Issue 01

The leak nobody budgets for: how promo abuse is draining retail in India and worldwide

12 October 2026

Flicp Editorial

The Indian retail edit desk

Promotion abuse is a growing share of retail fraud, and in India it now runs on device farms. What the data shows, and why unique coupons close the gap shared codes leave open.

Every brand that has run a discount campaign knows the feeling. You launch a code for a specific audience — first-time buyers, newsletter subscribers, a creator's followers. Within hours it is somewhere it was never meant to be: a deals channel, a coupon site, a browser extension that auto-applies it, a WhatsApp forward that says "🔥 WORKING 100%".

This is promotion abuse. The data says it is growing worldwide, and that India is now facing an industrial-scale version of it.

The global picture: abuse is a growing share of fraud

For years, retail fraud teams focused on stolen cards and chargebacks. Promotion abuse was treated as a cost of doing business. That is changing.

It is becoming a bigger share of fraud. Liminal's Link Index for Promotion and Loyalty Abuse in eCommerce 2025 projects that fraud from promotion and loyalty abuse will rise from 31% to 42% of total fraud within two years.
Most businesses cannot enforce their own rules. The same report found that only 20% of organisations enforce promo code restrictions automatically, and 96% of loyalty and referral abuse cases still require manual review.
Large merchants are seeing it rise. In Riskified's Policy Abuse and Its Impact on Merchants: Global Benchmarks 2023 — a survey of 300+ leaders at companies with at least $500 million in annual revenue across 10 countries — 38% of merchants reported a year-on-year increase in promo code and loyalty programme abuse.
Policy abuse is trending upward. The Merchant Risk Council's 2025 Global eCommerce Payments and Fraud Report, which surveyed 1,082 merchant professionals in 38 countries, found that 57% reported increasing rates of refund and policy abuse, with refund abuse the most-cited attack (47% of merchants).

The leaks are not only about shoppers. In December 2025, Capital One agreed to pay approximately $4 million to settle a US class action brought by content creators. They alleged that its shopping browser extension — a tool that finds coupon codes at checkout — refreshed the checkout page and overwrote the affiliate tracking code, diverting commissions from the creators who had sent the shopper there. Auto-applied coupons can change who gets credit for a sale.

The India picture: device farms and fake accounts

In India, promotion abuse looks less like individual bargain-hunting and more like organised crime.

In April 2026, risk-decisioning company Bureau published an analysis of 70 million marketplace users. It found:

256 fraud clusters comprising roughly 45,000 accounts linked to just 9,000 devices
On average, 1 in 6 risky devices had more than 10 accounts tied to it — the signature of a "device farm", where racks of phones run fake accounts in parallel
Some accounts recorded more than 50 activity instances within a single hour
Fraud hubs in Delhi, Bengaluru and Noida, with some platforms seeing 15 times the typical rate of multi-account users

These farms target exactly the features growing platforms rely on: first-order discounts, referral bonuses, return policies and cash on delivery. A "₹200 off your first order" offer is generous to a real new customer. To a farm running forty accounts from one phone rack, it is a payout.

Why India's offline market raises the stakes

It is tempting to treat this as an e-commerce problem. India's retail economy says otherwise.

According to the Deloitte–FICCI report Spotting India's PRIME innovation moment (August 2025), India's retail sector was worth US$1.06 trillion in 2024 and is projected to reach US$1.93 trillion by 2030. Online retail was US$75 billion — about 7% of total retail — and is expected to reach US$260 billion, or 14%, by 2030.

In other words, more than nine of every ten rupees of Indian retail is still spent offline — in kirana stores, brand outlets, franchises and malls. That is where paper vouchers, printed codes, manual discounts and month-end reconciliation still dominate, and where the tools that catch online abuse mostly do not reach.

The same report notes that Tier II and III cities now account for over 60% of e-commerce transactions. As brands chase these shoppers across both channels, their offers pass through more stores and more hands. Every handover is another place to leak.

Anatomy of a leaked campaign

To see how quickly this happens, follow a single campaign through its first week. The brand, the numbers and the timeline below are an illustration, not a reported case — but every step in it is a pattern the research above describes.

Monday, 10 a.m. A skincare brand emails 20,000 newsletter subscribers a code for 25% off their next order, valid for seven days. The plan assumes perhaps 2,000 redemptions.

Monday, 1 p.m. One subscriber posts the code in a deals group. Within the hour it is reposted to larger channels and picked up by coupon listing sites. By evening, auto-apply extensions are trying it at checkout for shoppers who never saw the email.

Tuesday. Redemptions are running at five times the forecast. The marketing dashboard shows a record-breaking day, and the team reads it as a successful campaign. Nobody checks how many of those orders came from people who were never on the list.

Wednesday. The code reaches accounts that exist only to collect offers. Because the code carries no identity, each new account looks like a new customer. Orders arrive for resale-friendly products in quantities no ordinary shopper would buy.

Thursday. Finance notices that the week's discount spend has already passed the monthly budget. The code is switched off — and genuine subscribers who try it on Friday are turned away, frustrated by a promise the brand made only four days earlier.

The following month. The campaign report says "10,000 redemptions". It does not say how many were incremental, how many were from the intended list, or how many came from duplicate accounts. The next campaign is planned on the strength of that number.

Nothing in this story required sophisticated fraud. It only required a code that worked for anyone who had it.

How a leak actually costs you

Promotion abuse rarely appears as a line item. It shows up in three quieter ways.

1. Margin you did not plan to spend. Take a deliberately simple illustration. A brand plans a 20% discount for 5,000 new customers with an average order of ₹1,500 — a budget of about ₹15 lakh. The code leaks, and 25,000 orders use it, mostly from existing customers, deal-seekers and duplicate accounts. Spend climbs to about ₹75 lakh, and most of the extra ₹60 lakh bought nothing the brand wanted.

2. Data that lies to you. Campaigns are judged on redemptions. A leaked code makes a campaign look like a hit, so budgets flow towards the channels that leak most. When 96% of abuse cases need manual review, much of this distortion is never caught.

3. Customers trained to wait. When a working code is always circulating, shoppers stop paying full price. They search for a code before every purchase, and the discount quietly becomes the real price.

Offline, there is a fourth cost: disputes. When a brand funds a discount and a store honours it, the two must later agree on what was redeemed. With paper and spreadsheets, someone usually ends up absorbing a loss they cannot disprove.

Why the usual fixes fall short

Most brands respond to their first leak with a familiar set of controls. Each one helps a little. None of them changes the underlying problem.

Usage caps. Limiting a code to, say, 2,000 uses stops the budget running away — but the 2,000 uses still go to whoever finds the code first, not to the audience it was meant for. A cap limits the size of the leak, not who benefits from it.
Short expiry windows. A code that lasts 48 hours leaks for 48 hours instead of a month. Deals channels move in minutes, so a short window mostly punishes genuine customers who open their email a day late.
"One per customer" checks. These usually key off an email address or phone number. Device farms exist precisely to produce many plausible-looking customers, and Bureau's finding of 45,000 accounts on 9,000 devices shows how far that can scale.
Minimum order values. Useful for protecting margin on small baskets, but they do nothing about who is redeeming. They can even push abusers towards larger, more damaging orders.
Manual review. Liminal's finding that 96% of loyalty and referral abuse cases still need manual review explains why abuse slips through: people cannot review every order quickly enough to stop a leak that moves in hours.
Blocking extensions or sites. There will always be another channel. Chasing distribution is a losing game when the thing being distributed is a reusable secret.

Every one of these controls is a fence around a shared code. The alternative is to stop handing out something that can be shared.

The root cause: a code is not an identity

Every one of these leaks has the same cause. A shared code cannot tell who is using it, how many times it has been used, or whether it is being used where it was meant to be.

Usage caps, expiry dates and "one per customer" checks help at the edges. But device farms exist precisely to defeat "one per customer" by making one person look like forty. The shared secret is still shared.

The fix is to stop sharing secrets and start issuing individual coupons.

From shared codes to unique coupons

This is the problem Flicp was built around. A brand on Flicp issues unique digital coupons — each one a single item with its own identity and rules, held in the wallet of the customer who received it.

Every coupon is one of one. There is no "WELCOME20" to copy. A forwarded screenshot does not create a second coupon, because the coupon's status is checked when it is redeemed.
Each coupon can be used once. When it is redeemed at a participating store's counter or at checkout, it is marked as used. A second attempt — the same customer, a photocopy, a cashier doing a favour — is refused.
The rules travel with the coupon. Where it can be used, what it covers and its redeem-by date are part of the coupon. The customer sees them before redeeming, and the store sees them when checking it.
Every use leaves a shared record. Each redemption is recorded with where and when it happened, so the brand and the store work from the same version of events.

At the counter, a store checks a coupon with a QR scan instead of trusting paper. Stores with an existing point-of-sale system can connect redemption to it directly.

What you can do this quarter

Moving to unique coupons is the structural fix, but there are steps any brand can take now to see and shrink its leaks — whatever tools it uses.

Count issued against redeemed. For every campaign, record how many people were meant to receive the offer and compare it with how many redeemed it. When redemptions exceed recipients, you have found a leak.
Watch redemption speed, not just volume. A sudden spike within hours of launch is rarely your intended audience. Set an alert for redemptions running well ahead of forecast.
Give every channel its own offer. If email, creators and stores each get a separate offer, a leak shows up against one channel instead of disappearing into the total.
Keep a holdout group. Leave a slice of your intended audience without the offer and compare their purchases with those who received it. The difference is what the campaign actually added; the rest is discount you would have given away anyway.
Reconcile with stores weekly, not monthly. The longer brand and store records drift apart, the harder disputes are to settle. Short cycles keep both sides honest and catch counter misuse early.
Write down what the offer is for. "New customers in Pune" is a target you can measure. "Drive sales" is not. A clear intent makes it obvious when redemptions do not match it.

What this means for store owners

Leaks do not only hurt the brands paying for discounts. Store owners sit at the point where a leaked or copied voucher is presented, and they carry the risk if a redemption is later disputed.

For an independent store, the questions are simple: is this voucher genuine, has it already been used, and will I be paid for honouring it? When the answer depends on trusting a printout and waiting for a month-end reconciliation, saying no is the safer choice — and the customer leaves disappointed.

A coupon that can be checked at the counter in seconds, and that leaves a record both sides can see, turns that calculation around. The store can accept brand-funded offers with confidence, the customer gets what was promised, and the brand reaches shoppers in the offline market where most Indian retail still happens. We will look at this side of the counter in detail in the next issue.

Five questions before your next campaign

If this code reaches a deals channel tomorrow, what is the most it could cost me? If the answer is "no limit", the campaign is not finished.
Can I tell a genuinely new customer from a new account at the moment of redemption?
Can my stores check an offer at the counter without a phone call or a printout?
Will the brand and the store agree on what was redeemed without a month-end reconciliation exercise?
Am I measuring the customers this campaign added — or just how many codes were redeemed?

If any answer makes you uncomfortable, the leak is probably already happening. It just has not been counted.

Sources

Some figures come from companies that sell fraud-prevention services (Riskified, Bureau, and vendors covered by Liminal) and should be read in that light. The ₹15 lakh / ₹75 lakh example is an illustration, not reported data.

This newsletter is general information, not legal, financial or tax advice. Product details describe Flicp as it works today and may change.