Promo and coupon abuse in Retail & e-commerce

How the attack works

1. The operator identifies a welcome code, referral credit or first-order discount issued through your registration flow. The offer becomes a repeatable source of margin when eligibility is tied mainly to a new email address or account.
2. Disposable identities are used to register multiple accounts. The operator changes email details and network addresses between attempts, presenting each registration as a separate customer entering the acquisition funnel for the first time.
3. The accounts claim the incentive and place qualifying orders. Related device or payment activity may continue across them even though the account records differ. Where referrals are rewarded, the operator can also arrange claims around accounts they control.
4. After an offer is exhausted or an account is restricted, the operator repeats the process with another identity. Repeated returns can make the commercial result worse by separating the incentive claim from a lasting, profitable customer relationship.

Why it gets through

A unique email address is easy to count, but it is not the same thing as a new customer. Eligibility rules attached only to that field let the operator reset their apparent history with each registration. Your acquisition reports can count those resets as growth.

Phone or email bans act on details the operator can replace. IP limits also lose context when requests move across proxies. A control that sees only the current registration cannot readily connect it to earlier claims and purchases made through other accounts.

Discount validation usually checks whether a code can be applied to the current order. That is necessary, but it may not explain who has already benefited through related accounts. Fraud, marketing and support can each see a valid-looking fragment while the repeated claim pattern remains between their tools.

Discount leakage is the direct cost: incentives intended to acquire customers subsidise repeated purchases by the same operator. Redemption volume can look healthy even when the offer is no longer reaching the audience your campaign was designed to attract.

Customer acquisition cost becomes harder to trust when registrations and first purchases include repeated identities. A campaign can appear to bring in more customers while generating less retained demand. Marketing decisions based on that apparent acquisition may compound the spending problem.

Repeat-purchase rate and return rate need the same context. Accounts that disappear after claiming an offer can depress retention measures, while serial returns add fulfilment and support work. The team needs to distinguish incentive exploitation from genuine customers sharing a household, device or payment arrangement.