Building a promo-code abuse dashboard: spotting fraud before it eats your margin

If you sell digital products — gift cards, game keys, prepaid codes — promo codes are both your best growth lever and your biggest fraud vector. A single leaked 25%-off code can travel from a private Discord to a deal forum in minutes, and every redemption after that is margin walking out the door.

The fix isn't to stop running promotions. It's to see what's happening in real time. This is a practical walkthrough of the promo-code abuse dashboard I wish I'd built before my first campaign went sideways.

What "abuse" actually looks like

Not every suspicious-looking redemption is fraud. Normal behavior has a rhythm: a code redeemed a handful of times per hour, spread across different customers, at a steady discount mix. Abuse breaks the rhythm:

• Velocity spikes — 200 redemptions of the same code in 20 minutes, usually overnight or on weekends.
• Concentration — one code, one SKU, one account email pattern ([email protected] style aliases), or one IP range.
• Stacking — coupons combined with an existing sale discount beyond what your campaign rules intended.
• High-value targeting — abuse clusters on your highest-margin SKUs because resellers optimize for resale value.

The data pipeline (keep it simple)

You don't need a data lake. You need a webhook or an ETL job that lands every order event — code applied, discount amount, timestamp, account ID, email domain, IP, SKU — into one table. Aggregate into minute/hour buckets per code.

A reasonable starting stack: your checkout platform's order events → a lightweight stream (webhooks + a queue) → a small warehouse table → a dashboard tool or even a scheduled notebook that posts alerts to Slack. Teams running a digital gift-card store often discover that the redemption event stream they already log for fulfillment is enough to feed the whole dashboard — reuse beats rebuilding.

The four panels that matter

1. Redemptions per code, per hour. A time series with one line per active code. Abuse shows up as a vertical cliff. Add a per-code baseline (median of the last 7 days) so the alert triggers on deviation, not on absolute volume — your flagship promo is supposed to be busy.

2. New-account rate per code. What percentage of redemptions come from accounts created in the last 24–48 hours? Legit campaigns pull existing customers too. When 90% of a code's redemptions are brand-new accounts, you're looking at a referral-loop exploit or a bot farm.

3. Discount concentration heatmap. Codes × SKUs, colored by total discount given. One dark cell — a single code hammering a single high-value product — is your biggest margin leak and your first investigation target.

4. Anomaly feed. A simple table: code, time window, redemptions, new-account share, est. margin impact, and a one-click link to pause the code. The margin-impact column is what gets finance to care: (discount per order) × (anomalous orders) is a number everyone understands.

Detection rules that don't page you at 3am

Start with guardrails, not machine learning:

• Velocity rule: redemptions in a 15-minute window > 5× the 7-day median for that code → alert.
• Concentration rule: > 60% of a code's redemptions in an hour tied to one SKU or one email domain → alert.
• Stacking rule: effective discount > max allowed by the campaign config → alert and auto-review.
• New-account rule: > 70% of redemptions from accounts < 48h old → alert.

Tune thresholds per code type. An influencer code shared to 200k followers should spike; a "support compensation" code should never leave the ticket it was issued in.

Responding without burning legit customers

When the dashboard fires, the playbook is: pause the code first, investigate second. Pausing is reversible; leaked margin is not. For customers caught in the crossfire, honor redemptions made before the pause — punishing real buyers for your leaky code destroys trust faster than fraud destroys margin. Stores like Kadokey operate in exactly this high-risk category, where a code leak on a popular SKU can move faster than any manual review.

Also: rotate the pattern of your codes. Sequential or guessable codes (SAVE10, SAVE11, …) get brute-forced. Use unguessable strings for anything above 10% off, single-use codes for influencer partnerships, and expiry dates on everything.

The one metric to report up

"Promo spend" usually means intended discounts. Track unintended discount separately: redemptions that violated your rules or leaked beyond their audience. When leadership sees that number next to the intended number, dashboard funding stops being a debate.

Build the four panels, wire the four rules, and your next campaign leak becomes a 10-minute incident instead of a quarter-end surprise.