How to stop promo code and referral abuse in SaaS
Leaked promo codes and self-referral loops can drain a SaaS budget overnight. How to stop promo code abuse and referral abuse without killing your campaigns.
A promo code is a promise: this discount, for this person, once. A referral program is a bigger one: we'll pay you for every real customer you bring. Both are built on the assumption that each claim comes from a different person. Promo code abuse and referral abuse are what happens when that assumption breaks, and they break fast.
A launch code posted on a deal forum at night can be redeemed thousands of times by morning, often by the same handful of people over and over. A referral program that pays credits or cash per sign-up can be farmed by one person inviting themselves, account after account, while your team is asleep. By the time anyone looks, the campaign budget is gone and the "growth" in your dashboard isn't real.
From our early beta
After a launch went viral on X, one team gained 6,400 new users in a month. 2,700 of them were duplicate accounts. About 32 became paying customers.
How promo codes get abused
- Repeat redemptions. The same person redeems a "new customers only" code on account after account.
- Leaked codes. A code meant for a partner audience ends up on coupon sites and deal forums, and spreads overnight.
- Stacking. A code meant once gets used alongside a trial, a referral bonus and another code, on fresh accounts each time.
The code itself isn't the problem. The problem is that nothing checks who is redeeming it.
How referral programs get abused
Self-referral is the classic loop. One person refers their own new accounts and collects the reward every time.
Every new account collects the referee bonus, and every one of them pays the referrer too. When rewards are cash, credits or payouts, that money is gone the moment it's granted. Credits are consumed, payouts are withdrawn, and none of it comes back.
Protect each reward as its own benefit
In AbuseZero, every promotion and every reward is a benefit, checked before it's applied.
| Reward | Benefit setup | When to check |
|---|---|---|
| Promo code or launch discount | One benefit per campaign, eligibility once ever | Before applying the discount |
| Referee signup bonus | Once ever, Strict, bot check required | Before granting the bonus |
| Referrer reward | Paid only when the referee's own claim is allowed | After the referee's evaluation |
| Seasonal promotion | Once per rolling window, such as 365 days | Before applying the offer |
The referrer rule is the one that breaks self-referral loops. If the new account's own bonus claim is denied as a repeat, the referral that produced it doesn't pay out either.
Campaigns that only reach new customers
Check every redemption against everyone who already claimed, before the discount or reward is applied. Start with Builder or see pricing.
Settings we'd start with
- Protection level: Strict for referral rewards and large discounts, Balanced for small promotions. See protection levels.
- Automation: deny scripted claims and require AbuseZero's bot check on referral and promotion benefits. Scripted sign-ups are how referral loops scale. See AI agents are claiming your free trials.
- Identifiers: send everything you have, including a payment fingerprint when the offer involves checkout. See $1 trial abuse for the payment pattern.
- History: import past redemptions, so people who already used a code are known from the first evaluation.
Catch a wave while it's happening
Promo abuse comes in waves, and the worst ones start at night. Two things help you see them as they happen instead of in next month's invoice:
- Alerts on denials. Send denied evaluations for your promotion benefits to an alerting channel with a webhook endpoint set to denied evaluations only. A sudden spike is your signal that a code has leaked. See AbuseZero webhooks.
- The association graph. For any evaluation, the association graph shows the earlier claims it connects to and which kind of identifier connects them, so you can see how far a cluster reaches.
Frequently asked questions
How do I stop people using a promo code more than once?
Make the promotion a benefit with an eligibility of once ever, and evaluate every redemption before you apply the discount. AbuseZero checks the redemption against everyone who already claimed, across new accounts and emails.
How do I prevent self-referral abuse?
Protect the referee's bonus as a strict benefit, and pay the referrer only when the referee's own claim is allowed. A denied repeat account then earns nothing for either side.
What happens when a promo code leaks?
Every redemption is still evaluated, so people who already used the offer meet the same check through every new account. Watch denied evaluations through a webhook to spot the leak early.
Should referral rewards wait until the referee pays?
That's your business rule, and many programs do it. AbuseZero adds a check before any reward: whether the referee's claim should be granted at all.
Make every campaign count
Start with Builder
Pay as you go. Protect your next campaign.
See pricing
Builder, Pro, Scale and Enterprise.
Talk to us about Enterprise
Large campaigns and custom terms.