The $5 Promotion Isn’t a $5 Problem Anymore

A $5 coupon might not sound like much of a security risk. When a customer got that coupon outside a store or in the mail, there were natural limits on how many one person could collect.

Move that same promotion online and the math changes. If there is a way to game it, automation makes it possible to repeat the same activity again and again.

It may still be a $5 coupon. It just isn’t a $5 problem anymore.

Loyalty Programs Vulnerabilities

Loyalty Programs Created Something Worth Targeting

QSRs have spent years moving more of the customer experience online, from promotions and ordering to loyalty programs and payments.

I saw that evolution firsthand at Starbucks, which was an early leader in building its loyalty program around the mobile experience. Customers joined the program, reloaded funds, and linked payment information to their accounts. The goal was to get to know the customer and create an easy experience that kept them coming back.

Those accounts also became attractive to attackers. If an attacker could take over an account, they could gain access to any loyalty balance or credit card associated with it. Credential stuffing became one way to do that: take a username and password exposed in a breach somewhere else and try those same credentials against another account, hoping the customer reused their password.

Automation has changed the scale of the problem. Small fraud loops can now get very big, very quickly. QSRs are particularly exposed to that tension because they are constantly trying to reduce friction. They want customers to create an account, participate in a promotion, place an order, and come into the store as easily as possible.

Scalable Promotions Risks

When Promotions Become Scalable

Many of the promotions QSRs run today are digital versions of ideas that once existed in the physical world. The physical format itself created limits. You could only collect so many coupons. Those limits do not automatically carry over when the promotion moves online.

A marketing team might launch an offer that requires little more than an email address to participate. That makes it easy for legitimate customers to take part. It also raises a different question: Can someone automate account creation, generate accounts in volume, and claim that offer again and again?

This is where views of a successful promotion can differ widely within the same company. The marketing team may see a surge in participation and celebrate a successful campaign. Meanwhile, the security or fraud team may be watching the adversary communities targeting the promotion and seeing people actively share ways to game it. What looks like customer engagement from one side of the organization can look very different from the other.

That is why you can’t evaluate risk by looking only at the value of an individual offer. A brand may look at the promotion and think, “It’s only $5.” The calculation changes when someone can find a way to claim that offer repeatedly through automation.

Responding after the abuse starts can create another challenge. Brands may add steps inside an application, ask customers to re-enter their credit card CVV, or deploy controls that inadvertently block legitimate users.

Every additional point of friction can degrade the experience the brand was trying to improve in the first place. In my experience, that meant continually tuning those protections, such as limiting step-up challenges to critical events to reduce how often customers encountered them.

Security and usability have to be balanced. If an experience is too difficult, people will not use it. If it is too easy to exploit, abuse follows.

Security in Promotions

Security Needs to Be Part of the Promotion From the Start

Finding that balance starts by recognizing that marketing, product, fraud, and security are all part of the customer experience.

Those teams may not sit together organizationally, and they may have different incentives, but their decisions ultimately affect the same customer. A marketing team should not design a promotion and then hand it over to security once something goes wrong.

Bring those teams together before launch. Treat the promotion like any other launch: test it, validate it, think through how it could be gamed, and take a risk-based approach. Once it goes live, have the right teams watching for signs that the promotion is being abused.

Teams will always encounter things they didn’t anticipate. The adversary communities targeting these programs are constantly looking for loopholes, and they can be remarkably creative in finding them. Brands should assume that if there is a way to game a promotion, someone will eventually find it.

The goal is to strike the right balance from the start: make promotions easy for legitimate customers to use without making them easy to abuse.