Catching Coupon Abuse

Coupon abuse comes in several flavors — repeat first-order coupon use across throwaway accounts, coupon-then-refund cycles to extract free value, deal-site coupon code leaks producing acquisition cohorts of unprofitable customers. This walkthrough shows how to identify all three patterns with TrustLens and stop them at scale.

---

The Three Patterns #

Pattern	Signature	Detection
Throwaway-account coupon hunting	Many accounts with slight email variations, all using new-customer coupons, often shared shipping	Coupons + Linked Accounts modules
Coupon-then-refund	Apply coupon, complete order, refund — repeat	Coupons module tracks the cycle
Deal-site code leak	One coupon code suddenly used by hundreds of unrelated customers	WooCommerce’s coupon usage counts — TrustLens has no per-code report

---

Pattern 1: Throwaway-Account Hunters #

Identify Existing Hunters #

1. Open TrustLens → Customers and filter to the Caution, Risk, and Critical segments
2. Open each profile and check the Linked accounts panel — which other accounts share an address, phone, or payment method
3. Check the Signal impact panel for coupon signals (“First-order coupon abuse pattern”, “coupon orders refunded”)
4. Linked accounts that each used a first-order coupon are the hunters

On Pro, an automation rule can do the sorting for you: a rule on the Linked Accounts Detected trigger with conditions First-Order Coupons ≥ 1 and Linked Accounts ≥ 2, and an Add Tag action, tags candidates as they appear. When TrustLens detects linked accounts whose combined first-order coupons exceed Max first-order coupons (default 2), it also logs a “multi account coupon abuse” event on the customer’s timeline.

Block the Pattern at Checkout #

Enable the linked-account coupon block (Pro):

1. Settings → Detection → Coupon Abuse Detection
2. Turn on Block checkout when a linked account has used first-order coupons
3. Save

Now, at checkout, if a shopper applies a first-order coupon — a code containing words such as “welcome”, “first”, or “new”, or one limited to a single use per customer — and shares an address, phone number, or payment method with an account that has already used a first-order coupon, the coupon is refused with “This coupon cannot be used. Please contact support if you believe this is an error.” The address and phone being typed at checkout are matched too, so a first-time shopper is covered. The customer can still complete checkout — just not with the discount.

Caveat #

This setting can produce false positives on shared-household addresses. Run it for a week and watch for support contacts about refused coupons — a refused coupon doesn’t send a Blocked Checkout Alert. If complaints come in, allowlisting doesn’t exempt a customer from this check, so consider giving the household a coupon code that doesn’t look like a first-order code.

---

Pattern 2: Coupon-Then-Refund #

Identify #

The Coupons module tracks a coupon_then_refund counter per customer. The Customers list has no column for it, so find offenders through their scores:

1. Open Customers list and filter to the Caution, Risk, and Critical segments
2. Open profiles and look for “coupon orders refunded” in the Signal impact panel
3. Investigate the customers with the largest counts

The Coupons module subtracts 5 points for one coupon-then-refund cycle, 15 for two, and 25 for three or more, plus 10 more when the customer also used a first-order coupon. Combined with Returns signals from the underlying refunds, these customers typically land in Risk.

Take Action #

For confirmed offenders:

• Block at checkout
• Add admin note documenting the pattern
• Consider tightening the affected coupon’s per-user usage limits

Automate (Pro) #

Build an automation rule:

• Trigger: Refund Processed
• Conditions: Coupon Then Refund >= 2
• Action: Block Customer (and a second rule with the same trigger and condition and a Send Email Notification action to alert the fraud team — each rule has one action)

This catches the cycle automatically and stops the pattern before it becomes a fourth or fifth.

---

Pattern 3: Deal-Site Coupon Leak #

Identify #

A leaked coupon shows up as anomalous usage volume on a single code. TrustLens doesn’t report usage per coupon code; check the usage count on Marketing → Coupons (or WooCommerce Analytics → Coupons) — if WELCOME15 is suddenly used far more than usual, your code is on a deal site.

Confirm #

Google the coupon code. If it appears on RetailMeNot, Honey, Slickdeals, or similar, it’s been leaked.

Take Action #

1. Disable the leaked coupon in WooCommerce Coupons settings
2. Create a new coupon code with stricter restrictions (per-user usage limit 1, customer-email-domain restrictions, expiration)
3. Review customers who used the leaked code over the past 30 days — many will have abuse signals; consider mass action
4. For customers who used the leaked code and are now in Risk: bulk block

Prevent #

• Use unique per-customer coupon codes for promotions (random codes that can’t be shared)
• Set per-user usage limit to 1 on all new-customer coupons
• Add expiration dates to all promotional codes
• Audit your active coupons quarterly — disable old codes

---

Setting Up the Coupon-Abuse Workflow #

Step 1: Tune Coupons Module Settings #

1. Settings → Detection → Coupon Abuse Detection
2. Set Max first-order coupons (default 2) — how many first-order coupons a customer and their linked accounts can use between them before TrustLens logs multi-account coupon abuse
3. Turn on Block checkout when a linked account has used first-order coupons (Pro) after a week of observation

Step 2: Enable the Coupon Abuse Notification #

If you’re on Pro, build a custom automation rule that watches coupon abuse via the score/segment lifecycle: use a score_updated or segment_changed trigger with a condition on the coupon_then_refund field (there is no dedicated coupon trigger — coupon abuse surfaces through the trust score, which these triggers fire on).

Step 3: Weekly Review Routine #

Add a recurring 15-minute calendar block:

1. Check coupon usage counts in WooCommerce for unusual spikes
2. Review new Caution / Risk / Critical customers on the Customers list for coupon signals
3. Review customers tagged by your coupon automation rules (Pro)
4. Investigate anomalies

---

What to Expect #

• First month: surge of detection as historical patterns surface
• Subsequent months: steady-state catches of new patterns as they emerge
• Customer acquisition cost may rise slightly as throwaway-account growth drops — that’s the goal
• Genuine new customers using welcome codes are unaffected (first use is fine)

---

Metrics to Track #

• First-order coupon usages per month (declining = throwaway accounts dropping off)
• Coupon-then-refund cycles per month (target: near zero after rollout)
• Coupon revenue / refund ratio per code (catches abused codes specifically)
• Customer acquisition cost from coupon-driven channels

---

Common Pitfalls #

• Over-blocking households: Address-linked household accounts using welcome codes can look identical to throwaway accounts. Allowlist confirmed legitimate households so their scores aren’t affected.
• Penalizing returning customers: A customer who used your welcome code once and returns months later shouldn’t be penalized. A first-order coupon on its own carries no penalty; the Coupons module only scores it alongside a coupon-then-refund cycle.
• Ignoring leaked codes: If a code is on a deal site, every additional use is bad-faith. Disable promptly.