Coupon abuse: how to stop promo code and sign-up bonus abuse

Common forms of promo abuse

Each of these looks like a new customer on its own. The connection only shows when you compare devices.

• First-order coupons redeemed by new accounts created on the same device.
• Sign-up bonuses or free credits collected by repeat registrations.
• Self-referrals: the inviter opens their own invite link in another browser or a private window.
• Referral rings: a few devices inviting each other in a loop.

Limit coupons per device, not per account

A per-account limit does nothing when accounts are free to create. Treat each coupon or bonus as a claim kind and allow one claim per device and per normalised email, with a per-network cap and a human check for first claims. When an order is refunded, give the claim back so the customer can use it again later.

Check codes on the server, at redemption

Validate the code in the same backend call that applies the discount, after the browser has sent a fresh device attestation. A check that only runs in the page, or only when the code is typed, is skipped by anyone who calls your API directly.

Leaked codes on coupon sites are a separate problem: per-device limits stop one person using a public code many times, but not many different people using it once. Use single-use codes or per-customer codes when that matters.

Referral bonuses

Referral rewards are abused differently: the inviter signs up again as their own invitee. The fix is to compare the invitee's device with the inviter's devices, covered in the referral fraud guide.

Referral fraud: how to detect and prevent it →

Coupon abuse prevention with FingerPrint Checker

Each coupon, first-order discount or sign-up bonus is a claim kind on the eligibility API, with its own limits per device, per email and per email domain. The answer is allow, deny or a human check, a claim can be given back on refund, and every account starts with 2,000 free checks.

Frequently asked questions