Most discount abuse does not look like fraud. It looks like a normal order that quietly cost you more than it should have.
Discount abuse prevention starts with a reframe: the problem is rarely a criminal with a stolen card. It is ordinary customers using your promotions in ways you did not intend, at a scale you did not model. Over enough orders, that gap between intended and actual use becomes a real line in your margin. This is a guide to the six patterns we see most often in Shopify order data, and how to shut each one down.
None of these require fraud tooling. They require reading your orders with the right questions and configuring discounts so the loophole never opens.
1. The leaked code
You send a 20% code to your email list. Within days it is on three coupon aggregator sites, and now every price-sensitive shopper who was going to buy anyway pastes it at checkout. Your targeted offer became a sitewide discount you never approved.
The tell is concentration: one code showing up on far more orders than the audience you sent it to. The fix is structural. For offers that do not need attribution, use an automatic discount that applies based on cart contents or customer tag rather than a word someone can copy. There is nothing to paste into a coupon site. Reserve typed codes for influencer and campaign tracking, and cap their usage.
2. The self-referral
Referral programs assume the referrer and the referred are two people. Some customers notice they do not have to be. They refer themselves through a second email, claim both the referrer reward and the new-customer discount, and repeat.
In the data this looks like new-customer orders clustering on a shared address, payment method, or device. The fix is to exclude the referrer's own account from redeeming their link, and to treat the new-customer discount as a segment (customers with zero prior orders) rather than an open code anyone can trigger again from a fresh inbox.
3. Unplanned stacking
This one is not the customer's fault at all. Two discounts you never intended to combine, a volume tier and a welcome code, resolve together in the cart and the effective discount lands far below either headline number. The customer simply accepted the price your store offered.
The fix is on your side: set explicit combination rules so promotions stack only when you decided they should. This is exactly the kind of thing a dry-run simulation catches before launch, by showing you the effective discount rate rather than the number you typed. If you have never audited which of your live discounts can currently combine, that is the first place to look.
4. Gift and threshold farming
Free gift and Buy X Get Y offers create a target. Some buyers assemble the cheapest possible qualifying cart, take the gift or the free item, and never touch the products the offer was meant to move. The reward becomes the purchase instead of a bonus on top of one.
The pattern shows up as a cluster of orders sitting exactly at the qualifying minimum with an unusual product mix. The fix is to anchor the reward to the products you actually want sold, not to a raw cart total, and to make the gift's value proportional to the qualifying spend rather than a flat item any minimum cart unlocks. Build the mechanics deliberately with Buy X Get Y rules rather than a blunt threshold.
5. Return-cycle abuse
A customer buys enough to unlock a discount or a free item, receives it, then returns the qualifying products and keeps the reward. They net the incentive without the purchase that justified it. On a bundle, they keep the discounted hero product and return the filler that got them to the tier.
Read returns against the discount that funded them. If the same discounted item keeps coming back while the reward stays, you have a cycle. The structural fix is to tie the reward to the retained order: if returning the trigger drops the cart below the qualifying threshold, the discount should reverse with it, not survive the refund.
6. Account cycling for new-customer offers
A generous first-order discount is an incentive to never become a second-order customer. A subset of buyers create a fresh account for every purchase, staying permanently "new" and permanently discounted.
The signal is repeat new-customer orders sharing a shipping address or card. The fix is to define the offer against the customer, not the account: gate the first-order discount on customer tags and order history so a returning buyer under a new email does not requalify, and keep the welcome incentive modest enough that cycling is not worth the effort.
How to find your own leaks
You do not need to memorize six patterns. You need to segment margin by discount and look for two things: concentration (one promotion touching far more orders than it should) and repetition (the same behavior recurring across orders that share an identifier). Your profit analytics will show you which campaigns earn their keep and which ones quietly bleed, which is where every one of these patterns eventually surfaces.
Then close the loop the way you would with any margin problem. Prefer automatic discounts and segment rules over shareable codes, set combination rules on purpose, and audit periodically. If you want a broader cleanup pass across your whole store, our guide to auditing promo debt walks through the zombie codes and orphaned campaigns that abuse tends to hide behind, and the last-minute BFCM conflict fixes cover the stacking traps that get worse under peak-season volume.
Discount abuse is rarely dramatic. It is a small percentage of orders, repeated, that you never priced for. Reading the data is how you find it, and configuring discounts deliberately is how you keep it from opening back up.
