Promo Protection Glossary and Discount Abuse FAQ
Reviewed for 2026, updated September 8, 2026.
Plain-language definitions of the terms that come up in coupon abuse prevention, plus answers to the questions merchants ask most.
- Address normalization
- The process of standardizing shipping addresses so that variations in capitalization, punctuation, abbreviations, and unit formatting resolve to the same underlying address. It is one of the most reliable ways to recognize a repeat customer who is using different email addresses.
- Automatic discount
- A discount that applies at checkout without the shopper entering a code, based on conditions such as cart value, product, or customer segment. Automatic discounts are convenient but must be included in combination rules or they can stack with codes unexpectedly.
- Average order value (AOV)
- The average revenue per order over a period. Tracking AOV for orders that used a specific code helps reveal whether the code is being used by its intended audience or by bargain hunters buying only the cheapest qualifying items.
- Cart abandonment offer
- A discount sent to shoppers who added items to their cart but did not complete checkout. These offers are frequently gamed by shoppers who abandon deliberately to trigger the discount, so they benefit from caps and eligibility limits.
- Combination rules
- Settings that determine whether a discount can be applied together with other product, order, or shipping discounts on the same order. Loose combination rules are the most common cause of accidental stacking.
- Contribution margin
- Revenue from an order minus the variable costs directly tied to it, including cost of goods, the discount, payment processing, and shipping. It is the right basis for judging whether a promotion made or lost money.
- Coupon extension
- A browser add-on that automatically tests known discount codes at checkout on the shopper's behalf. Extensions can apply codes the shopper never received and are a major channel through which leaked codes spread.
- Coupon stacking
- Applying more than one discount to a single order when the merchant did not intend for them to combine. Stacking can happen through codes, automatic discounts, loyalty rewards, and app-driven offers interacting in ways the store did not anticipate.
- Customer segment
- A defined group of customers based on attributes such as purchase history, tags, location, or subscription status. Restricting a discount to a segment is far more robust than relying on a code that anyone can type.
- Deal aggregator
- A website or community that collects and republishes discount codes for many stores. Aggregators are not inherently hostile, but any shared code that reaches one should be assumed to be public.
- Discount code
- A string of characters a shopper enters at checkout to receive a discount. Codes can be shared, single-use, unique per recipient, or public, and each type carries a different level of abuse risk.
- Discount rate
- The share of gross sales given away as discounts over a period, usually expressed as a percentage of revenue. A rising discount rate without a corresponding campaign is an early warning sign of leakage or stacking.
- Eligibility rules
- The conditions a shopper or order must meet to use a discount, such as being a new customer, belonging to a segment, or exceeding a minimum spend. Clear eligibility rules are the first line of defense against abuse.
- False positive
- A legitimate order or customer that is wrongly flagged or blocked as abusive. False positives are costly because they turn away real customers, which is why review and reversibility matter as much as detection.
- Fingerprinting
- Deriving a stable identifier from device, browser, or payment characteristics so that the same actor can be recognized across sessions or accounts. It is a supporting signal for repeat-abuse detection, never proof on its own.
- First-order offer
- A discount available only on a customer's first purchase, often delivered as a welcome code. First-order offers are the most common target of repeat abuse through new email addresses.
- Gross margin
- Revenue minus the cost of goods sold, before other expenses. Discounts reduce gross margin directly, which is why a promotion that looks strong on revenue can still be a net loss.
- Incrementality
- The portion of promotion-driven orders that would not have happened without the promotion. Estimating incrementality separates discounts that created sales from discounts that simply reduced the price of sales that were going to happen anyway.
- Leaked code
- A discount code that has spread beyond the audience it was issued to, typically through sharing, screenshots, forums, aggregators, or coupon extensions. Redemptions exceeding the size of the intended audience are the classic sign.
- Minimum purchase requirement
- A threshold in cart value or quantity that must be met before a discount applies. Thresholds protect margin on small orders but can be gamed by adding items that are later returned.
- One-per-customer limit
- A rule allowing each customer to use a discount only once. Because most platforms define a customer by email address, this limit is easily circumvented unless supported by address, phone, or payment matching.
- Promo abuse
- Any use of a promotion outside the terms under which it was offered, including sharing personal codes, stacking, repeat claims, and exploiting rule gaps. It is broader than fraud and usually involves no stolen credentials.
- Promotion budget
- The total discount value a merchant plans to give away on a campaign. Setting a total use cap on a code is the simplest way to keep a leaked or over-shared promotion inside its budget.
- Redemption
- A single successful use of a discount on a completed order. Comparing redemptions against the audience size and against expected order value is the fastest way to spot a code that has leaked.
- Return abuse
- Placing an order that qualifies for a discount or threshold, then returning part of it while keeping the discounted portion. It often accompanies minimum-spend promotions and is best addressed by adjusting the discount on partial returns.
- Single-use code
- A discount code that becomes invalid after one redemption. Single-use codes cap exposure per code but do not by themselves prevent one person from obtaining many of them.
- Threshold discount
- A discount that unlocks when the cart reaches a set value, such as free shipping over a certain amount. Threshold discounts are relatively resistant to abuse but should still exclude clearance and low-margin items.
- Unique code
- A code generated for one specific recipient, usually single-use and tied to that person. Unique codes are the most effective defense against leakage for list-based promotions because a shared code simply does not work for anyone else.
- Use limit
- A cap on how many times a discount can be redeemed in total, per customer, or both. Total use limits act as a safety net that keeps a promotion within budget even if the code spreads.
- Velocity check
- A rule that flags or blocks when the same code, address, payment method, or device is used more often than expected within a short period. Velocity checks are a simple and effective way to catch automated or rapid repeat abuse.
Questions people ask
What counts as coupon abuse on a Shopify store?
Coupon abuse is any use of a discount outside the terms it was offered under. That includes sharing a personal or partner code, applying discounts that were not meant to combine, claiming a first-order offer repeatedly with new email addresses, and meeting minimum-spend thresholds with items that are then returned. None of these require stolen payment details, which is what separates abuse from fraud.
How do discount codes leak in the first place?
Most leaks are ordinary sharing: a forwarded email, a screenshot in a group chat, a comment under an influencer post. Deal aggregation sites and coupon browser extensions then pick up the code, test it, and republish it to a much wider audience. Any code that is the same for every recipient should be assumed to leak eventually.
Is it worth trying to block coupon browser extensions?
Blocking extensions outright is difficult and tends to frustrate legitimate shoppers who use them. A more reliable approach is to make sure that the codes an extension could find are ones you are comfortable being public, and to protect the valuable codes with unique per-recipient generation and use limits so that a harvested code simply does not work.
How do I know if a promotion is actually profitable?
Work from contribution margin rather than revenue. Take the orders that used the promotion, subtract cost of goods, the discount, payment processing, shipping and any free-shipping subsidy, and returns, then make an honest estimate of how many of those orders would have happened at full price anyway. Promotions that look strong on revenue frequently turn out to be neutral or negative once discounts and incrementality are counted.
What is the safest way to run a new-customer discount?
Deliver the offer through a unique single-use code rather than a public one, restrict eligibility to customers with no prior orders, and back the one-per-customer limit with address and payment matching so a new email address is not enough to claim it again. Set a total use cap and an end date as a safety net.
Should discounts be allowed to combine?
Only deliberately. Decide for each discount whether it may stack with product, order, and shipping discounts, write the decision down, and test the checkout as a customer would. Most stores find that allowing free shipping to combine with a single product or order discount is fine, while allowing two order-level discounts to stack is rarely intended.
How do repeat abusers get around one-per-customer limits?
The limit is usually enforced by email address, so a new address is enough to reset it. Determined abusers also vary shipping addresses with small changes, use different payment methods, or check out as guests. Detecting them means matching orders on normalized addresses, phone numbers, payment fingerprints, and order cadence rather than trusting the email field.
What should I do when I find a leaked code?
First decide what the code is worth. A modest public marketing code can often be left running with a total use cap. A deep partner, staff, or influencer discount should be retired immediately and reissued as unique per-recipient codes. Either way, note the leak and its source so the next campaign is structured to avoid it.
How strict should abuse rules be?
Strict enough to stop the patterns that are costing you money, and no stricter. Hard blocks belong on clear-cut cases such as retired codes and unwanted combinations. Anything with a real chance of catching a legitimate customer should be flagged for a quick human review rather than declined silently, and every decision should be reversible.
Do deal sites hurt or help a store?
Both, depending on how you engage with them. They can expose valuable codes to the public and reduce the incentive to buy at full price, but they also send traffic and are not going away. Many merchants publish a modest, controlled public code themselves so that aggregators have something to list, then keep the generous offers unique and private.
How often should I review discount performance?
A short weekly review is enough for most stores: discount rate by code, redemptions against audience size for any code sent to a list, orders flagged for shared addresses or rapid repeat use, and a check of which discounts are currently allowed to combine. Add a deeper true-profit review at the end of each campaign.
Can automated protection block legitimate customers?
Yes, any automated system can produce false positives, especially with aggressive address matching that catches families, roommates, and offices. The safeguards are to reserve hard blocks for unambiguous cases, surface uncertain cases for review with the evidence visible, and give support a clear and kind way to reverse a wrong decision.
What is the difference between a unique code and a single-use code?
A single-use code stops working after one redemption, regardless of who uses it. A unique code is generated for one specific recipient and is typically also single-use. Unique codes are the stronger protection because a shared unique code is useless to anyone but its owner, while a shared single-use code can still be claimed by the first stranger to try it.