Promo Code Abuse
Leaked, shared, stacked, enumerated or misapplied promo codes and offer-eligibility abuse that extract discounts or credits beyond what a promotion was designed to give.
What it is
A promo code is a bearer token for a discount. Whoever presents it gets the value, unless the system binds it to an identity, a basket, a channel or a time window. Promo code abuse exploits the gap between the code's intended audience and scope and what the system actually enforces.
In Ravelin's merchant survey, 53% of merchants reported more promo abuse in the past year (56.5% in digital goods), and 51.1% expected it to rise further. On delivery platforms, Incognia's vendor analysis of Latin American data estimated that 20–40% of monthly transactions use some promotion and about 2% are linked to coupon fraud.
Boundaries:
- Coupon Counterfeiting and Misredemption fakes physical or scannable manufacturer instruments. Promo code abuse uses real codes in unintended ways.
- Sign-Up Bonus Abuse is the special case where the code means "new customer." It's often the most expensive promo by value.
- Business Logic Exploitation covers enforcement that is broken (race conditions, stacking bugs) rather than merely loose.
How it works
Conceptual patterns:
- Leakage and sharing. Codes meant for a segment (influencer audience, win-back cohort, employee, partner) circulate publicly. Sharing isn't always fraud, but it still destroys the promo's economics.
- Enumeration (token cracking). Automated guessing of valid codes. OWASP catalogs it as OAT-002 Token Cracking. Appriss Retail described criminals using bots to test codes across thousands of sites and then selling working codes or using them to buy product (ASIS, 2022).
- Repeat "first-order" redemption. New-customer codes reused across alternate accounts. Incognia's analysis of one delivery customer found about 4% of accounts over three months belonged to multi-accounting users. In one press-reported case, a single user ran about $2,000 in promotions through 400 accounts in a month.
- Stacking. Combining offers that weren't meant to combine. Survey data (Inmar, via ASIS) found 63% of U.S. shoppers had tried to stack offers. Most stacking is policy noise, and the loss concentrates in the outliers.
- Eligibility mismatch. Codes applied to excluded items, categories or channels because the eligibility check is incomplete.
- Promo-then-return. Buying at a deep discount and returning at full value, or returning the paid item in a buy-one-get-one and keeping the free one (ASIS).
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Code validation request | Rate and pattern of attempts; failure ratio; device and session | Throttle, challenge or block enumeration |
| Eligibility check | Account age, prior redemptions per identity or household, basket contents | Is this account and basket eligible? Is the "new" customer actually new? |
| Checkout | Discount size vs. basket; stacking; express shipping; reshipper addresses | Approve, cap or step-up |
| Fulfillment | Shipping address reused across accounts; pickup patterns | Hold or flag clusters |
| Post-order | Returns of promo items; refunds; resale signals | Prorate refunds to the discount actually given; claw back credits |
Promo abuse is mostly a margin loss at the moment of purchase. It becomes a cash loss two ways. First, through return or refund paths that refund more than was paid, or refund the full price on discounted items. Second, through promo credits stored as balances and later paid out or used on resellable goods. Close both: prorate refunds, and treat promo credits as non-withdrawable.
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Public leak of private code | Code intended for a cohort circulates publicly | Influencer, partner, employee, win-back codes |
| Code enumeration | Automated guessing; high failure ratios | Ecommerce, gift card and voucher endpoints |
| First-order multi-accounting | New-customer codes across alternate accounts | Delivery, ride-hailing, DTC retail, subscriptions |
| Loyalty and returning-customer offer farming | Portfolio of "active" accounts kept warm to qualify | Delivery and retail retention campaigns (Incognia) |
| Stacking and combinability gaps | Multiple discounts applied where only one was intended | Ecommerce carts; POS |
| Eligibility gaps | Excluded items, channels or regions not enforced | Marketplaces with complex catalogs |
| Reseller harvesting | Promo-priced goods bought in quantity for resale | High-demand, resellable SKUs |
| Fintech promo codes | Codes granting fee waivers, rate boosts or cash credits | Neobanks, brokerages, P2P (see Sign-Up Bonus Abuse) |
Retail vs. financial. At a delivery app, a code is worth a meal and costs the abuser an email and a device reset. At a neobank or brokerage, a code might be worth a cash credit or rate boost but requires a KYC'd account and a funding source. Retail defenses depend on volume controls and device linkage; financial ones depend on identity quality and funding linkage. On both sides, bind the code to the scarcest resource you can verify.
Where it shows up
- Retail and Ecommerce and delivery platforms: the volume center.
- Online Marketplaces: platform-funded vs. seller-funded promos create different loss owners and different appetite for enforcement.
- Cashback, Coupons and Rewards: code distribution is part of the product. These platforms also see leaked codes appear on their own pages.
- Neobanks and Consumer Fintech and Payments and P2P: codes for cash credits, often combined with sign-up and referral bonuses.
Impact
- Margin erosion and budget burn. Promotions reach the wrong audience or the same audience many times.
- Measurement distortion. Promo-driven acquisition looks great until cohort retention shows the "new" customers were alternates.
- Inventory and fulfillment costs. Reseller harvesting drains stock meant for real customers.
- Collateral. Enumeration traffic loads infrastructure and can also hit gift card and stored-value endpoints (Gift Card Fraud). Losses extend to payment fees, delivery subsidies and support costs (Bureau).
Red flags
- Failed code-validation attempts in bursts; patterned guesses → Automation and Headless Browser Signals, Velocity Signals
- Many accounts per device, address or payment instrument redeeming "first-order" codes → Device Reputation and Linkage, Entity Link Analysis
- Address normalization collapses many "different" addresses into one → Address Risk Signals
- Disposable or patterned emails among promo redeemers → Email Risk Signals
- Promo-heavy baskets concentrated in resellable SKUs; promo items returned → Basket and SKU Anomalies, Dispute and Return History
- Redemption volume on a private code far above its intended audience → Promo and Reward Redemption Patterns
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Promotion Design Guardrails | Non-guessable, single-use, identity-bound codes; explicit combinability; excluded SKUs; redemption caps |
| Prevent | Rate Limiting and Throttling, Bot Management and CAPTCHA | Stops enumeration; generic failure messages |
| Detect | Rules Engine and Graph Analytics | Per-identity and per-household redemption limits; clusters of linked redeemers |
| Detect | Promo monitoring dashboards | Redemption vs. intended audience; leak detection |
| Respond | Reward Vesting and Clawback | Promo credits non-withdrawable; prorated refunds |
| Respond | Code kill-switch | Disable a leaked code quickly without breaking other promotions |
Emerging variants and adversary adaptation
- Device-layer evasion at scale. Incognia reported a sixfold increase in app-cloning tools used on delivery platforms between early 2022 and 2023. Device-only linkage degrades, so compensate with payment, address and behavioral linkage, and bind rewards to verified, scarce attributes (Device Farms and Emulators).
- Leak-to-abuse latency is now minutes. Code-sharing communities and browser extensions spread codes almost immediately. Assume any code that isn't identity-bound is public.
- Promo plus refund combinations. Delivery platforms report refund abuse as a large share of consumer fraud. Promo abuse and false refund claims are often committed by the same accounts (Refund and Return Fraud).
- Likely next: agentic shoppers. Shopping agents that automatically search for and apply codes will push leaked-code redemption up even among legitimate customers, which makes abuse harder to tell from normal behavior. Expect promotions to move toward identity-bound, server-side eligibility (Agentic Commerce Fraud).
Related mechanisms
- Sign-Up Bonus Abuse: new-customer offers
- Referral Abuse: referral codes as promo codes
- Coupon Counterfeiting and Misredemption: physical and manufacturer coupons
- Business Logic Exploitation: when enforcement itself fails
- Multi-Accounting, Fake Account Creation (Bots), Device Farms and Emulators: the scale layer
Real-world examples
- Case Study - Pinduoduo Coupon Exploit (2019). In January 2019, a coupon meant for a narrow promotion (a QR code reportedly obtained illegitimately and shared on social media) spread widely. 100-yuan vouchers were redeemed at scale for phone top-ups and virtual goods. The company put losses below 10 million yuan, against rumors of far more, and Shanghai police opened an investigation (Caixin, Sixth Tone).
- Press-reported delivery cases: one person ran about $2,000 in promotions through 400 accounts in a month (AOL).
Sources and further reading
- Why is promotion abuse a problem for online businesses? (Ravelin): merchant survey: 53% saw more promo abuse; types; unpredictable codes
- Essential guide to promotion abuse on delivery platforms (Incognia): promo usage rates, multi-accounting share, app-cloning growth (vendor estimates)
- Paper Trails: Tracking Coupon Fraudsters (ASIS, 2022): bot code-testing; Inmar stacking and misuse survey; BOGO return abuse
- OAT-002 Token Cracking (OWASP): taxonomy for automated code guessing
- China's Pinduoduo reports theft worth millions of yuan (Caixin, Jan 2019): leaked QR code; losses; police investigation
- Food delivery services struggle with fraudulent order refunds (AOL): multi-account promotion and refund abuse examples