# How do bots exploit buy-one-get-one promo stacking? | BotBulwark

Source: https://botbulwark.com/blog/2026-10-11-bogo-promo-stacking-bots-discount-abuse.html

[Home](../index.md) / [Blog](index.md)


October 11, 2026 - BotBulwark

**Short answer:** Bots exploit BOGO promotions by systematically testing which offers stack, then scaling the combinations that produce extreme discounts through bulk orders. Merchants stop it with an explicit promotion compatibility matrix enforced server-side, a global maximum discount cap in the order management system, and pre-launch stacking tests on every new offer.

## Why BOGO is a stacking magnet

Buy-one-get-one promotions are built on conditions: buy this, get that, sometimes with exclusions and minimums. Each condition is a rule, and rules compose. A BOGO that stacks with a sitewide percentage discount, a loyalty reward, and free shipping is not one promotion anymore. It is four promotions multiplying each other, and the combined discount can go far beyond anything the merchandising team intended.

Bots find these compositions because they test without fatigue. They create carts, apply codes in every order, and record the totals. When a combination yields an 80 percent discount, they scale it: bulk orders through the same flow, sometimes reselling the goods below retail. The merchant sees a successful promotion with great redemption numbers and terrible margins.

## The anatomy of a stacking attack

The typical attack starts with discovery. Bots monitor a merchant's promotions page and coupon feeds, then systematically test combinations in headless browsers. They are looking for two things: offers that the system treats as compatible when they should not be, and sequencing tricks, like applying a percentage discount before a BOGO so the free item is computed against an already-reduced price.

Once a working stack is found, the operation shifts to extraction. Orders go through with the stacked discounts, often using multiple accounts to dodge per-customer limits. The goods are resold or the discounts are monetized through refund arbitrage. Because each individual order looks like a legitimate promotion redemption, the attack can run for weeks before margin reports reveal the damage.

## Stacking rules that actually hold

The fix starts with a promotion compatibility matrix: every offer type gets an explicit list of what it can and cannot combine with, enforced server-side at pricing time. BOGO offers should default to non-stackable with percentage discounts unless merchandising explicitly approves the combination. The matrix needs to be a real system, not a wiki page, because promotions change weekly and human memory does not scale.

The second layer is a global discount cap. No order should be able to exceed a maximum effective discount, regardless of which offers combined to get there. The cap lives in the order management system, applied after all promotions, so it catches combinations nobody anticipated. Set it from margin data, not gut feel: the cap is the line where the order stops being worth fulfilling.

## Monitoring for the next combination

Even with rules and caps, new promotions create new combinations. The monitoring that matters is margin-based, not rule-based. Track effective discount distribution across orders: a sudden cluster of orders at exactly the cap, or a spike in multi-offer redemptions, is the signal that someone found a stack. Alert on the pattern, not on individual redemptions.

Run your own stacking tests before launch. Before any promotion goes live, enumerate its combinations with active offers and verify the totals. This is the same testing the bots do, and doing it first closes the window. Promotions are code, and code needs testing. The merchants who treat offer logic with the same rigor as checkout logic are the ones whose promotions stay profitable.

### Should you just ban coupon stacking entirely?

A blanket ban punishes legitimate shoppers who found two valid offers. The better approach is explicit stacking rules: define which offer types combine, set a maximum total discount, and enforce it in the pricing engine rather than the UI. Shoppers accept clear rules; they resent rules that only apply at checkout.

### How do bots find stackable combinations faster than your team?

They test systematically. Bots enumerate offer codes, cart conditions, and checkout sequences, recording which combinations apply. A human tester tries dozens of combinations; a bot tries thousands overnight. Assume every published offer will be tested against every other offer within days.

### What is the right maximum discount cap?

It depends on margin structure, but most merchants land between 30 and 50 percent off the pre-discount total. The cap should be set in the order management system, not just displayed in the cart, so that even a manipulated frontend cannot push the total below it.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@botbulwark.com?subject=Free%20free%20bot-traffic%20audit)