Discounts are deeply embedded in online shopping, with nearly 60% of US consumers using digital coupons. But promotions are only successful when the cost of the incentive pays off in lifetime value. Promo abuse extracts the discount and instead of delivering customers, produces fake accounts, self-referrals, and automated redemption campaigns that can drain budgets and inflate acquisition metrics.

Below, we’ll explain how promo abuse works at the account level, how to detect promo abuse, and how to build controls that stop abuse without hurting conversion for legitimate users.

Highlights

• Promo abuse typically exploits weak identity verification at signup. For that reason, new account fraud and promo abuse are often part of the same problem.

• Detection relies on combining signals such as device clustering, disposable email patterns, and abnormal redemption timing.

• Effective prevention uses layered controls and risk-based friction to better detect fraud while keeping the signup flow open for genuine customers.

What is promo abuse?

Promo abuse is the exploitation of discounts, referral bonuses, or signup incentives beyond their intended terms. This usually happens through fake accounts, automation, or identity manipulation. It could look like someone creating five accounts to claim a first-order discount five times, referring themselves through a second email address to collect a referral credit, or scripting the entire process and draining a campaign in hours.

How does promo abuse affect the return on promotional spend?

The incremental revenue from customers acquired through the promo should exceed the cost of the discount plus the cost of running the campaign. Abuse degrades both sides of that equation.

Here’s how to measure the effects of promo abuse:

• Redemption-to-purchase rate: Look at what share of accounts that redeemed the promo made at least one real purchase. Abuse-heavy cohorts show low conversion to real transactions.

• Repeat-purchase rate at 30/60/90 days: Real customers return to purchase more, while fake accounts disappear.

• Referral graph density: In referral programs, track how many referred accounts go on to refer others. Organic referral trees deepen over time; abuse-generated ones remain flat.

• Device and IP overlap rates within the promo cohort: High overlap can signal coordinated creation.

How does promo abuse connect to new account fraud and free trial abuse?

Promo abuse sits inside a broader cluster of behaviors that all exploit the same weakness. Whether the goal is promo redemption, money laundering, or account-takeover setup, any scheme that uses fake or stolen identities to open accounts qualifies as new account fraud, and promo abuse is a common expression. Similarly, free trial abuse might look like someone who creates a new account every time their trial expires instead of converting. While they might have a different incentive from a promo abuser, they’re still using the same mechanism.

Infrastructure that lets someone farm referral credits can just as easily let them create fake accounts for free-trial harvesting, or worse. A promo abuse problem often signals weaknesses in your account creation flow that extend beyond promos. Addressing promo abuse in isolation can leave you exposed to workaround attacks. More than the promo endpoint, you need to close the underlying identity gap.

What promo abuse tactics are common at account signup?

Promo abuse at signup typically follows a set of standardized patterns.

Look out for the following tactics:

Multiple account creation

This is the simplest form of promo abuse. One person creates several accounts using different email addresses to claim a new-user offer multiple times. This works wherever new-account eligibility is checked only against email address, with no deeper identity verification.

Referral self-dealing

Referral programs that pay the referrer a bonus create a direct financial incentive for self-referral. The attacker creates a second account, refers it from their primary, and collects the reward. Programs with two-sided bonuses can mean double the yield per fake account created.

Promo stacking

Businesses might allow multiple codes on a single order. Attackers find and combine codes through code enumeration or leaked or shared code lists to push a transaction toward zero cost or, if your system issues store credit, negative cost.

Automated redemption

More sophisticated attackers might script the signup and redemption flow. A campaign meant to run for a week can be drained in hours.

Code sharing and public leakage

Promo codes posted to coupon aggregator sites or shared on social channels get redeemed far beyond their intended audience. This isn’t always malicious, but it can undermine targeting and exhaust the budget meant for a specific cohort.

What detection signals indicate promo abuse is happening?

Detection works by combining signals that distinguish synthetic or repeat identities from genuine new users.

No single signal is conclusive, but the following signals seen together often indicate potential abuse:

Device and network clustering

Multiple accounts created from the same device, Internet Protocol (IP) address, or subnetwork in a short window are strong signals. Two accounts from the same household IP isn’t unusual, but 15 accounts from the same IP in 48 hours would be something to investigate.

Alias and disposable email patterns

Some email providers allow address aliasing (e.g., user+tag@domain.com), which lets attackers generate unique-looking addresses that all route to one inbox. Disposable email domains can appear disproportionately in abusive signups compared with organic ones.

Suspicious referral graphs

Organic referral trees tend to have branches: one person refers a few friends, some of whom refer others. Abuse produces star-shaped graphs: one account refers many, but those referred accounts show no further activity and redeem immediately after creation.

Abnormal redemption timing

Accounts that redeem a promo within seconds of creation or that were created in coordinated batches behave differently from real customers. Real users might explore, hesitate, or take days between signing up and their first purchase.

Velocity around promo launch

A spike in account creation immediately after a promo is announced warrants closer examination.

Device fingerprint inconsistencies

Mismatches between reported user agent, screen resolution, and installed fonts can indicate automation or fingerprint spoofing. Real users typically don’t have these inconsistencies.

How do prevention controls for promo abuse work without blocking legitimate users?

Eliminating all abuse is challenging, and often is not possible. The goal is to make abuse expensive enough that the return on investment (ROI) disappears.

Redemption throttles and eligibility rules

Limit promo codes to one per verified identity, not one per email address. What counts as verified depends on your risk tolerance: a confirmed phone number, payment method check, or verified address.

Device and identity risk scoring at signup

Tools that score new accounts at creation, based on device fingerprint, IP reputation, email domain risk, and behavioral signals, let you apply differential treatment. Low-risk accounts can access the promo easily; high-risk accounts might need additional verification before the promo activates. Tools such as Stripe Radar apply this kind of scoring within payment flows, and its rules engine lets you write custom logic around redemption events.

Progressive challenges for high-risk cohorts

Rather than blocking suspicious accounts outright, require a real purchase before the promo credit releases. This converts abuse-motivated signups into real customers or no-cost abandonment.

Rate limiting on promo endpoints

If your promo code validation runs via an application programming interface (API) call, that endpoint needs rate limiting and anomaly detection.

Clearer terms, enforced technically

“One per customer” is meaningless if you don’t define and enforce what “customer” means in your system. Encode eligibility rules so they’re checked automatically, rather than manually reviewed after the fact.

How Stripe Radar can help

Stripe Radar uses AI models to detect and prevent fraud, trained on data from Stripe’s global network. It continuously updates these models based on the latest fraud trends, protecting your business as fraud evolves.

Stripe also offers Radar for Fraud Teams, which allows users to add custom rules addressing fraud scenarios specific to their businesses and access advanced fraud insights.

Radar can help your business:

• Prevent fraud losses: Stripe processes over $1 trillion in payments annually. This scale uniquely enables Radar to accurately detect and prevent fraud, saving you money.

• Increase revenue: Radar’s AI models are trained on actual dispute data, customer information, browsing data, and more. This enables Radar to identify risky transactions and reduce false positives, boosting your revenue.

• Save time: Radar is built into Stripe and requires zero lines of code to set up. You can also monitor your fraud performance, write rules, and more in a single platform, increasing efficiency.

Learn more about Stripe Radar, or get started today.