Promo Code Stacking: How Bots Drain Discount Budgets at Checkout

The stack that should not exist

A buy-one-get-one promotion is built on conditions: buy this, get that, sometimes with exclusions and minimums. A BOGO that stacks with a sitewide percentage discount, a loyalty reward, and free shipping is not one promotion anymore. It is four promotions multiplying each other, and the combined discount can go far beyond anything the merchandising team intended. DataDome's coupon glittering guide describes exactly this: bots test thousands of code combinations per second to find stackable discounts, and organized fraud networks deploy scraping bots to decode how promotional codes are structured, then sell access to the working combinations.

The attack starts with discovery. Bots monitor a merchant's promotions page and coupon feeds, then systematically test combinations in headless browsers, looking for offers the system treats as compatible when they should not be, and sequencing tricks like applying a percentage discount before a BOGO so the free item is computed against an already-reduced price. When a combination yields an 80 percent discount, they scale it: bulk orders through the same flow, sometimes reselling the goods below retail.

Each individual order looks like a legitimate promotion redemption, which is why the attack can run for weeks before margin reports reveal the damage. The platform sees higher order volume and reads it as a successful campaign. The merchandising team sees the margin report later and finds the campaign paid customers to take the goods.

The three techniques that do the damage

Coupon stacking is the headline: combining multiple promotional codes on a single transaction when only one was intended, often reducing the final price to zero or near-zero. Coupon duplication is the quieter sibling, copying a single-use promo code and applying it to unlimited transactions. Code sharing and public leakage is the third: a targeted VIP code meant for select customers gets posted to a coupon aggregator site and redeemed far beyond its intended audience.

All three ride on the same weakness, which Stripe names directly: weak identity verification at signup. Promo abuse typically exploits weak identity checks, which is why new account fraud and promo abuse are often part of the same problem. A fraudster creates five accounts to claim a first-order discount five times, refers themselves through a second email to collect the referral credit, and scripts the whole process so a campaign meant to run for a week is drained in hours.

Detection relies on combining signals that distinguish synthetic or repeat identities from genuine new users: device clustering, disposable email patterns, and abnormal redemption timing. A single IP address attempting the same code hundreds of times in hours, from different accounts linked to the same payment method, is the pattern that gives it away. One signal alone proves little. The cluster is the proof.

The fix is a matrix, not a wall

Start with a promotion compatibility matrix: every offer type gets an explicit list of what it can and cannot combine with, enforced server-side at pricing time. BOGO offers should default to non-stackable with percentage discounts unless merchandising explicitly approves the combination. The matrix has to be enforced where the price is computed, not in the front-end code a bot never runs.

Add a global discount cap in the order management system, applied after all promotions, so it catches combinations nobody anticipated. Most merchants land between 30 and 50 percent off the pre-discount total. A blanket ban on stacking punishes legitimate shoppers who found two valid offers, and it teaches them the store does not trust them. A cap stops the zero-dollar order and lets the honest shopper keep their discount.

Test before launch. Every new offer should go through pre-launch stacking tests against every live offer, because the combinations are what break, not the individual offers. And watch redemption timing after launch: a campaign draining in hours is a bot problem, not a popularity problem, and the response is to pause the code, not to raise the discount.

Keep reading: Card testing on small checkouts: why the $1 charge is the whole attack, Checkout Bots Explained: Scrapers, Card Testers, Scalpers.