Marketing teams call it a growth budget. Fraud rings read it as a bounty program: every referral bonus, first-order coupon, and signup credit is a price list for fake accounts. Promo abuse rarely shows up in a chargeback report, because the "customers" pay or never pay at all, so it quietly drains campaigns while the dashboards report acquisition success. This guide covers how promo abuse actually operates, why it has become an organized and tooled-up business, and the network signals that expose it. The one thing a thousand fake customers struggle to fake is a thousand clean network locations.
What counts as promo abuse
The label covers several distinct schemes, and they call for different responses:
| Scheme | How it works | Typical target |
|---|---|---|
| New-customer coupon farming | One operator creates repeat "first" accounts to reuse intro discounts | Ecommerce, delivery, subscriptions |
| Referral rings (self-referral) | The same operator controls referrer and referee; every fake signup pays a bonus twice | Marketplaces, fintech, gig platforms |
| Signup / bonus farming | Mass account creation to harvest credits, welcome bonuses, or airdrops | Fintech, iGaming, crypto |
| Code enumeration | Bots brute-force guessable voucher codes until valid ones respond | Any site with short or sequential codes |
| Stacking & glitch exploitation | Combining codes or exploiting redemption logic beyond intended limits | Retail checkout flows |
| Loyalty and points farming | Fake or automated activity to accumulate redeemable points | Airlines, hotels, retail loyalty |
OWASP catalogs the automated versions of these in its Automated Threats to Web Applications project. OAT-002 Token Cracking is the "mass enumeration of coupon numbers, voucher codes, discount tokens," and OAT-019 Account Creation covers bulk account creation "for subsequent misuse". Nearly every promo abuse scheme is built on these two primitives.
Why promo abuse is scaling now
Promo abuse used to be a leaky-bucket problem: some double-dipping at the margins, priced in as marketing waste. Three things changed.
First, the money got serious. Juniper Research projects fraudulent digital-goods transactions will grow from $10.4 billion in 2025 to $27 billion by 2030, a 162% rise, and names promo abuse, alongside synthetic identities and friendly fraud, as a key driver (Juniper Research). And each abused dollar costs more than a dollar: the 2025 True Cost of Fraud study puts the real cost at $4.61 for every $1 of fraud for US retail and ecommerce merchants once labor, investigation, and recovery are counted (The Paypers).
Second, the tooling industrialized. Account-creation bots, anti-detect browsers, aliased email at unlimited scale, and rented residential proxy pools mean one operator can plausibly impersonate thousands of new customers. What used to take a fraud ring now takes a subscription.
Third, incentives themselves got bigger. Gig platforms paying hundreds of dollars per referred driver, fintechs paying cash signup bonuses, and token airdrops worth thousands per eligible wallet turned "pretend to be a new user" into a full-time occupation.
Inside the playbook: how one operator becomes a thousand new customers
The mechanics are consistent across industries, and two well-documented cases show both ends of the spectrum.
The identity-theft end. Between 2018 and 2021, a US-wide ring used stolen identities and falsified documents to mass-create driver accounts on rideshare and food-delivery platforms, then collected the referral bonuses those platforms paid for recruiting new drivers. The ring rented and sold the fake accounts as a product line, and used bots plus GPS spoofing to inflate payouts. Federal prosecutors charged the participants with wire fraud conspiracy and aggravated identity theft; multiple defendants pleaded guilty, including the scheme's leader. That is promo abuse as organized crime.
The pure multi-accounting end. When Layer-2 network zkSync distributed its token airdrop, analysts identified roughly 46,000 sybil wallets that captured about $94.5 million. That is one "user", thousands of times over. Across these sybil hunts, the disqualifying evidence has included wallets funded from one source, identical transaction sequencing, matching browser fingerprints, and, most relevant here, clusters of accounts sharing IP subnets (overview of sybil attacks). No identity theft required; just one operator and industrial account tooling.
Both playbooks share the same weak point. Fake identities are cheap. Fake emails are free. But every account still has to connect from somewhere, and clean, distinct, consumer-grade network locations are the one resource abuse rings cannot mint on demand. They reuse infrastructure, and reused infrastructure is detectable.
The IP signals that surface promo abuse
This is where IP risk scoring earns its keep: the network layer betrays coordination that per-account checks miss.
Shared origin across "different" customers. The bluntest and most reliable signal: multiple new accounts redeeming the same promotion from one IP address, or on IPv6 from one /64 prefix, since a single subscriber typically controls the whole prefix and rotating within it is free. If you only key velocity checks on full IPv6 addresses, a one-person ring looks like thousands of users; keying on the prefix collapses it back into one actor (see rate-limiting and blocking IPv6 by /64).
Datacenter and hosting ranges where consumers should be. Real new customers sign up from residential and mobile connections. Signups arriving from datacenter IP ranges, meaning cloud instances, VPS providers, and hosting ASNs, are scripts until proven otherwise. Connection type and ASN type are the cheapest first-pass filter on promo eligibility.
Anonymization concentrated at the redemption step. VPN, proxy, and Tor flags on ordinary browsing are weak evidence, since privacy tools are mainstream. The same flags spiking specifically on referral submissions and code redemptions are a different story: the operator is rotating exit points to defeat exactly the shared-origin check above.
Residential proxies on fresh accounts. Sophisticated rings rent residential exits so each account arrives on a believable consumer IP. Those pools are detectable because they are reused, rotated, and behaviorally distinct from the households they hide behind, and they are the signature of a ring that has already invested in evading naive checks (see residential proxy fraud detection).
The mandatory caution: shared IPs are normal. Carrier-grade NAT puts hundreds or thousands of legitimate subscribers behind one address. Cloudflare found CGNAT IPs get rate-limited about 3x more often than comparable traffic despite similar bot rates (Cloudflare), and roughly one in four internet users runs a VPN, overwhelmingly for legitimate reasons (Security.org). Shared or anonymized origin is a reason to look closer, not a verdict. A CGNAT flag on the IP should dampen, not amplify, your response to it.
A detection playbook you can ship this week
- Instrument three events, not one. Log the IP and its risk signals at signup, at referral submission, and at code/bonus redemption. Most teams only score signup; most abuse concentrates at redemption.
- Score the referrer and the referee. In a self-referral loop both sides are the same operator. A referrer whose "recruits" cluster on one subnet, one ASN, or one proxy pool is the ring's own bookkeeping, visible in your logs.
- Run velocity per IP and per /64 per promotion. Not globally, but per campaign. Five redemptions of one code from one prefix in an hour is a decision, not a coincidence.
- Gate promo eligibility, not purchases. Datacenter origin, Tor exits, or known-abuse history at redemption should quietly withhold the discount or bonus while letting a full-price sale proceed. Deny the incentive, not the customer. That removes the profit without creating support tickets.
- Send the medium band to verification. A VPN flag alone, or a minor geo mismatch, warrants a step-up such as payment-method verification, a phone check, or the same challenge logic you use for per-action fraud score thresholds, not a silent ban.
- Review clusters, not accounts. Manual review is wasted on one account at a time. Queue groups that share an IP, prefix, or device fingerprint, and adjudicate the ring in one pass.
- Measure cohort quality. Track redemption-to-retention per campaign: a promotion whose redeemers never make a second purchase from the same network is telling you where the budget went.
How GeoIPHub answers it
A single lookup on the redeeming IP returns the promo-relevant evidence in one response: connection_type and asn_type separate residential and mobile consumers from datacenter and hosting origins; the detection block flags VPN, proxy, Tor, and relay traffic with the proxy_type and anonymity_level behind the flag; is_cgnat marks shared carrier addresses so you can suppress false positives instead of amplifying them; and the explainable 0-100 fraud score ships with a recommended_action (allow, review, step-up, or block) plus the exact signals that fired, including exonerating ones, so your promo-eligibility rule can act on reasons rather than a black-box number. Every field is available on the free tier at 1,500 lookups per day, and you can test any IP without an API key before writing a line of integration code.
Where this fits in your fraud stack
Promo abuse is multi-accounting pointed at your marketing budget, which makes it a network-visibility problem before it is a payments problem. The same signal stack defends adjacent doors: the anonymization layer is covered in how VPN and proxy detection works, the account-security side in detecting account takeover and credential stuffing, and the false-positive discipline in detecting anonymized traffic without blocking real customers. Wire the redemption check in first. It is the cheapest place to turn a bounty program back into a growth budget.
Frequently Asked Questions
What is promo abuse?
Promo abuse (promotion abuse) is the exploitation of marketing incentives such as new-customer coupons, referral bonuses, signup credits, loyalty points, and free trials by people who were never the intended recipients. It ranges from one customer creating a second email address to reuse a first-order discount, up to organized rings that operate thousands of fake accounts through proxies and device farms to drain referral and bonus budgets.
Is promo code abuse illegal?
Often it is a terms-of-service violation rather than a crime, which is why platforms handle most of it with detection and account bans. It becomes criminal when it involves identity theft, forged documents, or coordinated deception at scale: US federal prosecutors have charged referral-bonus rings that used stolen identities to mass-create rideshare and food-delivery accounts with wire fraud conspiracy and aggravated identity theft, and defendants have pleaded guilty.
How do people abuse referral programs?
The core move is self-referral through multi-accounting: the same operator controls both the referrer and the 'new customer', so every fake signup pays out a bonus. Rings scale this with disposable or aliased emails, anti-detect browsers, device farms, VPNs and residential proxies to make each account look like a distinct person, and they harvest both the referral payout and the new-customer promotion on each account.
Which IP signals indicate promo abuse?
The strongest network signals are: many 'different' new accounts redeeming the same promotion from one IP address or one IPv6 /64 prefix; signups arriving from datacenter or hosting IP ranges where consumer traffic should be residential or mobile; VPN, proxy, or Tor flags concentrated at the redemption step; and residential-proxy classifications on fresh accounts. Each signal needs context, though. Carrier-grade NAT legitimately puts thousands of real users behind one IP, so combine IP evidence with account and payment signals before acting.
How do I stop promo abuse without blocking real customers?
Act on promo eligibility instead of the account: when risk signals fire, withhold or reverse the discount and bonus rather than rejecting the signup or the sale. Use graduated responses. Allow low-risk redemptions, require verification (payment method, phone, or step-up challenge) in the medium band, and reserve hard blocks for clear cases like Tor exits combined with abuse history. Score both the referrer and the referee, and give shared-IP situations such as CGNAT and campus networks the benefit of the doubt unless other signals corroborate.
