How do bots exploit new-customer welcome discounts?

How welcome-discount farming works

Almost every e-commerce store offers something to first-time buyers: 10 percent off, free shipping on the first order, a gift with purchase. The intent is customer acquisition. What bot operators see is a margin they can harvest. The pipeline is simple: create accounts in bulk, claim the new-customer offer on each one, place small orders that maximize the discount, and route them to reshipping addresses or parcel forwarders. Each account is used once or twice and abandoned.

The scale surprises merchants who have never looked. A store running a generous 15-percent first-order code can attract farming operations that open hundreds of accounts a day. The orders look legitimate in isolation: normal products, valid payment methods, real shipping addresses. It is only in aggregate that the pattern appears, a flood of first orders with near-zero repeat purchase, all arriving in waves from the same infrastructure.

Why email verification does not stop it

The most common countermeasure is requiring email verification before the discount applies. It fails because email addresses are effectively free. Operators use catch-all domains, plus-addressing, and disposable providers to generate unlimited inboxes, and automated pipelines click verification links as fast as they arrive. Some operations skip email entirely by abusing guest checkout flows that apply first-order pricing without any account at all.

SMS verification raises the cost but does not end the game. Virtual number services rent phone numbers by the thousand, and verification codes get read automatically. The operators who farm welcome discounts at scale treat verification as a line item, a few cents per account, and price it into the margin they extract from the discount itself. As long as the discount is worth more than the account cost, the operation continues.

The signals that actually identify farm accounts

Real new customers and farm accounts differ in ways that survive verification. Farm accounts show signup velocity clustering, dozens or hundreds of accounts created in bursts from related infrastructure. They reuse devices, payment methods, and shipping addresses across accounts at rates no legitimate customer base matches. Their first session converts immediately: signup, claim code, checkout, done, with none of the browsing hesitation real first-time buyers show.

Order composition is another tell. Farmed orders skew toward products that maximize discount value and resale appeal: high-margin items, popular SKUs, anything easy to flip. Real new customers buy what brought them to the store. Farm accounts buy what the discount math favors. And the post-purchase behavior is a desert: no email opens, no returns within normal rates, no second purchase. The accounts go silent the moment the discount is spent.

Discount rules that resist farming

The structural fix is to stop keying discounts to cheap identity. A discount tied to a verified, unique customer survives farming; a discount tied to an email address does not. That means layering identity signals into eligibility: device fingerprint uniqueness, payment method uniqueness, shipping address history, and account behavior scoring at signup. A second account from the same device and payment method should not earn a second welcome discount.

Timing rules help too. Delaying the discount, for example applying it to the second order rather than the first, destroys the farm economics because the operator has to complete a full-price purchase to unlock the discount. Minimum order values and category exclusions further shrink the margin. None of these hurt real acquisition, because real customers acquired by the discount come back. Farm accounts never do, which is exactly the behavior the rules select against.

Measuring whether you have a problem

Most stores can diagnose welcome-discount farming from data they already have. Pull first-order customers from the last 90 days and check the repeat purchase rate, the device and payment reuse rate across those accounts, and the signup-to-checkout time distribution. A healthy acquisition channel shows browsing, consideration, and a meaningful share of second purchases. A farmed channel shows instant conversion, heavy reuse of devices and payment methods, and a repeat rate near zero.

The cost of ignoring it is not just the discount margin. Farmed accounts pollute customer analytics, inflate acquisition numbers, and distort lifetime value calculations. Marketing teams optimize spend toward a channel that produces no actual customers. Cleaning up welcome-discount abuse is one of the rare fraud projects that pays for itself twice: once in recovered margin, once in honest data.