Promotional fraud protection: check the purchase, not the picture
By Matt Hunt, orsom ·
The short version
- Anyone can now fake a receipt in under a minute using free AI tools. Checking whether a receipt photo "looks real" no longer works.
- Promotion fraud is now organised. It's not just the odd cheeky customer. Groups use bots and fake accounts to farm offers at scale.
- The fix is to check the purchase, not the picture, and to build protection into the promotion from day one rather than cleaning up afterwards.
- Don't overcorrect. In Australia, wrongly rejecting genuine customers is a legal and reputational risk too.
Picture this
You launch a simple offer: buy any two products, upload your receipt, get $10 back. It's a hit. Claims pour in, well ahead of forecast. Everyone's happy.
Then finance notices something odd. Hundreds of claims come from the same few phones. Dozens of receipts share the same store, time and transaction number. Some receipts are from stores that never stocked your product. By the time anyone looks closely, a big slice of the budget has gone to people who never bought a thing.
This is promotion fraud. It's not new, but two things have made it much worse: AI makes fake receipts effortless, and abuse has become a business. That's why protection now belongs in the campaign plan, right next to the prize pool and the creative.
What's changed: fake receipts got easy
The best early warning comes from office expense claims, which run on the same proof as most promotions: a photo of a receipt.
In March 2025, almost none of the fake expense receipts caught by software company AppZen were made by AI. By mid-2026, about 7 in 10 were (PYMNTS). One survey found 4 in 10 US workers admitted using AI to fake a receipt. SAP Concur, which checks millions of expense claims, now tells customers simply: don't trust your eyes (TechRadar).
If finance teams with full card records are struggling, a promotion that relies on someone eyeballing receipt photos doesn't stand a chance.
Why AI fakes are so hard to catch:
- There's no "original" to spot changes in. Old-school fakes were edited real receipts, so you could look for a wonky font or a smudged total. An AI receipt is made from scratch, so there's nothing to give it away (PYMNTS).
- The hidden tags disappear. Some AI tools stamp an invisible "made by AI" label into the file (TechRadar). Taking a screenshot wipes it (Expert Insights).
- They're kept small on purpose. AI fakes averaged about US$100, small enough to slip past automatic approval. Think $10 cashbacks and free-gift offers: exactly the size of most promotions.
And it's organised now. Fraud groups keep thousands of fake accounts ready to go, and share ready-made scripts for abusing offers online (BotBye). In one real case, 4,000 people created 137,000 fake accounts to keep claiming a 35% "new customer" discount. The cost: more than US$14 million a year (RetailWire).
The six tricks you'll see most
Promotion abuse is the most common way customers game retailers. In one study of large US retailers, nearly 3 in 4 had been hit, losing around 1.2% of revenue (PYMNTS). Most of it comes down to six tricks.
| The trick | What it looks like | How to stop it |
|---|---|---|
| Fake receipts | An AI-made or edited receipt for a purchase that never happened | Check the sale really happened, using retailer or payment data |
| Recycled receipts | One real receipt shared in a Facebook group and claimed 50 times | Block repeats of the same store, date, time and receipt number |
| Fake identities | One person with 20 email addresses claiming "one per person" 20 times | Check phone, device and address, not just email |
| Bots | Software that enters a competition thousands of times, or guesses promo codes | Bot blocking, entry limits, long random codes |
| Leaked codes | A code meant for one influencer's followers ends up on a deal site | Tie each code to a channel or account, cap how often it's used |
| Flipping the prize | Claiming free gifts to sell online, then returning the product | Hold high-value rewards briefly, match claims against returns |
The pattern is the same each time: the rules say one thing, but nothing actually enforces it. Close that gap and most casual cheating stops. The organised groups that remain need the layered approach below.
Five checkpoints, from planning to payout
No single check stops fraud. Think of it like airport security: a ticket check, a bag scan, a passport check. Each one catches what the last one missed.
- Design it toughbefore launchAsk how you would cheat it, then close those gaps. Clear limits per person, receipt and code in the T&Cs.
- Stop the botsat sign-upBot blocking, entry limits, a code texted to a mobile. Don't rely on email alone to know who someone is.
- Check the saleper claimConfirm the purchase happened, using retailer or payment data. Catch repeat receipts; use photo checks as a backup only.
- Spot patternsacross claimsWatch for sudden spikes, shared phones and look-alike addresses. Review linked accounts together, not one claim at a time.
- Pause before payingbefore payoutHold big rewards for a few days and pay only verified people. Keep a record of every decision, in case it's questioned.
1. Design it tough (before launch)
The cheapest fraud to stop is the fraud your promotion never invites. Before you sign off the brief, ask: "If I wanted to cheat this, how would I do it?" High-value prizes, long claim windows and loose rules are what attract cheats (Snipp).
In practice: a 14-day claim window instead of 90 days. One claim per household, not per email address. A reward that's great for real customers but hard to resell.
2. Stop the bots at the door (at sign-up)
Good bot protection removes most automated entries (RTM). Serious groups go further, using fake phone numbers and paying people to solve CAPTCHAs (Alibaba Cloud). So treat an email address as the weakest proof of who someone is.
In practice: text a code to a mobile, limit entries per device, and step up the checks as the prize gets bigger.
3. Check the sale, not the photo (each claim)
This is the checkpoint AI has changed most. Photo checks still help, but they can't be the main test any more. The question to ask is: did this purchase actually happen? (PYMNTS)
In practice: match claims against retailer sales data, loyalty card scans or card-linked offers where you can. Where you can't, flag any receipt whose store, date, time, receipt number and total already appear in another claim.
4. Look for patterns (across all claims)
One claim can look perfectly fine while the bigger picture screams fraud.
In practice: watch for spikes in claims with no ad campaign to explain them, lots of accounts on one phone, or near-identical addresses (Unit 1, Unit 1A, 1/12). Review linked accounts as one group. Spotting repeat offenders is where most retailers say they struggle.
5. Pause before you pay (before payout)
This is your last chance to stop money or stock walking out the door.
In practice: hold big rewards for a few days of checks, pay only to verified people, and match free-gift claims against returns. If fraud spikes mid-campaign, slow payouts and tighten the rules rather than shutting the whole thing down. Fraud tends to come in waves.
In Australia: be firm, but be fair
Here, stopping cheats is only half the job. You also owe every genuine customer a fair go, and regulators check both.
- State rules. Each state and territory has its own rules for prize draws, and permit needs depend on prize value and promotion type (Clayton Utz). Even without a permit, NSW expects promotions to be run fairly and openly, with proper records. Your fraud decisions are part of those records. Check the current rules in every state you run in.
- Consumer law. The ACCC has taken action where promotion conditions were hidden. It took The Good Guys to court, alleging key conditions were not clearly shown and thousands of eligible customers missed out on store credit (Business News Australia). Flight Centre paid $252,000 in penalties for not making voucher conditions clear (ACCC).
What this means for you:
- If you plan to enforce a rule (one per household, receipt must be dated in the promotion period, we may check your ID), say so clearly in the terms. Don't bury it.
- Rejecting real customers isn't a "safe" default. Not paying people who qualified can land you in trouble too. Every automatic rejection needs a person who can review it and a clear reason on file.
Stop the cheats without annoying everyone else
You'll never get fraud to zero, and you shouldn't try. Every extra hoop at sign-up loses some genuine entrants. Every wrongly rejected claim becomes a complaint, or a one-star review. Retailers say the fear of accusing real customers is one of the hardest parts of tackling abuse.
The trick is to match the effort to the risk. Think of a shop: nobody checks your bag for a packet of gum, but buy a TV and they'll want ID.
- Small, low-risk claims: let them through with light checks.
- Big rewards or suspicious signals: ask for more proof, review by hand, or hold the payout.
- Ask nicely first. Not every dodgy-looking receipt is fraud. Some people recreate a receipt they lost (Expert Insights). A polite request for better proof sorts out a lot without accusing anyone.
Your pre-launch checklist
- We've asked "how would I cheat this?" and fixed the answers
- Limits and our right to check claims are clear in the T&Cs
- We can confirm purchases with real sales data, not just photos
- We catch the same receipt being used twice, even with a new photo
- Entries are protected from bots, with limits that suit the prize
- We check more than an email address to know who's entering
- Someone watches claim numbers daily for odd spikes
- Big rewards are held briefly and paid only to verified people
- Every rejection has a reason and a person who can review it
- The fraud team knows the promotion is live
That last one sounds obvious. It often isn't: fraud teams sometimes don't even know a promotion is running (Signifyd). And fraud does a second kind of damage. A promotion that pays cheats looks more successful than it really was, so next year's budget gets set on bad numbers.
Sources
- How to Prevent Receipt and Promotion Fraud (Snipp, 8 Oct 2026, reference article)
- Top 12 Receipt Fraud Signals to Watch in 2025 (Snipp)
- AI-Generated Fake Receipts Now Make Up 71% of Expense Fraud (PYMNTS)
- 89% of Retailers Get Burned By Abuse of Their Own Customer Promotions (PYMNTS, Nov 2021)
- Expenses fraud: how to spot an AI-generated receipt (ICAEW, Nov 2025)
- Workers scam employers with AI-generated expense receipts (Expert Insights, Oct 2025)
- Workers are scamming their employers using AI-generated fake expense receipts (TechRadar)
- ChatGPT is now really good at faking receipts (TechRadar)
- Are generous coupon and return policies hurting the bottom line? (RetailWire, citing Riskified)
- Promo Abuse Demystified (BotBye)
- Protecting Your Promotion From Fraud and Bots (RTM)
- Glossary: promotional abuse (Alibaba Cloud)
- The hidden cost of policy abuse (Signifyd)
- Trade promotion lotteries: proposed regulation in NSW (Clayton Utz, Mar 2020)
- ACCC takes The Good Guys to court over store credit promotions (Business News Australia)
- Flight Centre pays $252,000 in penalties for Christmas and Easter promotions (ACCC)
Want this working for your brand?
Tell us the goal. We'll recommend the mechanic.