Referral and coupon fraud controls should evaluate the benefit claim, not just the text of the code. Define who may receive a reward, connect the claim to qualifying activity, and delay irreversible payouts until the relevant conditions are met. Account relationship signals can help reviewers examine repeated or self-referred claims.
Distinguish a code from an entitlement
A public campaign code may be used by many eligible customers. A referral code identifies a relationship or acquisition route. Neither necessarily proves that a particular claimant is entitled to a discount or that the referrer has earned a reward.
Stripe’s coupon documentation distinguishes the underlying discount from a customer-facing promotion code. Available restrictions can narrow how a code is redeemed. Your own program may still need to evaluate customer relationships, qualifying purchases, returns and reward eligibility.
Write the offer rules before choosing signals. State whether the reward belongs to a person, a business, a household or an account. Define the qualifying event and when it becomes final. These details determine whether two related accounts represent abuse or an ordinary customer relationship.
Create a claim ledger
Keep the campaign, referrer, claimant, benefit, qualifying event and current claim state together. Use stable internal identifiers rather than email alone. An investigation should be able to follow a reward from invitation to signup, purchase, qualification and payout without assembling separate spreadsheet exports.
| State | Meaning | Reversal rule |
|---|---|---|
| Claimed | A customer requested the benefit | May be rejected before grant |
| Pending | Qualification or review is incomplete | Can remain on hold with an owner |
| Qualified | The program conditions are met | Record any remaining return window |
| Granted | The discount or reward was issued | Follow the published recovery policy |
| Reversed | A documented condition invalidated it | Preserve the reason and linked event |
The exact states depend on the program. The important property is that a retry or duplicate webhook cannot create a second grant. Make each reward operation idempotent and retain the reference to its qualifying event.
Add context at the relevant point
An account-risk result at signup may help identify a suspicious cluster, but a reward issued weeks later needs current business evidence too. Check whether the qualifying purchase was refunded, whether the referrer controls the claimant and whether an earlier reward already exists.
Shared devices, networks and addresses can be legitimate. A referral among colleagues or family members might be allowed under one program and excluded under another. Review the evidence against the actual offer terms instead of treating a relationship as a universal violation.
Control the irreversible action
Use proportional controls. A small discount may need a low-friction eligibility check; a cash payout may justify stronger review and a waiting period. Assign a person who can release a pending reward and explain an exception. Keep the customer’s ability to use the core product separate from a disputed campaign reward where the policy permits it.
Monitor granted value, reversals, qualified conversions and review effort. Include customers who were incorrectly held. Reward cost saved is only part of the picture if the policy also removes valuable referrals or creates a large support queue.
Build a useful vendor shortlist
ShieldLabs and Verisoul address account relationships and abuse signals. Merchant-oriented platforms such as Ravelin also cover policy-abuse workflows. Confirm which service evaluates the event, which system owns the entitlement and how a reviewer can inspect the evidence.
Use the benefit-abuse hub to compare these choices. If a supplier demonstrates a successful blocked claim, ask to see an allowed shared-environment case and a reversed incorrect decision too. Both are necessary parts of a practical program.
FAQ
Is using a public coupon code fraud?
Not by itself. Eligibility depends on the published offer, redemption restrictions and customer activity.
Can email verification prevent self-referrals?
It can confirm mailbox access. It does not by itself establish whether the claimant and referrer are eligible under the program.
When should a referral reward be paid?
Choose a point that reflects the qualifying event and reversal risk. Explain that timing in the offer and record the event that authorizes the payout.