Saturday, June 21, 2025

Security Boulevard Logo

Security Boulevard

The Home of the Security Bloggers Network

Community Chats Webinars Library
  • Home
    • Cybersecurity News
    • Features
    • Industry Spotlight
    • News Releases
  • Security Creators Network
    • Latest Posts
    • Syndicate Your Blog
    • Write for Security Boulevard
  • Webinars
    • Upcoming Webinars
    • Calendar View
    • On-Demand Webinars
  • Events
    • Upcoming Events
    • On-Demand Events
  • Sponsored Content
  • Chat
    • Security Boulevard Chat
    • Marketing InSecurity Podcast
    • Techstrong.tv Podcast
    • TechstrongTV - Twitch
  • Library
  • Related Sites
    • Techstrong Group
    • Cloud Native Now
    • DevOps.com
    • Security Boulevard
    • Techstrong Research
    • Techstrong TV
    • Techstrong.tv Podcast
    • Techstrong.tv - Twitch
    • Devops Chat
    • DevOps Dozen
    • DevOps TV
  • Media Kit
  • About
  • Sponsor

  • Analytics
  • AppSec
  • CISO
  • Cloud
  • DevOps
  • GRC
  • Identity
  • Incident Response
  • IoT / ICS
  • Threats / Breaches
  • More
    • Blockchain / Digital Currencies
    • Careers
    • Cyberlaw
    • Mobile
    • Social Engineering
  • Humor
Security Bloggers Network Threats & Breaches 

Home » Cybersecurity » Threats & Breaches » How to combat promo abuse, refund abuse, and other types of policy violations

SBN

How to combat promo abuse, refund abuse, and other types of policy violations

by Kevin Lee on September 15, 2022

As summer winds down and fall begins, I am reminded of two things: back to school for my kids and the kick-off of the American football season. Both bring me joy. While these two activities are not connected, they’ve connected in my professional world. Recently, I had the opportunity to speak with some folks from a large online retailer and a sports betting/wagering app. The online retailer just finished with back-to-school sales and was being hammered by a particularly high amount of refunds (even higher than expected). The sports betting app was preparing for the new NFL football season and dealing with a huge spike in new sign-up bonus abuse. 

Although both of these companies were from very different verticals with completely different business models, it struck me how similar the abuse types that they had to deal with were.

As online companies continue to grow and branch out into new business models, many fraud and trust and safety teams have been asked to take on additional types of abuse hitting the system that go beyond dealing with fraudulent orders and chargebacks. This abuse can take many forms: 

Techstrong Gang Youtube
AWS Hub
  • Promo abuse: A person who continues to get $10 off their “first” purchase over and over again.  
  • New sign-up bonus abuse: A person who signs up to get $100 in free bets over and over again.   
  • Refund abuse: A consumer who refunds greater than x% of merchandise. 
  • Referral/affiliate abuse: A partner who repeatedly refers themselves to the platform over and over again to acquire a higher standing or level.       

To keep it simple, I classify all these use cases as different forms of policy abuse. Each business has a specific tolerance when it comes to these things so there’s not necessarily an “industry standard” when it comes to how firm or lenient a company should choose to be. Below I’ll cover the consequences of this type of abuse. In addition, I’ll talk through some effective strategies to combat promo abuse, refund abuse, and other types of policy violations.  

how to combat promo abuse

Consequences of policy abuse

  • Lower customer lifetime value: Most of these “new” users/customers are one and done because there’s only one person behind all those accounts.  
  • Increased customer acquisition cost: Acquiring new customers is difficult (and expensive) for any business. Reducing promo abusers enabled my previous company to reinvest millions of dollars back into the marketing budget. My marketing team was appreciative of this.    
  • Artificially inflates the company’s user base numbers: At first, seeing the rush of new sign ups can be exhilarating. But the aftermath can feel like coming down from a sugar high. For publicly traded companies in particular, this can also create some difficult conversations down the line with investors.       

Best practices on how to fight policy abuse

  • Establish clear policies: Any promotion or bonus should have clear rules on who qualifies for the incentive and who does not. These policies should be documented for both internal and external consumption. Ideally, there should be help center articles and prepared responses ready to go before any sort of incentive program is launched. Clear policies should educate customers to avoid crossing any thresholds. If, however, a user crosses a particular threshold and is upset, the help center article can be a useful tool in helping quell concerns.  
  • Be kind: Oftentimes the people abusing these policies can be loyal and recurring customers, but they just need a little reminder that they should be engaging with the company through one account. When it comes to tone and messaging, try to avoid any accusatory language, but be clear on how users are expected to use the platform.    
  • Strong cross-functional collaboration and communication: Most promotions probably originate from the marketing team, but it’s up to the customer support team and fraud team to support it and enforce it. Having regular check-ins and setting up joint team goals at the beginning of each quarter can help produce stronger results (and fewer headaches!) for all teams involved. 
  • Machine learning vs. rules: Most of these abusers tend to be opportunistic (“I’ll take advantage of it if it’s available”) and not professional fraudsters (“I do this for a living”). As such, the bar to dissuade this abusive behavior tends to be pretty low. Machine learning models should not be the primary option here. Rules should be sufficient. 
  • Link analysis and querying tools: These days, there are various off-the-shelf business intelligence tools that can be used by teams to query data (e.g., Tableau, Snowflake, Looker, etc). Using tools like this, SQL or the Sift Console can help identify policy abusers by shared attributes like IP, device, billing, email, address, number of lifetime refunds, etc.        

If you’d like to learn more specific strategies about how your business can mitigate these types of policy abuse, please request a Trust and Safety Assessment from me or one of my teammates. 

The post How to combat promo abuse, refund abuse, and other types of policy violations appeared first on Sift Blog.

*** This is a Security Bloggers Network syndicated blog from Sift Blog authored by Kevin Lee. Read the original post at: https://blog.sift.com/how-to-combat-promo-abuse-refund-abuse-and-other-types-of-policy-violations/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-combat-promo-abuse-refund-abuse-and-other-types-of-policy-violations

September 15, 2022September 15, 2022 Kevin Lee affiliate abuse, Data & Insights, Digital Trust & Safety, Fraud, promo abuse, promo fraud, promo policy violations, referral abuse, refund abuse, sign up abuse
  • ← The guide to analyzing Kubernetes runtime detection alerts using Amazon Athena
  • How to Start with Mayhem for API →

Techstrong TV

Click full-screen to enable volume control
Watch latest episodes and shows

Tech Field Day Events

Upcoming Webinars

How to Spot and Stop Security Risks From Unmanaged AI Tools

Podcast

Listen to all of our podcasts

Press Releases

GoPlus's Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

C2A Security’s EVSec Risk Management and Automation Platform Gains Traction in Automotive Industry as Companies Seek to Efficiently Meet Regulatory Requirements

C2A Security’s EVSec Risk Management and Automation Platform Gains Traction in Automotive Industry as Companies Seek to Efficiently Meet Regulatory Requirements

Zama Raises $73M in Series A Lead by Multicoin Capital and Protocol Labs to Commercialize Fully Homomorphic Encryption

Zama Raises $73M in Series A Lead by Multicoin Capital and Protocol Labs to Commercialize Fully Homomorphic Encryption

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

RSM US Deploys Stellar Cyber Open XDR Platform to Secure Clients

ThreatHunter.ai Halts Hundreds of Attacks in the past 48 hours: Combating Ransomware and Nation-State Cyber Threats Head-On

ThreatHunter.ai Halts Hundreds of Attacks in the past 48 hours: Combating Ransomware and Nation-State Cyber Threats Head-On

Subscribe to our Newsletters

ThreatLocker

Most Read on the Boulevard

Iran Reduces Internet Access After Israeli Airstrikes, Cyberattacks
Google’s $32 Billion Acquisition of Wiz Draws DoJ Antitrust Probe: Report
Trump’s TikTok Tarry — Yet Again, Ban-Can Kicked Down the Road
Novel TokenBreak Attack Method Can Bypass LLM Security Features
AWS Extends Scope of Cybersecurity Alliance with CrowdStrike
MY TAKE: Microsoft takes ownership of AI risk — Google, Meta, Amazon, OpenAI look the other way
Integrating SCIM with Identity Providers: Your Complete Guide to Okta and Azure AD
How the New HIPAA Regulations 2025 Will Impact Healthcare Compliance
AI Security Guide: Protecting models, data, and systems from emerging threats
Cycles That Drive Cybersecurity

Industry Spotlight

US Pig Butchering Victims ‘Will’ Get Refunds — Feds Seize $225M Cryptocurrency
Analytics & Intelligence Blockchain Cyberlaw Cybersecurity Data Privacy Digital Currency Featured Governance, Risk & Compliance Humor Incident Response Industry Spotlight Mobile Security Most Read This Week Network Security News Popular Post Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Social Engineering Spotlight Threat Intelligence Threats & Breaches 

US Pig Butchering Victims ‘Will’ Get Refunds — Feds Seize $225M Cryptocurrency

June 20, 2025 Richi Jennings | Yesterday 0
Iran Reduces Internet Access After Israeli Airstrikes, Cyberattacks
Blockchain Cloud Security Cybersecurity Data Security Digital Currency Featured Identity & Access Incident Response Industry Spotlight Network Security News Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight Threat Intelligence Threats & Breaches 

Iran Reduces Internet Access After Israeli Airstrikes, Cyberattacks

June 18, 2025 Jeffrey Burt | 2 days ago 0
Trump’s TikTok Tarry — Yet Again, Ban-Can Kicked Down the Road
Analytics & Intelligence Cloud Security Cyberlaw Cybersecurity Data Privacy DevOps Endpoint Featured Governance, Risk & Compliance Humor Industry Spotlight Mobile Security Most Read This Week Network Security News Popular Post Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Social Engineering Spotlight Threat Intelligence Threats & Breaches 

Trump’s TikTok Tarry — Yet Again, Ban-Can Kicked Down the Road

June 18, 2025 Richi Jennings | 2 days ago 0

Top Stories

Google’s $32 Billion Acquisition of Wiz Draws DoJ Antitrust Probe: Report
Cybersecurity Featured News Security Boulevard (Original) Social - X Spotlight 

Google’s $32 Billion Acquisition of Wiz Draws DoJ Antitrust Probe: Report

June 19, 2025 Jon Swartz | 1 day ago 0
AWS Makes Bevy of Updates to Simplify Cloud Security
Cloud Security Cybersecurity Featured News Security Awareness Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Spotlight 

AWS Makes Bevy of Updates to Simplify Cloud Security

June 18, 2025 Michael Vizard | 3 days ago 0
U.S. Moves to Collect $7.74 Million Tied to N. Korea IT Worker Scam
Cloud Security Cybersecurity Data Privacy Data Security Featured Identity & Access Network Security News Security Boulevard (Original) Social - Facebook Social - LinkedIn Social - X Social Engineering Spotlight Threat Intelligence 

U.S. Moves to Collect $7.74 Million Tied to N. Korea IT Worker Scam

June 17, 2025 Jeffrey Burt | 3 days ago 0

Security Humor

A pig in a muddy farm field

US Pig Butchering Victims ‘Will’ Get Refunds — Feds Seize $225M Cryptocurrency

Download Free eBook

The State of Cloud Native Security 2020

Security Boulevard Logo White

DMCA

Join the Community

  • Add your blog to Security Creators Network
  • Write for Security Boulevard
  • Bloggers Meetup and Awards
  • Ask a Question
  • Email: [email protected]

Useful Links

  • About
  • Media Kit
  • Sponsor Info
  • Copyright
  • TOS
  • DMCA Compliance Statement
  • Privacy Policy

Related Sites

  • Techstrong Group
  • Cloud Native Now
  • DevOps.com
  • Digital CxO
  • Techstrong Research
  • Techstrong TV
  • Techstrong.tv Podcast
  • DevOps Chat
  • DevOps Dozen
  • DevOps TV
Powered by Techstrong Group
Copyright © 2025 Techstrong Group Inc. All rights reserved.
×