Promo abuse escalates in tiers: casual (code-site leaks eroding margin), systematic (multi-account stacking), and criminal (stolen cards + deep discounts for resale inventory — every order a future chargeback). BFCM promo season invites all three. Controls: single-use codes over blanket codes, eligibility scoping, velocity limits per identity cluster, and treating deep-discount orders with the same screening as full-price ones — discounts don't discount risk.
The three abuse tiers
- Casual: your influencer code hits RetailMeNot; margin bleeds but orders are legitimate. Annoying, not dangerous.
- Systematic: multi-account creation to stack new-customer discounts, aliased emails, referral-loop farming. Margin loss plus a customer base of exploiters.
- Criminal: stolen cards + deep promos to acquire resale inventory cheaply. The card's real owner disputes every order — you lose goods, amount, fee, and rate standing. Deep-discount events are these operators' harvest season.
Tier 3 is why promo periods need *more* screening, not less: the discount attracts exactly the traffic that converts to chargebacks.
Controls that hold
- Single-use generated codes (Shopify supports bulk generation) over one blanket code — leaks self-limit.
- Eligibility scoping: new-customer codes validated against identity clusters (device, address, payment fingerprint), not just email uniqueness.
- Velocity rules: same address/device redeeming multiple 'first-order' codes = review before fulfillment.
- Screen discounted orders at full strength: a 50%-off order still carries 100% of the chargeback. Deep-discount + rush shipping + first order is a classic tier-3 signature.
Aurai Prevent scores promo-period orders with the same outcome-trained model regardless of discount — and its dispute history means a tier-3 identity that burned you in November gets caught retrying in December.
Frequently asked questions
Do discounted orders get disputed more?
Criminally-acquired ones do — stolen-card operators seek deep discounts for resale margin. Screen promo orders at full strength; the discount changes your margin, not your risk.
How do I stop new-customer code stacking?
Validate eligibility against identity clusters — device, address, payment fingerprint — not email uniqueness. Aliased emails defeat email-only checks trivially.
Post reflects public documentation, industry surveys, and Aurai's own book of disputes as of the publish date. Visa, Mastercard, American Express, Discover, Stripe, PayPal, and Shopify are trademarks of their respective owners; Aurai is independent and not endorsed by any of them. Network rules change — always verify current official rules before acting on any specific tactic.