Promotion and Bonus Abuse Guide: Multi-Accounting and Referral Fraud

Every incentive a business offers to a new or loyal customer is also an offer to anyone who can pretend to be many customers. Promotion abuse turns welcome bonuses, promo codes, referral credit, free trials and loyalty points into a revenue stream for individuals and organised groups, usually by creating or controlling many accounts. The losses rarely show up as fraud: they appear as inflated acquisition numbers, wasted marketing budget and good customers who never see the offer. This guide covers how promo abuse and multi-accounting work, the specific patterns in iGaming and sportsbooks, detection signals and duplicate account detection, promotion design that resists abuse, and how to measure it. It is for fraud, product, growth and trust and safety teams in retail, delivery, fintech, subscriptions and gambling; it describes abuse at concept level for defenders. For the wider fraud programme see the Fraud Prevention Guide for Digital Businesses.

Key takeaways

• The unit of abuse is the person, not the account. Most promotion abuse is one person or group posing as many new customers, so the core capability is linking accounts that belong together.
• Design beats detection. Rewards paid on a real value event, held for a period and capped per device, payment instrument and household remove most of the profit before any model runs.
• Platform device signals help. Apple DeviceCheck stores two bits per device and Google Play Integrity device recall three bits, explicitly to recognise devices that already redeemed an offer or keep creating accounts.
• Proportionate responses keep good customers. Withholding a reward or limiting future offers is usually better than closing an account, and in regulated gambling the terms behind any sanction must be specific and disclosed in advance.
• Measure cost per genuine customer. Report promotion spend against customers who stay and pay, not sign-ups, or abuse will look like growth.

What promotion abuse is, and where it becomes fraud

Promotion abuse (promo abuse, incentive abuse) is the use of an offer in a way its terms or intent do not allow, usually to claim a benefit more than once or without the behaviour the offer was meant to reward. It sits on a spectrum, and the response should match where an actor sits on it:

The OWASP Automated Threat Handbook covers the automated end: OAT-019 Account Creation ("Create multiple accounts for subsequent misuse"), OAT-002 Token Cracking ("Mass enumeration of coupon numbers, voucher codes, discount tokens, etc.") and OAT-012 Cashing Out. Theft of loyalty balances through takeover is covered in the Account Takeover Prevention Guide.

Abuse patterns by incentive type

Multi-accounting and account farming

Multi accounting is one person controlling several accounts on a service that allows one. Multi account fraud adds intent to profit from offers or to hide from limits. The techniques aim to make each account look like a new person, and each leaves a trace a defender can link:

• Email variants: a consumer Gmail address ignores dots, so "j.smith" and "jsmith" reach the same inbox, according to Google; plus addressing (name+tag@) does the same on many providers. Normalise addresses before uniqueness checks. Privacy relay addresses, such as Apple's Hide My Email under Sign in with Apple, are legitimate and unique per app, so treat them as neutral rather than suspicious.
• Phone numbers: virtual and short-lived numbers pass SMS verification. Line type and number tenure are better signals than "verified".
• Payment instruments: prepaid and virtual cards give a new card number for each account. Link on the card fingerprint many payment processors provide, and on the funding type, rather than the raw number.
• Addresses: small variations of one delivery address ("Flat 2", "2/", "Apt 2"). Normalise and geocode before comparing.
• Devices (mobile multi accounting): app cloners, emulators, factory resets and reinstalls produce fresh-looking app instances. App integrity checks expose modified apps and untrusted environments, and Google states that Play Integrity device recall bits survive reinstall and device reset.
• Account farming: accounts created in bulk (OAT-019, which OWASP also calls "account pharming"), aged and then used or sold. Look for cohorts created together with similar profile patterns that stay dormant then activate at once.

See the Device Intelligence and Fingerprinting Guide for how device signals are built and their privacy limits.

iGaming and sportsbook fraud

Online gambling concentrates the problem because bonuses are cash-like and accounts can be funded and withdrawn quickly, which is why igaming fraud teams meet some of the most organised promotion abuse. The terms defenders search for:

• Bonus hunting: claiming welcome offers across many operators. It is often within the rules; operators manage it through offer design rather than enforcement. Bonus abusers go further, using duplicate accounts or prohibited play to claim more than once.
• Bonus arbitrage: using free bets or bonus funds alongside opposing bets elsewhere so the outcome barely matters and the bonus value is extracted; matched betting is the best-known form. It becomes abuse when it relies on duplicate accounts or breaches stated terms.
• Gnoming: operating accounts registered in other people's names, such as relatives, friends or bought identities, to claim bonuses repeatedly or to coordinate play. It defeats checks that only compare names and dates of birth, so linking must use devices, payment and payout accounts and behaviour.
• Collusion and chip dumping: linked accounts at the same table or in peer-to-peer games moving value between each other.

Regulation shapes both the abuse and the response. In Great Britain the Gambling Commission requires remote operators to verify a customer's name, address and date of birth before allowing them to gamble, which raises the cost of duplicate accounts. From 19 January 2026 its Social Responsibility Code 5.1.1 caps wagering requirements on bonuses at ten times and bans incentives that mix gambling products (betting, casino, bingo and lottery). Lower wagering requirements change the economics of bonus abuse, so fraud teams should re-test their thresholds after offers are redesigned for compliance.

Terms enforcement: the Commission's promotional play guidance says terms must "clearly specify all prohibited types or patterns of play", that "Terms cannot contain a general reference to banned types of play as this is too vague", that operators must not reserve sole discretion, and that fraud terms such as the use of multiple accounts must sit separately from restrictions on play strategies. Customers who lose winnings must receive a full explanation of the breach. The CMA reached a similar position in 2018, when firms agreed not to rely on vague terms to confiscate players' money. Promotion terms are a legal matter: this page is not legal advice, and fraud teams should agree sanctions and wording with their legal and compliance teams.

Detection signals and duplicate account detection

NIST SP 800-63A-4 Sec. 3.2 lists device fingerprinting "to protect against scaled and automated attacks and enrollment duplication", device or account tenure checks and transaction analytics (IP, geolocation, velocity) among the fraud checks identity services should run. The same toolkit drives duplicate account detection for promotions.

Combine signals in a graph: accounts are nodes, shared attributes are edges, and abuse shows up as clusters. Weight edges by strength (a payout account outweighs an IP address) and review the cluster, not the single account.

What to log

• Sign-up: timestamp, normalised email, phone line type, device identifiers or attestation result, IP and network type, referral code used.
• Code attempts: every code entered, valid or not, with session and account, so token cracking and leaked codes are visible.
• Reward events: offer ID, value, trigger event, release date and any later reversal, so loss can be attributed to each promotion.
• Value movement: first deposit or purchase, returns and chargebacks, loyalty redemptions and transfers, and payout destination changes.

Keep these events joinable by account, device and payment fingerprint for at least the life of the promotion plus its dispute window. Privacy law still applies: collect what the purpose needs, state the fraud prevention purpose in your privacy notice, and respect platform rules such as Google's ban on using device recall to track users.

Where identity fits

Promotion abuse is an identity problem in disguise: the business is paying for "new customers" without knowing whether each account is a distinct, real person. The proportionate answer is not identity verification for every coupon, but assurance matched to offer value: light linking for small discounts, payment or phone checks for trials and referrals, and document-based proofing where offers are cash-like or regulated, as in gambling. Synthetic and borrowed identities used for gnoming defeat name checks, which is why linking evidence beyond the identity document still matters. See the Identity Proofing and KYC Guide.

Designing promotions that resist abuse

• Reward on a value event: pay referral and welcome rewards after the first paid order, deposit and play, or completed month, not at sign-up.
• Hold before release: credit rewards after the return or cooling-off window, and hold the first withdrawal until checks complete.
• Cap per entity: one welcome offer per device, payment instrument, payout account and normalised address, plus a cap on rewards per referrer per month.
• Make codes hard to guess and easy to revoke: single-use codes with enough randomness, bound to an account where possible, with redemption rate limits and alerting on invalid attempts (OAT-002).
• Restrict stacking explicitly: define which offers combine in the system, not only in the terms.
• Step up on redemption: loyalty point transfers, gift card redemption and payout detail changes need fresh authentication.
• Put bot defences on sign-up and redemption: rate limits, automation detection and challenges on account creation and code entry. See the Bot Management Guide.

Decision guidance

• Small organisations: start with design controls (value events, holds, caps on card and address) and the anti-abuse features of your payment and identity providers. A spreadsheet review of the top referrers each month catches most self-referral.
• Large organisations: build an entity-resolution and graph capability shared by fraud, marketing and trust and safety, so one cluster decision applies across all offers. Give marketing a pre-launch abuse review for every new promotion.
• Response ladder: exclude from future offers, withhold the reward, reverse the reward, then close linked accounts. Keep closure for organised activity and stolen identities.

How to implement: a phased approach

1. Inventory incentives (weeks 1 to 2): list every live offer, its trigger, value, cap and owner, and estimate exposure as value multiplied by expected redemptions.
2. Baseline the abuse: run linking on historical redemptions (card, payout, device, normalised email and address) and measure what share of reward spend went to linked clusters.
3. Fix design first: move the highest-exposure offers to value events, holds and per-entity caps. This needs no model.
4. Add device and integrity signals in monitor mode: integrate DeviceCheck, Play Integrity and payment fingerprints, log decisions without acting for two to four weeks, and review false positives such as households.
5. Enforce the response ladder: start with withholding rewards from strong clusters, then widen. Route closures through review.
6. Close the loop with marketing: report abuse rate per offer and require an abuse review before launch.
7. Roll back safely: every rule has a monitor-only switch and a customer appeal route. If complaints from genuine customers rise, revert that rule to monitor mode, restore withheld rewards where justified and retune.

Metrics that show it is working

Framework mapping

Common failure patterns

• Rewarding sign-up instead of value: referral credit paid when the referee registers, so creating accounts is the whole job.
• Uniqueness on raw email: dot and plus variants pass as new customers.
• Enumerable codes: short or sequential codes with no rate limit invite token cracking.
• Linking by IP alone: mobile carrier and office networks put thousands of genuine customers behind one address, so rules block good users and miss abusers on residential proxies.
• Vague abuse terms: sanctions resting on general wording such as "irregular play" or on sole discretion, which the Gambling Commission's guidance rules out for licensed operators and which invite disputes everywhere.
• Loyalty points treated as low value: redemption and transfer need no step-up, so takeover of loyalty accounts is cheap.

Practitioner checklist

• Keep a register of every live incentive with trigger, value, caps, owner and abuse exposure.
• Pay welcome and referral rewards only after a qualifying value event and a hold period.
• Cap offers per device, payment instrument, payout account and normalised address.
• Normalise emails (dots, plus tags), phone numbers and addresses before uniqueness checks.
• Use DeviceCheck on iOS and Play Integrity device recall on Android to mark redeemed devices.
• Issue single-use, high-entropy codes with redemption rate limits and invalid-attempt alerts.
• Run graph-based linking across accounts and review clusters, not single accounts.
• Apply a response ladder and an appeal route, with sanctions written into specific terms agreed with legal.
• Report promotion spend lost to abuse and cost per retained customer for each offer.

Standards and references

• OWASP: OAT-019 Account Creation
• OWASP: OAT-002 Token Cracking
• NIST: SP 800-63A-4 Identity Proofing and Enrollment
• Gambling Commission: Promotional play restrictions
• Gambling Commission: Gambling promotions to be safer and simpler
• Apple: DeviceCheck
• Google: Detect repeat abuse using device recall (Play Integrity)
• CMA: Gambling sector told to raise its game after CMA action

Related NHI Mgmt Group resources: Fraud Prevention Guide for Digital Businesses · Top 10 Online Fraud Attacks · Bot Management Guide · Device Intelligence and Fingerprinting Guide · Identity Proofing and KYC Guide