Promo and referral abuse in Online marketplaces

How the attack works

1. The operator opens the buyer-registration flow through a referral or welcome campaign, creating an account intended to qualify for a marketplace incentive.
2. Further registrations use different contact details and sessions, making one coordinated effort appear to be a series of newly acquired customers.
3. The accounts complete the qualifying actions, such as a first purchase or referral claim, while repeating parts of the same access and checkout sequence.
4. Available rewards are claimed across the account group, including seller incentives where the campaign allows related trading activity to qualify.
5. Once a restriction or campaign limit applies, the operator returns through another account, leaving growth and fraud teams to reconcile apparent acquisition with repeated claims.

Why it gets through

Marketplace promotions are designed to reduce the hesitation of a first transaction. Referral schemes can also reward existing users for introducing buyers or sellers. Those same rules create a repeatable target when eligibility is attached mainly to a new account, while the activity behind successive registrations is assessed separately or only after the reward has been issued.

Different email addresses do not necessarily mean independent customers. An operator can distribute registrations and qualifying actions across sessions so that each account stays within its own allowance. Growth teams may see successful campaign participation while the wider relationship between claims remains outside the reports used to decide whether the promotion is attracting valuable new trading activity.

Shared households and legitimate referrals also create connections between users. Common devices, networks or payment references need to be assessed alongside the campaign’s actual conditions and the activity supplied by the business. The goal is to identify patterns worth investigating, not to turn every relationship between buyers into an automatic judgement that a reward was claimed dishonestly.

Customer acquisition cost becomes misleading when credits fund repeat operators rather than new buyers. The campaign pays for qualifying transactions, yet some of the apparent acquisition disappears once eligibility is examined. Marketing and finance need to distinguish genuinely new customers from repeated claims before deciding whether to increase spending or make a referral reward more generous.

The repeat purchase rate helps expose the difference between incentive-driven registrations and lasting customer demand. Accounts that disappear after collecting a reward can make an initial campaign look successful while contributing little subsequent trading. Review what happens after the qualifying purchase, using the business’s own account and order records rather than registration totals alone.

Promotion-related support tickets increase when repeated claims require manual review or broad restrictions delay legitimate rewards. Teams must explain rejected eligibility, missing credits and requests for additional checks. Track these conversations alongside campaign performance so the cost of abuse includes the service burden, and the response does not make genuine referrals unnecessarily difficult.