Why does a first-order discount attract so many fake new customer accounts?

The welcome offer rewards a definition that is easy to fake

A first-order discount promises something to anyone who has never bought from you. Your store checks that promise against whatever it can see, and what Shopify can see at checkout is mostly an email address. The one-use-per-customer setting on a discount is keyed to the customer record, which in practice means the email entered at checkout. A shopper who wants the discount a second time simply needs an email your store has never seen. That is the whole trick, and it takes seconds. Related: Setting Discount Rules That Hold

The common variations are plus addressing, where jane+shop2 at a given domain is delivered to jane at the same domain but looks like a different customer, dot variations that some large mail providers ignore, and disposable email services that hand out a fresh inbox per visit. Guest checkout makes it even easier because no account is needed at all. None of this is sophisticated fraud. It is ordinary shoppers who learned that the welcome code works every time if they change one character, and a smaller number of resellers who run the play at scale.

Keep reading: How Coupon Abuse Eats Your Margin, Spotting a Leaked Discount Code, Coupon Stacking and How to Prevent It. See how CouponFence helps you discount and coupon abuse guard for shopify stores.

Recognize the pattern before it reaches your margin report

Look at repeat welcome-code redemptions that share a shipping address. A household legitimately has a few people, but an address with a dozen distinct first-order emails in a quarter is not a household. Look at the local part of the email before the at sign: sequences like name1, name2, name3, or the same root with different plus tags, are a strong signal. Look at the ratio of guest checkouts to account creation among welcome-code orders; abusers rarely create accounts because accounts leave a trail. Related: Repeat Abuse by the Same Accounts

Timing matters too. Genuine first orders are spread across the day and across the week in roughly the same shape as your general traffic. Serial welcome-code use clusters, often several orders within minutes from the same device or network, each with a different email. Phone numbers are another tell, because shoppers change emails freely but keep their phone number for delivery notifications. When two supposedly new customers share a phone number, you are looking at one person.

Close the gap with matching rules, not just email uniqueness

The fix is to define a new customer with more than the raw email string. Normalize emails before comparing them: strip plus tags, and for providers known to ignore dots, strip the dots too. Then match on secondary identifiers, including normalized shipping address, phone number, and where available a device or payment fingerprint. A welcome code should be refused, or flagged for review, when any of these match a prior order. Shopify's native discount settings do not do this on their own, which is where an abuse guard app or custom checkout logic comes in, but even a manual weekly review of welcome-code orders against past addresses catches the heaviest abusers. Related: How Coupon Abuse Eats Your Margin

Structure the offer itself so it is less worth gaming. A percentage off the whole first order is the most attractive target because it scales with cart size. A fixed amount off, a free gift with a minimum spend, or free shipping on the first order is cheaper to lose and less appealing to resellers. Unique single-use codes delivered by email after signup, rather than a public WELCOME10 string, add friction that stops casual repeat use, and many email tools, including some native Shopify features, can generate them.

Decide how strict to be without punishing real newcomers

Every matching rule produces some false positives. Two roommates buying separately, a parent ordering for a college student at the same address a year later, a customer who genuinely switched email providers. Treat a match as a reason to review or to downgrade the discount rather than to cancel the order outright. A soft approach is to let the order through but apply the discount only if no prior order matches; a firmer approach flags the order for a quick human look before fulfillment. Reserve outright blocking for accounts that trip several signals at once. Related: Balancing Generosity and Protection

Write your terms so the policy is defensible: one welcome offer per person or household is clearer and easier to enforce than one per email. Then measure. Track the share of welcome-code orders that match a prior customer each month. If the number drops after you tighten matching and overall first-order conversion barely moves, you have removed abuse without hurting acquisition, which is the outcome you want.