The 4 Promotion Campaign Mistakes Fraudsters Feast On

Having a popular promotional campaign is great, because it means you’ve also got a popular product. People eager to sign up for a steep first-time discount might like your product enough to stick around and make full-price purchases, and the more new users your campaign reaches, the more likely you are to find longer-term customers.

Unfortunately, what’s attractive to consumers is often also attractive to fraudsters. Consumers love promo campaigns because they’re easy to claim and use, and fraudsters love them because they’re easy to abuse—in the right circumstances. It’s possible to protect a promotional campaign from abuse by bad actors, but you have to put your guard rails into place before the campaign ever launches. Otherwise, you run the risk of seeing all your marketing team’s hard work—and most of their budget—drain right into a fraudster’s pockets.

Merchant Risk Council hosted a webinar called, “Promotion Abuse Exposed: Protecting Gig Economy and Delivery Platforms,” where industry insider Jaanus Uudmäe of Bolt, Vlad Branin of Gett, and Kyle Griffin of Incognia talked about promo abuse, how to limit it, and some of the campaign planning mistakes that leave a promotion most vulnerable to abuse.

Not having reliable device fingerprinting to identify multi-accounting

If you can’t identify when people are creating new, fake accounts on your platform to claim the same promotions multiple times, you could be flushing your promotion budget down the drain and not even realize it. That’s why having a persistent device fingerprinting solution in place before launching a campaign is paramount—and why not having one could be a big mistake.

In the webinar, Kyle shared an example of a food delivery platform that went ahead with a promotion despite not having the tools in place to protect it from bad actors:

“[In] one specific example, where the fraud team told the marketing team that the campaign they're about to run was going to result in a lot of losses due to promotion abuse that they didn't have the defenses set up for…Marketing team ran the promotion anyway, and then it turned out that they lost about 90 percent of the budget for the promotion campaign. It all went to the fraudsters. The goal of these campaigns is to boost new customer acquisition and then encourage more orders from your existing users. But if the promotions are going to this small group of fraudsters, you're kind of lighting money on fire.”

This fraud team had reason to suspect there would be promo abuse before the campaign launched, but it’s not always the most obvious conclusion. Without device data you can look at for signs of multi-accounting and promo abuse, your marketing team might blame themselves for what’s actually a fraud problem.

In a different webinar with Marketplace Risk, Incognia CEO and co-founder Andre Ferraz told the story of another platform struggling with promo abuse:

“We had a case of a ride-hailing business that was testing our solution, and during the month we ran that, about 60 percent of their referral bonuses were going to existing users. Basically what was going on was, I knew if I invited someone, I would get like an extra $10 for my next ride. I started creating a bunch of accounts on the same device, or even using multiple devices, and basically gaming the system. They were losing over a million dollars per month with this. And they didn't even know. On their side, they thought that the problem was that the users were simply not sticking around, like, ‘Oh, my retention rate is this low.’ No, that's actually fraud. That's the promotion abuse. So we were able to help them fix that.”

When you can reliably re-identify users across accounts, you can limit the multi-accounting that makes widespread promo abuse possible.

Forgetting to pay active attention to campaign metrics

When you have reliable data signals in the place, the next mistake you could make is forgetting to pay close enough attention to them. Like Jaanus Uudmäe pointed out in the MRC webinar, promo abuse is different than some other types of fraud like refund abuse—if you’re not looking for it yourself, it’s all too easy for it to slip under the radar.

As Jaanus explained,

“First, you need to have somebody looking at it. Because the problem with the promotion is abuse is that you are the one who needs to define it. What's promotion abuse? And what's abuse and what's not? If you're talking about payment fraud where you have chargebacks, it's quite easy. You will get the bill from your payment service provider. You know exactly how many chargebacks you have, and then you know the size of the problem, and you can deal with it.

“The problem with promotion abuse is that the fraudster is not going to come to you and say that ‘Oh, you know, I got that promotion, and this is how much fraud is happening.’

So first you need to have somebody monitoring it, you need to have tools monitoring it.”

Without keeping an eye on your multi-accounting numbers, your marketing team might chalk the limited success of the campaign up to churn. When you’re watching the data, though, you can know the full story about where the campaign funds are going.

Not establishing KPIs between marketing & fraud prevention

Sometimes, having acceptable thresholds for how much fraud you’ll tolerate is a good way to limit false positives and ensure that anti-promo abuse measures impact legitimate users as little as possible. Jaanus described Bolt’s approach as being absolutely sure before taking action, even if it means some fraud slips through the gaps:

“We have taken the approach that we want to keep the gates relatively open and make it easy for the good users to get the promotion.

That means that we want to be very sure that this a [fake] account and this is an abuser before we stop them…we're more open to maybe letting some fraud and potential abuse to go through to go for the growth.”

This is a good example of negotiating a balance between fraud prevention and growth tactics. Being too heavy-handed or “ban happy,” on the fraud prevention side can lead to false positives and friction that stifle growth. On the opposite side, being too loose means most of your promotion budget might go to fraudsters instead of converting customers. One of the most important things for achieving this balance is agreeing on metrics for acceptable fraud losses before launching the campaign.

Having no way to stop or limit campaigns once they launch

Sometimes, despite our best efforts, we need to reach for the emergency brake. Not having a way to stop a campaign (or stop an individual from accessing a promotion if they’re suspected of being a bad actor) is a mistake that could cost your platform significantly if things go off the rails.

As Vlad Branin of Gett said during the webinar:

“[You need] the ability as a company to stop the campaign at any time. And to check that the campaign is not an endless campaign, that it's limited and has a cap, and it’s not a runaway campaign.”

Jaanus agreed, saying:

“Make sure that you have talked to the legal team about terms and conditions in place, so, if you run a promotion, you have a nice legal way to back out of it and you can take away somebody's promotional code…People will not be happy about it, and they can complain, but at least then, your customer service can point them to these terms and conditions and say that, yes, we can do that, and we can stop the campaign at any point of time as well.”

When run safely, promotional campaigns can be an excellent tool to supercharge your platform’s growth strategy by encouraging new user sign ups and platform engagement. By learning from the mistakes other platforms have made in the past, you can put guardrails on your promotional campaigns and ensure they’re used in the spirit they were intended.