The Essential Guide to Promotion Abuse on Delivery Platforms

The food delivery industry experienced major growth during the COVID-19 pandemic. These marketplaces saw the demand for their services grow, but also experienced intense competition.

Post-pandemic, user growth slowed, and food delivery companies had to implement new customer acquisition and retention strategies. In the face of this new environment, food delivery companies have invested—and continue to invest—substantial sums in promotional activities.

Some of these transactions are performed by legitimate customers just looking for a good deal. But many of them are made by bad actors who are systematically abusing promotional activities and stealing large sums of money from these platforms using sophisticated fraud methods.

How extensive is this problem of promotion abuse? By our estimates, on average 2% of all monthly transactions on delivery platforms in LATAM are associated with coupon fraud. With the top two US delivery platforms averaging US $1.1B worth of transactions per month, we estimate that the largest US delivery companies each could be losing over US $1.5M per month due to promotion abuse.

To systematically abuse coupons, bad actors typically use a multi-accounting strategy in which they use several devices and utilize a sophisticated device reset strategy to evade recognition. As they’ve implemented limits and rules in an attempt to crack down on this behavior, fraudsters have come up with increasingly complex techniques to get around the restrictions so they can continue to profit. Given the strategic combination of these multi-accounting techniques and their lack of advanced location and device recognition signals, the delivery industry has been fighting blind.

The Incognia team has extensive experience fighting promotion abuse through close collaboration with our customers.

To illustrate the scope and complexity of these issues, we’ve included real insights from the food delivery market in LATAM. Our goal with this report is to help fraud practitioners gain a deep understanding of the true sophistication and scale of promotion abuse on food delivery platforms, and the tools, techniques, and new signals that can be used to prevent it.

The first and most obvious promotion type to exploit is new user coupons. Generally, this type of coupon offers a more aggressive discount to convince new users to try the service.

In order to exploit new user coupons, the fraudster must create as many accounts as possible. After the discount is used, these accounts are typically discarded.

In LATAM, Incognia’s research shows that on average between 1% and 2.5% of devices on food delivery platforms access 3 or more accounts, with many of these devices actually accessing over 50 accounts.

For a better understanding of the volumes we’re discussing, we’ve calculated 4% of the monthly active users at some of the top food delivery platforms in the world:

In order to abuse new user coupons at scale, bad actors leverage tools to quickly create a large number of accounts. Often, they also use advanced techniques to block device recognition. In the next section, we’ll take a deeper look at both of these approaches.

Tools for creating accounts

In order to create accounts at scale, fraudsters make use of a number of tools:

Advanced techniques to mask device identification

The systematic account creation methods mentioned above are commonly used to commit various different types of fraud and are relatively easy to do. No real technical knowledge is required to get to this point.

But in order to scale promotion abuse, bad actors must bypass the device controls the app has in place. At this point, the level of complexity increases substantially.

Let’s dive into the most common tools and techniques fraudsters are using to mask their devices:

Rise of Cloning Apps

Experienced fraudsters not only take advantage of new user coupons, but they also exploit promotions offered to active customers to reward their loyalty to the platform.

To abuse loyalty coupons, fraudsters have to play the long game and consistently maintain an arsenal of active accounts. These fake account portfolios are created by buying active accounts from other users or by creating multiple accounts using the methods we described in the last section.

We’ll be the first to admit it: The way these fraudsters maintain hundreds of active accounts and manage their network of delivery addresses is a masterclass in administration and logistics. Let’s look at exactly how they do it.

Purchase management strategy

By studying the apps that they target, bad actors know that inactive accounts are monitored and often banned, while moderately active accounts are likely to receive promotion offers to incentivize more orders. Commonly, delivery apps will assign different classification levels to customers based on the quantity and value of their purchases. Knowing this, fraudsters set alerts to monitor promotional periods but also manipulate the system by strategically making frequent low-value purchases outside those periods as well.

We’ve created the illustration below to depict this pattern. We tracked the purchases of 20 different accounts linked to a single device over the course of a week.

As shown below, when a promotional coupon is offered, there is much more activity from these accounts. However, outside the promotional days, occasional purchases are still made to maintain the illusion that these are legitimate accounts.

By using this method, fraudsters are able to keep their accounts active and scale their operation by removing the need to continuously acquire new accounts. Using this strategy, they maximize gains while minimizing expended resources.

By using this method, fraudsters are able to keep their accounts active and scale their operation by removing the need to continuously acquire new accounts. Using this strategy, they maximize gains while minimizing expended resources.

Delivery Address

The delivery address provided at purchase is an extremely important data point when identifying fraud related to physical goods. Even if the account details are entirely fake, a real address is still needed to complete a delivery.

A high concentration of orders using the same delivery address often triggers fraud alerts, so bad actors find clever ways to bypass these monitoring techniques, including:

Different but concentrated addresses

• Delivery addresses can be different houses on the same street or different streets in the same neighborhood.

• Fraudsters also use public access commercial establishments, such as convenience stores or small markets.

Pickup in-store

• Fraudsters may also choose the option that allows them to pick up their order at the establishment. This way, their address remains ‘clean’.

So what can food delivery companies learn from these detailed insights into promotion abuse and how it’s being perpetrated? Here are 5 strategies you should take away:

1. Encourage cross-functional collaboration

Cracking down on coupon fraud involves effort by more than just the fraud prevention team. Promotional campaigns are generally created by the marketing team, their policies need to be approved by the legal team, and operations will be responsible for troubleshooting the users, some legitimate and some not, who are blocked. Given this, it’s important that these teams all work together to establish a coupon usage policy that can deliver the desired growth results while also discouraging abuse and fraud.

2. Monitor user behavior and transactions

It’s crucial to implement customized fraud rules that can alert you to changes in behavior at different stages of the user journey so that you can step in to investigate. This would include abnormal activity relating to account creation, logins, payments, and other critical moments.

Of course, there will be fluctuations based on seasonality, marketing campaigns, and external events.

3. Integrate a persistent device fingerprint

Promotion abuse often involves a cluster of accounts accessed on the same device.

In order for a device recognition solution to be robust and reliable, it has to be resistant to tampering. Keep in mind that there are a broad range of tampering techniques, from simple to sophisticated. Free APIs will not detect the complex methods used in systematic promotion abuse scams. 

Delivery companies need to look for solutions that are cutting-edge, keeping them one step ahead of fraud. Incognia's breakthrough use of exact location to create a resilient device recognition signal is an example. One way to create a stronger solution is to pair a device fingerprint with a second signal, like exact location behavior data.

4. Detect emulators and app tampering

As we’ve seen in this report, these tools are widely used by coupon fraudsters to scale their operations. To prevent significant losses, it’s important that food delivery platforms have a solution for detecting the use of emulators and advanced app tampering tools that bypass detection and enable multi-accounting.

5. Ensure continuous learning and updates (tools and people)

Fraudsters quickly adapt to new fraud prevention and detection measures. That’s why it’s important for the fraud teams at food delivery companies to stay in a constant state of learning and adaptation. This includes using innovative and dynamic solution providers, benchmarking and exchanging knowledge with other companies in the market, and specializing teams.

To sustain user growth and engagement post-pandemic, food delivery companies turned to promotions as a key strategy. But in this report, we’ve shed light on how the abuse of these promotions can send your growth budget spiraling down the drain.

As food delivery companies worldwide grapple with the issue of promotion abuse, it’s our hope that the insights and data presented here will serve as a valuable guide.

By learning about the scope of the problem, the techniques employed by fraudsters, and the preventive strategies that are available, you can defend your platform against abuse and ultimately invest more resources in creating great experiences for genuine customers.

Persistent device fingerprint for food delivery

Incognia uses exact location behavior and device recognition signals to provide a device ID that is resilient to factory resets and prevents multiple account creation, promotion abuse, and courier scams. Our cutting-edge location technology provides the food delivery industry with real-time insights that enable proactive fraud prevention.

With its sophisticated apartment-level location verification and device intelligence, Incognia is leading the charge against risky behavior.

Reliable performance at scale