How do bots harvest and resell limited discount codes at scale?

Codes leak from more places than breaches

Stores picture a hacker stealing a code database. The common leaks are duller: customers posting codes publicly for others to use, codes printed in shared inbox screenshots, affiliate partners distributing codes beyond their audience, and sequential or patterned codes that can be guessed once the format is known.

Each leak alone is small. Harvesting is an aggregation business. A bot that collects a few hundred codes a day from posts, forums, and code sharing sites ends up holding a live inventory worth real money at checkout.

Testing turns a pile of codes into a priced asset

A collected code is a rumor until it is tested. Bots validate codes against store checkout endpoints, quietly and at low rates per store, recording the discount value, product limits, and expiry for each one that works. The tested list is what gets sold, because buyers pay for certainty.

Testing is also where stores can see the operation earliest. Code validation attempts that arrive in bulk, from sessions that never build a cart first, look nothing like a shopper pasting a code from an email. The pattern is measurable long before redemption spikes.

Resale markets move codes faster than stores react

Working codes are sold in bundles, posted in paid groups, or fed into coupon sites that present them as community finds. A targeted code meant for a lapsed customer segment can be public within a day, redeemed by shoppers the campaign never intended, at a margin cost the campaign budget absorbs silently.

Speed is the harm. By the time a marketing team notices redemption coming from the wrong segment, the code has usually burned through most of its value, and revoking it punishes the legitimate customers still holding it.

Why patterned codes are an open door

Codes built from a prefix plus a short number, or from a word plus a birth year style suffix, can be enumerated. Once a bot knows the format from one leaked example, it can generate and test the whole space. The store sees a working code redeemed and assumes a leak, when the truth is the code was never secret at all.

Random, longer codes cost a store nothing extra to issue and close the enumeration route completely. The gap between a guessable code and an unguessable one is a configuration choice, and it is surprising how many promotions still choose the guessable side.

Defenses that protect the campaign, not just the code

Validate codes only inside a real checkout flow with a cart attached, rate limit validation per session and account, and alert when validation attempts outnumber completed orders by a wide margin. Those steps make harvesting slow and visible without inconveniencing a shopper pasting one code.

On the campaign side, bind high value codes to the customer account or email they were issued to wherever the offer allows it. A code that only works for its intended holder has no resale value, and harvesting stops being worth the effort.

Keep reading: How do fake coupon browser extensions steal affiliate commissions and shopper data?, How do account takeover bots test stolen passwords across retail sites?, and How do bots impersonate delivery companies in package tracking scams? cover the nearby cases in this series.

Frequently asked questions