Promo abuse escalates in tiers: casual (code-site leaks eroding margin), systematic (multi-account stacking), and criminal (stolen cards + deep discounts for resale inventory — every order a future chargeback). BFCM promo season invites all three. Controls: single-use codes over blanket codes, eligibility scoping, velocity limits per identity cluster, and treating deep-discount orders with the same screening as full-price ones — discounts don't discount risk.
The three abuse tiers
- Casual: your influencer code hits RetailMeNot; margin bleeds but orders are legitimate. Annoying, not dangerous.
- Systematic: multi-account creation to stack new-customer discounts, aliased emails, referral-loop farming. Margin loss plus a customer base of exploiters.
- Criminal: stolen cards + deep promos to acquire resale inventory cheaply. The card's real owner disputes every order — you lose goods, amount, fee, and rate standing. Deep-discount events are these operators' harvest season.
Tier 3 is why promo periods need *more* screening, not less: the discount attracts exactly the traffic that converts to chargebacks.
Controls that hold
- Single-use generated codes (Shopify supports bulk generation) over one blanket code — leaks self-limit.
- Eligibility scoping: new-customer codes validated against identity clusters (device, address, payment fingerprint), not just email uniqueness.
- Velocity rules: same address/device redeeming multiple 'first-order' codes = review before fulfillment.
- Screen discounted orders at full strength: a 50%-off order still carries 100% of the chargeback. Deep-discount + rush shipping + first order is a classic tier-3 signature.
Aurai Prevent scores promo-period orders with the same outcome-trained model regardless of discount — and its dispute history means a tier-3 identity that burned you in November gets caught retrying in December.
Frequently asked questions
Do discounted orders get disputed more?
Criminally-acquired ones do — stolen-card operators seek deep discounts for resale margin. Screen promo orders at full strength; the discount changes your margin, not your risk.
How do I stop new-customer code stacking?
Validate eligibility against identity clusters — device, address, payment fingerprint — not email uniqueness. Aliased emails defeat email-only checks trivially.
Post reflects public documentation and industry surveys as of the publish date. Win rates and other figures are indicative ranges, not guarantees and not Aurai results; outcomes vary by merchant, evidence, and issuer. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.