Home / Knowledge hub / Coupon abuse
Knowledge hub
Coupon abuse
Using a discount code more times, or in more ways, than you intended.
What it means
Coupon abuse is the use of a discount code, credit or promotion in ways the business did not intend: more times than allowed, stacked with other offers, by accounts that should not qualify, or after it has expired. The code is genuine. The rules around it are not enforced.
It is a business-logic problem rather than a technical one. Each request is valid by itself, and the application does what it was told. What is missing is a check that the whole sequence follows your promotion rules, covering how often, by whom, on which items and in what combination.
Why it matters
Direct revenue is lost whenever a one-time offer is used again and again, or a code meant for new customers is claimed by existing ones. Margins on a launch promotion can disappear within a day if a code is shared on a deals forum.
Beyond the money, it spoils your data: you cannot judge whether a campaign worked if abuse inflated the numbers, and genuine customers who paid full price may feel the offer was unfair to them. It often overlaps with trial abuse and referral fraud, which use the same weaknesses.
How it shows up
Typical gaps: a one-use code that can be applied twice if two requests arrive together (a race condition); several codes allowed at once; codes valid for any cart value or product; codes still working after removal of the item that qualified; and new accounts created just to claim an offer.
Enforce limits on the server and record each redemption against the account, order and code. Mark the code spent inside the same database transaction that applies it. Re-check the discount at payment, not just when it is added to the basket. Test by applying, removing and reapplying codes, and by sending the same request at once.
Questions people ask
Coupon abuse, answered
Is coupon abuse fraud?
It can be, when someone knowingly exploits the rules to get what they are not entitled to. Sometimes it is simply a customer using a loophole you left.
Either way the control is the same: enforce the rules on the server.
How do attackers use a code more than once?
By sending the same request many times at once, so every copy passes the check before any marks the code as used. Or by changing the account details, order or case of a code.
Atomic updates on the redemption record stop the first.
Should we limit per account or per person?
Both where you can. Limiting per account is easy to get round by creating new accounts, so combine it with checks on payment method, delivery address or verified phone number.
Choose limits to fit the value of the offer.
Can single-use codes be guessed?
If they are short or follow a pattern, yes. Use long random codes and limit failed attempts, so enumeration is impractical.
Also avoid revealing whether a code exists in your error messages.
How do we test for it?
Apply the same code repeatedly, in parallel, with different carts, after removing the qualifying item, and combined with other offers. Try expired and other customers' codes.
Check the final price at payment each time.
Sources
Where this comes from
Related
Terms that sit next to this one
Trial abuse
Signing up again and again to keep free access without ever paying.
Referral fraud
Gaming a refer-a-friend reward with fake or self-made accounts.
Race condition
Two near-simultaneous actions producing a result neither should allow.
Double spend
Using the same balance, credit or voucher twice by acting faster than your checks.
Business logic flaw
Nothing is technically broken, but your own rules turn against you.
How many times will the code work?
Promotion and redemption logic is part of the business-logic flaws we check, including repeated and simultaneous use of a code. Each finding comes with the exact requests that proved it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.