Cashback, Coupons and Rewards

Business model and fraud surface

The four business models below work the same way: someone funds an incentive, someone proves a purchase, the platform credits a balance, and the balance leaves.

Who eats the loss depends on the contract, and it shapes incentives inside the platform. When the platform pays a user for an invalid receipt, it has either already billed the brand (and risks disputes or lost trust if the brand audits) or it absorbs the cost. Either way the platform can't recover the payout from the user once it reaches a gift card. Sign-up and referral bonuses are funded by the platform's own growth budget, so abuse there hits marketing ROI directly, and it is often the thing marketing measures least well.

Proof of purchase is where these programs are weakest. A card-linked offer gets an authoritative transaction record from the issuer or network, but usually only merchant-level data without item detail. A receipt program gets item-level detail but only as a picture of a document, so it is effectively underwriting the image. Industry writing on CLOs notes that product-level offers at supermarkets need SKU-level receipt data joined to the bank's card record. That join is exactly where both businesses are now converging, and it is also the strongest control.

Decision points: sign-up (one human, one account?), offer activation, submission validation (receipt or transaction match), balance crediting, vesting into available balance, payout destination setup and change, and redemption.

What fraudsters want here

• Cash-equivalents with weak identity binding. A gift card bought with points is close to cash, and the account that earned it may have taken 30 seconds to create.
• Multiplication. Every welcome bonus, referral reward and "first receipt" offer pays per account, so Multi-Accounting, Device Farms and Emulators and Account Farming and Resale turn small incentives into income.
• Evidence you can't fully verify. Edited, fabricated, duplicated, borrowed or bought-then-returned receipts (Receipt Fraud (Cashback)). GenAI makes realistic receipt images cheap. On one expense-management platform, AI-generated images went from 0% of flagged fake receipts in March 2025 to about 71% by May 2026. That is expense-fraud data, but it is the best public early warning for rewards programs.
• Timing gaps. CLO credits can post before the merchant refund arrives, points can be credited before a return, and coupon reimbursement reconciles weeks after redemption. Each gap is a window for buy-claim-return.
• Stored balances to steal. Reward balances are poorly monitored, so Account Takeover (ATO) of a loyalty account is low-risk for the attacker. EY's 2025 loyalty report estimates over $200B in unredeemed points globally and cites typical detection times of 150 to 180 days.

Fraud across the customer lifecycle

Top mechanisms, ranked

1. Receipt Fraud (Cashback): fabricated, edited, duplicated, shared or borrowed receipts, plus purchase-claim-return. It is the highest-volume loss for receipt-scan programs, and GenAI image tools have made it cheaper and better.
2. Multi-Accounting: one controller running many accounts to repeat first-purchase offers, welcome bonuses and per-account caps. It is the force multiplier behind nearly every other mechanism here.
3. Referral Abuse: self-referral rings and farmed referees that turn referral budgets into payouts. Rewards that pay out before the referee does anything real are the giveaway.
4. Sign-Up Bonus Abuse: farming new-user bonuses with minimum activity. PayPal publicly attributed 4.5 million illegitimately created accounts in late 2021 to incentive campaigns.
5. Card-Linked Offer Abuse: buy-claim-return, split tenders, multiple enrolled cards per person, and stolen cards linked to reward accounts. Public CLO terms show that reversals on refund depend on the merchant's refund flowing back through the same rails.
6. Loyalty and Rewards Redemption Fraud: ATO of points balances, farmed balances pooled into one redeemer, and laundering through gift cards and partner transfers.
7. Promo Code Abuse: leaked, stacked or enumerated codes and eligibility abuse. An early-2021 Inmar survey found 63% of US shoppers had tried to stack offers on one item, so "abuse" sits on a spectrum with normal behavior.
8. Coupon Counterfeiting and Misredemption: counterfeit manufacturer coupons and misredemption. The Talens case cost retailers and manufacturers about $31.8M (DOJ). Digital coupon codes are tested at scale by bots.
9. Business Logic Exploitation: double-crediting, race conditions on redemption, and stacking bugs. They are rare but tail-heavy, and can drain a budget overnight (see Pinduoduo, 2019).
10. Account Takeover (ATO): stuffing and phishing into reward accounts. Balances are small per account but large in aggregate and lightly protected.

Also present: Insider Fraud (retail staff scanning their own loyalty card on customers' purchases, or support agents adjusting balances), Fraud Rings and Collusion (receipt marketplaces and pooled accounts), and Generative AI and Deepfake Fraud (synthetic receipts).

Regulatory environment

No regulator owns "rewards fraud". The obligations that shape your controls come from consumer protection law about how you take rewards away.

See also US Regulatory Overview, Regulation E and Unauthorized Transfers, BSA-AML and SAR Filing.

Key metrics

General definitions: Fraud Metrics and KPIs. Rewards labels are noisy because most fraud here is first-party, so invest in Loss Taxonomy and Attribution and Fraud QA Program early.

How fraud teams are typically organized here

Rewards companies often start with trust and safety or integrity teams inside product or operations rather than a compliance-led fraud function. Typical shape at scale:

• Integrity or fraud strategy: rules, models and offer-level risk. Works closely with growth/marketing, who own bonuses and referral budgets.
• Receipt or claims operations: review queues for flagged submissions. This is often outsourced, and QA becomes critical (see Fraud QA Program).
• Data science: receipt image forensics, linkage and anomaly detection.
• Partner/brand management: offer design and reconciliation with funders.
• Payments ops: payout rails and gift card vendors.

The key organizational control is a promo launch review with teeth: every offer, bonus and referral change gets a pre-launch fraud review, a budget cap and a kill switch (New Product and Promo Launch Review, Promotion Design Guardrails). The common failure is growth teams measured on sign-ups while fraud is measured on losses, with nobody owning bonus cost per real user. See Cross-Functional Partnerships and Fraud Operating Model.

Industry-specific signals and controls

Signals

• Receipt and Document Image Forensics: template conformance per merchant (store numbers, register and transaction ID formats, tax math), duplicate and near-duplicate detection, signs of editing or synthesis. Metadata absence proves nothing.
• Basket and SKU Anomalies: baskets built around offers, impossible quantities, offer items with nothing else, prices off the merchant's actual price.
• Promo and Reward Redemption Patterns: redemption timing relative to offer launch, uniform redemption sequences across accounts, sudden offer-level surges.
• Referral Graph Patterns and Entity Link Analysis: referral stars and chains, shared payout destinations, shared devices.
• Device Reputation and Linkage and Emulator and Rooted Device Detection: device farms behind "unique" users.
• Dispute and Return History: purchase-claim-return when you can see retailer returns or CLO refund reversals.

Controls

• Receipt and Purchase Verification: tiered validation, with merchant-template checks, cross-account duplicate detection and, where possible, a match against the retailer's or issuer's transaction record (the strongest control).

• Reward Vesting and Clawback: hold new rewards until the return or refund window passes. Clawback terms must be clear (see Regulatory environment).

• Referral Program Controls: pay on real referee activity, cap per referrer, delay payouts.

• Promotion Design Guardrails: per-identity limits, budget caps, unguessable codes, kill switches.

• Withdrawal and Payout Controls: payout-destination uniqueness, cooling-off after destination changes, step-up before first payout.

• Graph Analytics and Machine Learning Models for ring detection. Consortium and Data Sharing across retail partners where contracts allow.

• Can one person earn the same welcome bonus twice with a new email and phone?

• Does a retailer refund ever reverse a reward already paid out?

• Can you find every account paid out to the same gift card or bank in one query?

• Does every new offer have a budget cap and a kill switch before launch?

Members: Playbook - Receipt and Offer Fraud Members, Playbook - Referral Abuse Members, Playbook - Sign-Up Bonus and Promo Abuse Members, Playbook - Multi-Accounting and Linkage Members, Playbook - Business Logic Exploit Response Members, Playbook - Payout and Withdrawal Risk Members.

Notable public cases

• Case Study - Talens Counterfeit Coupon Scheme (2020): a Virginia Beach operation that sold counterfeit manufacturer coupons nationwide from 2017 to 2020. The Coupon Information Center bought samples, confirmed them as counterfeit and referred the case to postal inspectors. Losses were about $31.8M. The leader was sentenced to 12 years in 2021.
• Case Study - Pinduoduo Coupon Exploit (2019): a promo logic flaw let users claim discount vouchers at scale over one weekend. Early reports said "tens of millions" of yuan. The company later put its actual loss at under ¥10M and dismissed far larger rumored figures. Either way, the budget drained within hours.
• GenAI receipt fraud (expense platforms, 2025–2026): AppZen data reported by trade press showed AI-generated images rising from 0% to about 71% of flagged fake receipts in roughly 14 months. Expect the same curve in cashback.
• Loyalty ATO and insider incidents compiled in EY's 2025 loyalty fraud report: mass redemptions of airline miles, insider point manipulation at a grocer, and logic-flaw gift card redemptions.
• Adjacent: Case Study - Chase Infinite Money Glitch (2024) shows how viral social-media "hacks" spread incentive and provisional-credit abuse in days.

Sources and further reading

• American Banker: How Cardlytics is changing card-linked offers: merchant and manufacturer funding, statement-level data, revenue split with banks
• PaymentsJournal: What makes card-linked offers work?: merchant-funded debit rewards; SKU-level receipt data plus card data
• DOJ EDVA: Virginia Beach couple sentenced in $31 million coupon fraud scheme: scheme period, CIC role, losses, sentences
• ASIS Security Management: Paper trails: tracking coupon fraudsters: reconciliation lag, bot code testing, Inmar stacking survey
• Sixth Tone: E-commerce app loses tens of millions from coupon glitches: Pinduoduo 2019 incident, early loss reports
• Caixin: Pinduoduo reports theft worth millions of yuan: company's under-¥10M loss statement
• PYMNTS: AI-generated fake receipts now make up 71% of expense fraud: AppZen trend data and sample size
• EY: Loyalty system fraud report (2025): unredeemed points value, loss estimates, detection time, fraud types, controls
• Fintech Business Weekly: Fighting fraud with SentiLink: PayPal's 4.5M illegitimate accounts tied to incentive campaigns
• Ravelin: Why is promotion abuse a problem?: merchant survey on rising promo abuse (vendor source)
• CFPB Circular 2024-07: credit card rewards programs: revocation under vague terms, devaluation
• Morgan Lewis: CFPB revokes guidance in sweeping rollback: Circular 2024-07 not withdrawn as of May 2025
• FTC: Tapjoy order on undelivered game rewards (Jan 2021): undelivered rewards treated as deception; complaint investigation duties
• CFPB Regulation E § 1005.20 and § 1005.2: gift card rules and the loyalty/promotional card exclusions
• Robinhood referral program terms: public example of settled-activity requirements, holding periods, caps and abuse provisions