Each step of promo abuse looks valid on its own, which makes it hard to catch. The abuse shows only when you look across accounts. EY's June 2024 paper on loyalty scheme fraud names policy abuse as one of five common types of loyalty fraud. It cites current estimates of a $1 billion annual loss from loyalty fraud as a whole.
What counts as promo abuse in a loyalty program?
In EY's examples, people create bogus accounts to collect introductory bonuses. They make large purchases to earn points, then return the goods and keep the rewards. They refer customers who do not exist. They cancel and rebook to claim booking perks again. EY notes that such acts are often not clearly illegal. They go against the intent of the program's rules.
That makes the program terms the line between a keen member and an abuser. Marriott Bonvoy's program rules let each person keep only one account, with no shared accounts even within a household. The same rules ban the sale or barter of points. They also let the company cancel points when it believes a member acted in an abusive way. Precise terms give the operator grounds to act.
Why does promo abuse matter to loyalty operators?
The direct loss is the promotion budget. Juniper Research forecasts that digital goods fraud against online merchants will grow from $10.4 billion in 2025 to $27 billion by 2030. It names promo abuse as a key driver. It also finds that the fastest growing attacks look real, with authorized accounts and valid payment details.
The indirect losses last longer. Abused offers inflate sign-up and redemption counts, so a weak campaign can look like a winner. Points held by fake accounts swell the points liability until they are spent or reversed. EY adds that policy abuse is unfair to genuine customers.
What are the most common promo abuse patterns?
- Multi-accounting. One person runs many accounts to claim a welcome or first-purchase offer again and again. The accounts differ by an email alias or phone number but often share a device or card.
- Referral fraud. A member refers fake accounts they control and collects both sides of the reward. In a ring, members refer each other in turn.
- Coupon stacking and leakage. Stacking combines offers the rules meant to keep apart. Leakage is a code meant for one person or partner audience that lands on a public deal site. Imperva's 2025 Bad Bot Report also lists coupon guessing among the attacks bots run against APIs.
- Reseller bots. Scripts open accounts in bulk to claim sign-up credits or buy limited promo stock for resale. Imperva counts lost revenue from bots that exploit new account promotion credits, points among them. It found that bad bots made up 37% of all internet traffic in 2024.
- Buy, earn, return. A member buys enough to trigger a bonus threshold, then returns the goods and keeps the points.
- Trial cycling. In a paid program, members open new accounts to restart a free trial of the paid tier.
What are the warning signs of promo abuse in your data?
Promo abuse leaves traces in data the program already holds. Read them per campaign.
- Enrollments jump at launch faster than site traffic or store visits. Imperva lists abnormal growth in new accounts as a sign of bot sign-ups.
- Many new accounts share one device or one payment card. Shared delivery addresses point the same way.
- The emails look alike. Many are aliases of one inbox or sit on throwaway domains.
- Accounts claim the bonus and never buy again. Imperva also flags a drop in conversion from new accounts to paying customers.
- One referrer sits at the center of many referees who share a device or an address.
- A code meant for one segment shows up in accounts outside it, or traffic arrives from coupon sites.
- Promo orders come back at a higher return rate than normal orders.
- Bonus points get redeemed within hours, often for gift cards that are easy to resell.
How do you prevent promo abuse without hurting real members?
Design the offer first and detect second. Most promo abuse works because the offer pays out before the program knows who it is paying. Pay later and tie each payout to one identity. Much of the abuse then stops paying.
Every control also costs genuine members something. A household cap blocks the second spouse. A sign-up check loses some real sign-ups. Pending points make the reward feel slower. The table weighs each control against that cost.
| Control | What it stops | Cost to genuine members | Best fit |
|---|---|---|---|
| One bonus per verified phone or email | Casual multi-accounting | An extra sign-up step that some real members abandon | Welcome bonuses |
| One bonus per device or payment card | Multi-accounting at scale | Families who share a phone or card lose the second bonus | High-value bonuses |
| Pay the bonus after the first qualifying purchase | Bot sign-ups and empty accounts | Real joiners wait longer for the first reward | Any enrollment offer |
| Hold points as pending until the return window closes | Buy, earn, return | Members see their points later | Retail with generous returns |
| Unique single-use codes with their own caps for each partner | Leakage to deal sites | Members cannot pass a code to a friend | Targeted, partner and influencer offers |
| Stacking rules and caps in the rules engine | Stacking past the offer's intent | A refused code at checkout feels like an error | Overlapping campaigns |
| Velocity limits and bot checks at sign-up | Reseller bots and scripted sign-ups | A challenge screen for some real users | Limited-stock drops |
| Real-time anomaly scoring with step-up checks | Patterns no rule foresaw | False positives when thresholds are blunt | Large, fast-moving programs |
Apply friction by risk, so a member with years of history never sees the checks a fresh cluster of accounts sees. Review the controls after each campaign.
How do you measure what promo abuse costs?
Count five lines per campaign, then weigh them against what the controls cost.
- Value paid out. Bonus points claimed by flagged accounts, valued at the cost per point. Add discounts at face value.
- Open liability. Points from abuse that no one has spent yet still sit in the liability. Reverse them before they are spent and you get that value back.
- Distorted metrics. Imperva warns that metrics built on bot accounts can lead to poor decisions. Measure campaign lift against a control group of genuine members.
- False positives. Count genuine members you blocked or delayed. Value them at their expected margin and add the support contacts they create.
- Review time. Hours spent on manual case review and appeals.
For illustration, a program offers 1,000 bonus points on a first app purchase. Each point costs one cent to fulfill, so each bonus costs $10. The campaign pays 50,000 bonuses. Link analysis ties 4,000 of them to 600 shared devices and cards, so $40,000 went to abuse. Of those, 1,500 bonuses are still unredeemed, so reversing them saves $15,000.
Now test a stricter rule on the same data. One bonus per payment card would have blocked 3,600 abusive claims and 400 genuine households that share a card. At $25 of lost yearly margin per refused household, that is $10,000 of cost against $36,000 saved. One bonus per device would have blocked 3,900 abusive claims and 2,000 genuine households. That rule saves $39,000 and costs $50,000, so it loses money.
Report the abuse rate per campaign as flagged claims over total claims. Track appeals that end in reinstatement as your false positive rate.
How GRAVTY handles promo abuse
GRAVTY, the Loyalty Juggernaut platform, splits the work between rules and detection. The rules live in GRAVTY Visual Rules, a patented no-code rules engine. That is where the loyalty team writes eligibility rules and caps. A rule can change the day an offer is exploited, with no engineering release. AI-Trust adds real-time fraud and anomaly detection. Its machine-learning models flag odd earn and redemption behavior as it happens. Its scoring models can be tuned for each program.
Loyalty Juggernaut announced a U.S. patent that recognizes its use of AI to combat fraud in loyalty programs in November 2024. For account takeover and the full control set, read the loyalty fraud prevention guide.
Frequently asked questions
Can a loyalty program take back points earned through promo abuse?
Yes, when the program terms give it that right. Marriott Bonvoy's rules let the company cancel a member's points if it believes the member acted in a fraudulent or abusive way. Reverse points that are still unspent first. Value that has already been redeemed is hard to get back.
What is the difference between promo abuse and promo fraud?
Promo abuse bends the program's own rules, while promo fraud uses stolen or fake identities or payment details. A member with five email aliases is abusing a welcome offer. Someone who claims the same offer with stolen cards is committing fraud, and the program can inherit the chargebacks too. Fraud calls for payment and identity checks on top of offer rules.
What is coupon abuse?
Coupon abuse is promo abuse aimed at discount codes. The usual forms are single-use codes that get shared and codes stacked against the rules. Bots also guess predictable codes until one works. Unique codes that expire quickly take the value out of sharing and guessing.
Should a program stop offering welcome bonuses because of abuse?
No, restructure the bonus so it pays after a qualifying purchase. That keeps the acquisition value and removes the reward for empty accounts. Pair it with one bonus per verified identity, and watch the claim rate per device during the campaign.
Who should own promo abuse inside a loyalty team?
The loyalty team should own the offer rules, and the fraud or risk team should own detection. Most abuse exploits how an offer is built, so the people who write offers need to see the abuse data each week. Fraud teams bring device and identity analysis to the table.
How fast should a team respond when an offer is being abused?
Respond the same day, while the campaign is still live. Every hour a gap stays open adds payouts, and a method that works for one abuser can be shared with others. Tighten the rule first, then review the flagged accounts and reverse what you can.