- Promotion abuse is a group activity, not a lone bargain hunter. Research on a large delivery platform describes it as organised and deliberately mixed in with ordinary customer traffic.
- In a survey of 300 large merchants, 38% reported rising costs from promo code and loyalty abuse between 2021 and 2022, and nine in ten reported significant costs from policy abuse overall.
- The signals that catch it are relational. One account looks fine. Forty accounts sharing a device, an address or a card do not.
- Abuse spikes seasonally. Seventy percent of surveyed retailers saw more of it during the summer season and 67% after the fourth quarter holidays.
- Your promotion terms are the control that costs nothing. Under the UK advertising code, significant conditions have to be stated where leaving them out would mislead.
The first sign is usually a margin that does not match the sales. A good month on paper, a quiet alarm in the bank balance, and somewhere underneath it a welcome code written for new customers being used by people who have shopped with you eleven times under eleven email addresses.
Most small sellers discover this late, because every individual order looks perfectly reasonable. That is the whole design. Promotion abuse does not announce itself in any single transaction, which is why it survives the fraud checks you already run and why the fix lives somewhere other than your payment provider.
What does promo code abuse actually look like?
Four shapes, and only one of them involves anything a court would call fraud. The rest are ordinary people following incentives you published, which is worth remembering before you design a response.
The first is serial sign up: new accounts created purely to re-earn a first order discount, usually with the same delivery address and a predictable email pattern. The second is code leakage, where a private or influencer code reaches a public coupon site and gets applied to thousands of orders you never intended to discount. The third is stacking, where two offers combine in a way your checkout permits and your margin does not survive. The fourth is organised exploitation at scale, which is what researchers study and most small shops never see.
That last category is better documented than you would expect. PromoGuardian, a 2025 paper built on data from the Meituan platform, describes promotion abuse as group based and deliberately blended with legitimate customer behaviour, and names two recurring patterns the authors call stocking up and cashback abuse. The scale is not yours. The structure is.
How big a problem is this for a small shop?
Smaller than the vendor pitches suggest and larger than your dashboard shows, which is an unhelpful answer until you measure your own number. The published benchmarks come from large merchants and should be read as a direction rather than a forecast of your losses.
In the Riskified benchmarks conducted with WBR Insights, 300 merchants each earning more than $500 million a year were interviewed, and nine in ten reported significant costs from policy abuse, with 38% reporting that promo code and loyalty abuse costs had risen year on year. The same survey found seasonal concentration: 70% saw more abuse in the summer season and 67% in the post holiday returns period.
Scale those sentiments down carefully. A shop doing 400 orders a month with a 15% welcome code and 8% of those orders coming from repeat customers in disguise is losing roughly the price of a part time afternoon each week. Worth fixing, not worth panicking over, and certainly not worth a fraud platform subscription that costs more than the leak.
Which signals link accounts that look unrelated?
Relationships rather than attributes. A single order carries almost no evidence of abuse, while the graph connecting orders to each other carries nearly all of it, which is why this problem is studied with graph methods rather than with per transaction scoring.
The academic work makes the logic explicit. A 2023 CIKM paper on voucher abuse detection using graph neural networks frames the task as anomaly detection over a graph of users and orders, and reports a 23.4% improvement over two models already running in production once the method was deployed. The engineering is out of reach for a shop of two people. The underlying idea is not, because the same links are visible in a spreadsheet.
| Abuse shape | How it works | Signal that catches it | Cost of blocking wrongly |
|---|---|---|---|
| Serial sign up | New accounts re-earn a first order discount | Repeated delivery address or card across accounts | High, families and flatmates share addresses |
| Code leakage | A private code reaches a public coupon site | Redemption rate jumps far beyond the audience you sent it to | Low, you can retire the code quietly |
| Stacking | Two offers combine beyond your intent | Orders with a discount total above your maximum rule | None, this is a checkout rule you forgot to set |
| Organised exploitation | Coordinated accounts, often reselling | Clusters ordering minutes apart with identical baskets | Medium, legitimate bulk buyers look similar |
The fourth column is the one most guides omit. Every control you add has a false positive rate, and a blocked genuine customer costs more than the discount you were protecting. We put numbers on that trade in what it costs to block a good order, and the arithmetic carries over to promotions without much modification.
What should you change first?
The code configuration, before any detection at all. Most leakage comes from codes written without limits, and the limits cost nothing to add.
Three settings close the majority of the gap. One use per customer account, which immediately turns serial sign up into an address matching problem rather than a free for all. A hard cap on total redemptions, so a leaked code costs you a known amount rather than an open ended one. A real expiry date, because a code with no end becomes permanent inventory on coupon sites and quietly reprices your whole catalogue.
Then add a minimum order value that sits above the discount, which prevents the pattern where someone buys the cheapest item in your shop repeatedly to harvest a fixed amount off. And separate your codes by purpose: one code per campaign, per channel, per influencer. A single shared code tells you nothing when it leaks. Twenty codes tell you exactly which door was left open.
What do your terms actually have to say?
Enough that a customer is not misled, which is a lower bar than a legal document and a higher one than most shops clear. Conditions that would change whether somebody takes part belong in the promotional material itself, not three clicks away.
The UK advertising code is the clearest working checklist even if you trade elsewhere, because it is written in plain language and enforced against real campaigns. Section 8 on promotional marketing makes promoters responsible for all aspects and stages of a promotion under rule 8.1, requires promotions to run fairly and to avoid causing unnecessary disappointment under 8.2, and under 8.17 requires significant conditions to appear where leaving them out would mislead, including how to take part, closing dates and any restrictions on entry. Rule 8.18 covers the case where your advert is a story on social media with no room for detail: point clearly to somewhere that carries the full conditions.
Two further rules matter for abuse specifically. Rule 8.9 says that writing subject to availability does not remove your duty to do everything reasonable to avoid disappointing participants, and 8.10 expects you to make a reasonable estimate of likely demand and either meet it or say so up front. In practice that means a redemption cap has to be disclosed rather than applied silently once the money starts hurting. Cancelling a promotion mid flight because it worked too well is exactly the situation those rules exist to govern.
Where does a leaked code actually end up?
On three kinds of surface, all of them findable in about ten minutes. Coupon aggregation sites, browser extensions that auto apply codes at checkout, and deal communities where somebody posts a screenshot of your influencer agreement.
Check yours this week. Search your code string in quotation marks, then search your brand name alongside the words discount code, then install one of the common coupon extensions and run a test checkout on your own site. The third test is the one that surprises people, because an extension can apply a code the shopper never had and never searched for, converting a full price customer into a discounted one at the final step without any intent on their part.
What you do about it depends on whether the code was ever meant to be private. A public campaign code found on a coupon site is working as designed. An influencer code with a 40% share of all redemptions and no matching traffic from that influencer's audience has leaked, and the fix is a fresh code with a redemption cap rather than an argument with the partner. A staff or supplier code circulating anywhere outside your building should be retired the day you find it, because that one has no legitimate audience at all.
Build a habit rather than a project. Once a quarter, list every live code, its redemption count and the audience it was issued to, then kill everything that has no owner. Most shops running for more than two years are carrying half a dozen codes nobody remembers creating, and those are the ones that quietly accumulate on aggregation sites.
Do referral and loyalty programmes break the same way?
Worse, because they pay out in advance of any proven value. A discount gives away margin on a sale that happened. A referral bounty gives away cash for a signup that may never buy anything, which makes it the most abused structure a small shop can run.
The mechanics are predictable. One person creates referred accounts to collect their own bounty, the accounts place a minimum qualifying order, and the credit covers the cost. Three design choices remove most of it. Pay the referrer after the referred customer's first order ships and the return window closes, rather than on signup. Cap lifetime referral earnings per account. Require that the referred order uses a different payment method and delivery address from the referrer, which is the single most effective rule and the one most programmes omit.
Loyalty points have a different weakness, which is accumulation. Points earned on orders that are later returned need to be clawed back automatically, or a returns cycle becomes a points machine. The Riskified survey found that two thirds of merchants recover less than half the value of a returned item, and if that return also minted points you are paying twice for the same transaction. The operational response belongs with the returns rules rather than the promotion rules, and we covered where the decisions sit in who should decide on a refund.
Does a model beat a rule here?
Eventually, and only above a volume most small shops will not reach for years. The honest comparison is between a handful of deterministic rules that you can explain to a customer and a statistical system that finds patterns you cannot see but also cannot justify.
The production numbers in the research are genuinely strong. The Meituan work reports 93.15% precision in production, detecting between 2.1 and 5.0 times more fraudsters than the methods it replaced and preventing between 1.5 and 8.8 times more financial loss. Those results come from a platform with millions of transactions and a labelled history of confirmed abuse, which is exactly what a model of that kind needs and exactly what a small catalogue does not have.
There is a middle path worth taking. You do not need a graph neural network to compute a link table: a weekly export that groups orders by delivery address, by card fingerprint and by email root, then flags any group with more than two first order discounts in it, catches most of what matters and takes an afternoon to build once. A general purpose model is genuinely useful for the next step, which is reading those flagged groups and writing a one line explanation of what connects them, so that a human spends thirty seconds per case instead of five minutes.
Keep the decision rule itself deterministic. When a customer asks why their discount was refused, an answer you can state in one sentence protects the relationship. A score you cannot explain does not.
How do you tell abuse from a discount that simply worked?
By measuring incrementality rather than redemption. A code with a high redemption rate and no lift in new customers is not being abused, it is being wasted, and the two problems have completely different fixes.
This distinction saves real money. If most redemptions come from customers who would have bought anyway, your promotion is a margin transfer rather than a growth tool, and tightening the abuse controls will not change the economics at all. The method for separating the two is the same holdout logic we went through in whether your discount week actually caused the sales. Run the offer to a random portion of your list, hold the rest back, and compare.
Only once you know the offer earns its keep is it worth defending. Spending an afternoon a week hunting duplicate accounts on a promotion that never moved anybody is a common and entirely avoidable waste.
What does a reasonable response look like?
Graduated, not binary. Blocking is the loudest tool available and it should be the last one you reach for, because the cost of being wrong lands on a real customer who will not come back to argue.
Start by declining the discount rather than the order. A checkout that says this code has already been used on this address, with the order still available at full price, converts a confrontation into a decision. Then rate limit rather than ban: one welcome discount per address per year is enforceable, explicable and survives the flatmate problem that catches naive device fingerprinting.
Reserve account level action for the clustered cases, where several accounts share a device and a card and the baskets are identical. Even then, a short human look costs a minute and prevents the embarrassing version, which is a bulk buying business customer treated as a fraud ring. If you are building these rules into your own storefront rather than accepting whatever a plugin offers, the logic belongs next to the cart in code you can read, which is one practical argument for a shop whose checkout rules you own.
Write the customer facing wording once, in advance, and keep it short. A refusal that reads as an accusation turns a marginal case into a public complaint, while the same decision phrased as a limit on the offer rarely gets a second message. One sentence naming the rule and offering the order at full price is usually the whole script.
Keep a log of every intervention with its outcome. Three months of that log tells you your own false positive rate, which no vendor benchmark can give you, and it is the only number that should decide whether your controls get tighter or looser next quarter.