How to Stop Multi-Email Discount Fraud on Shopify

The Problem with Email-Only Verification

Most Shopify discount codes are configured with a "one use per customer" limit. In practice, this limit only checks whether a given email address has previously used the code. A customer who creates a second email address bypasses it entirely.

This gap makes multi-email discount fraud one of the easiest exploits in e-commerce — and one of the hardest to catch manually.

Why Manual Review Doesn't Scale

Some merchants attempt to catch fraud by manually reviewing orders for suspicious patterns. This works occasionally, but it has serious limitations:

What Effective Detection Looks Like

Stopping multi-email discount fraud reliably requires checking multiple signals simultaneously on every order:

Email address: The most obvious check, but the least sufficient on its own. Exact match plus similarity scoring (to catch minor variations like extra dots or plus-addressing) improves coverage.

Phone number: Many customers reuse the same phone number across multiple accounts. A phone match is a strong fraud signal.

Shipping address: Exact address matching and fuzzy address matching (handling abbreviated street names, apartment number variations, etc.) are both necessary. Most fraudulent customers ship to the same physical location.

Billing address: Separate from shipping in many cases, but still a useful corroborating signal.

Customer name: Name matching with fuzzy logic catches transpositions and abbreviations.

The key insight is that no single signal is reliable on its own. A fraud scoring system that weights multiple signals together is significantly more accurate than any individual check.

Configuring Thresholds Appropriately

One risk of automated fraud detection is false positives — flagging legitimate customers. This typically happens when:

The right approach is to configure thresholds conservatively at first, review flagged orders manually for a period, and tighten thresholds as you build confidence in the scoring. Most merchants find that a threshold requiring 2–3 matching signals eliminates nearly all false positives while catching the vast majority of fraud.

Automating the Response

Once a fraudulent order is detected, the response options are:

1. Flag for manual review: Receive an email notification and decide whether to cancel manually. Good for starting out or for high-value orders.

2. Automatic cancellation and refund: The order is cancelled and fully refunded via the Shopify API before it fulfills. The customer receives a cancellation notification.

3. Cancel connected subscriptions: If the fraudulent order was a subscription placed through Recharge, the subscription is also cancelled.

4. Cancel shipments: If ShipStation is connected, the order is cancelled there before it ships.

Automation is the end goal for most merchants — once you've tuned your thresholds and confirmed the system is accurate, letting it run without manual intervention is what makes fraud prevention scalable.

The Unexpected Benefit

One finding that surprises many merchants: 38% of customers who are caught and refunded repurchase at full price. Being caught appears to deter future abuse while preserving the customer relationship for a segment who are willing to pay. This means automated fraud detection doesn't just stop losses — it sometimes converts an abusive customer into a profitable one.