Promo Abuse: How One Phone Claims Ten Welcome Bonuses

A wallet launches a cashback campaign: SAR 50 for every new customer who makes a first payment. Two weeks later the campaign is over budget and the growth team is celebrating a record month of signups. Then someone notices that four hundred of those new customers withdrew their cashback to the same twelve bank accounts.

That is promo abuse. One person, or a small group, opens many accounts to collect a reward meant for one. It rarely looks dramatic on any single account. Each one passes KYC, makes a small payment, and claims its bonus. The pattern only shows when you look at what the accounts have in common.

What abusers have to reuse

Creating a convincing new identity every time is expensive. Abusers cut corners where they think nobody is looking, and those shortcuts are your signals.

• The device. Factory-resetting a phone between signups is slow. Most farms reuse a handful of phones or run emulators.
• The payout destination. The reward has to land somewhere they control, so withdrawal accounts and cards repeat across "different" customers.
• Phone numbers and emails. Fresh SIMs cost money, so numbers get recycled, and emails follow obvious patterns.
• Timing. Signups arrive in bursts, often at night, with the same steps completed in the same number of seconds.
• Network. Many signups from the same IP range or through the same VPN exit.

Rules that catch it

Start with the device, because it is the hardest thing for an abuser to change.

• Three or more accounts created on one device fingerprint: send new signups to REVIEW and hold the bonus.
• A withdrawal account already used by another customer who claimed the same promotion: hold the payout.
• Five or more signups from one IP in an hour: REVIEW.
• Signup to first payment to bonus withdrawal in under ten minutes: REVIEW.

Note that most of these hold the bonus, not the account. A legitimate customer who shares a tablet with their family still gets an account. They just wait a little for the reward while someone checks.

Don't block the family iPad

The opposite mistake is as expensive. Three siblings signing up on their father's phone is normal in the Kingdom, and blocking them costs you three real customers and an angry review. Look at what the linked accounts do after signup. A family spends money at different shops on different days. A farm makes one qualifying payment per account and withdraws.

This is why the first version of any promo rule should run in observation mode. Let it score every signup for a week without acting, then look at the clusters it flags. You will see the difference quickly, and you can tune before a real customer is affected.

Fix the campaign, too

Some of this belongs in the promotion design, not the fraud rules. Pay the reward after a second transaction, or after seven days. Pay it as credit inside the app rather than as cash that can be withdrawn. Cap rewards per device and per payout account. Fraud rules work better when the campaign is not handing out free money in the first five minutes.

Where to look first

If you suspect a past campaign was abused, pull every account that claimed the reward and group them by device fingerprint and withdrawal account. The clusters will be obvious. Then put those two checks in front of your next campaign.

Naiza links each device to the accounts it has touched and lets rules act on shared devices and repeated payout destinations at signup and withdrawal. The promo abuse and multi-accounting entries cover the definitions.