referral.

The long-term, superior solution for complete data accuracy and reconciliation with your internal systems is to build a server-side tracking infrastructure using the NetSuite API, Google Analytics Data API, and a server-side GTM platform like Stape or Google Cloud Platform.

The long answer is:

Your instincts and Garrett’s findings are spot-on.

The culprit is almost certainly self-referral traffic breaking the session, and the shopping cart is a prime suspect.

On SuiteCommerce, if a user clicks from the main shopping domain to a different secure domain for the checkout (a common configuration), or even moves between subdomains in a way that the GA4 tracking is not perfectly configured to handle, the session is seen as “ending” and a new session starts.

This new session’s referrer is your own shopping site’s domain.

When this happens, all the original, highly valuable attribution data from the Google Ad (the GCLID parameter) is lost, and the new session is incorrectly credited as a Referral or, if the referrer is lost completely, as Direct traffic.

Since GA4 uses a data-driven attribution (DDA) model by default for conversions, and Organic search is often the non-Direct last touch before the session break, a significant portion of that lost paid credit can be reallocated to Organic, leading to the dramatic 95% drop you’re seeing in paid channels and a corresponding spike in others.

This is why when you added Session Source/Medium, you saw everything bucketed under Referrals – those are the broken sessions being incorrectly credited.

The hack Garrett suggested of adding the domain as a Referral Exclusion is actually the standard and necessary fix for this specific issue in e-commerce, especially when you have separate domains or subdomains for shopping and checkout, or for third-party payment gateways.

You should go into your GA4 Admin settings, navigate to Data Streams, select your web stream, click Configure tag settings, and then select List unwanted referrals.

Add your main shopping domain and any other self-referring domains/subdomains (like a separate checkout domain or even the NetSuite-hosted checkout if applicable) to this list.

This tells GA4 to treat traffic moving between those domains as part of one continuous session, preserving the original Google Ads attribution.

You should also ensure that your Google Ads account has auto-tagging enabled.

Garrett’s later post about removing the GA4 ID from the NetSuite configuration if you’re using the GTM Editor Bundle is also critical, as running both implementations causes data duplication and a host of other attribution headaches.

To future-proof your data and achieve a single source of truth, integrating NetSuite and GA4 using server-side tracking is the superior architectural solution.

Using the NetSuite API or NetSuite Commerce API, you can capture the exact order details, customer ID, and the original GA4 client_id at the moment of a successful purchase.

Separately, a tool like Stape (or your own custom solution on Google Cloud Platform) allows you to set up a server-side GTM container.

You would then use the GA4 Measurement Protocol to send an accurate, server-verified purchase or other standard event directly to GA4.

This is powerful because you are sending the event from your server, not the user’s browser, which means the event is clean, less likely to be blocked by ad blockers, and most importantly, you can attach the true, uncorrupted customer and attribution data (like the original client_id) that you retrieved via the API from the NetSuite order record.

This architecture connects the precise NetSuite back-end data with the GA4 front-end attribution data, giving you a complete, unassailable, end-to-end view of your campaign performance that is fully reconciled with your system of record, far beyond what client-side browser tracking can ever reliably achieve.