ECM-37Recommended
Limit each coupon per customer instead of per account
Enforce each coupon's limits on the server, with a unique constraint on its use per customer. Count a customer by normalised email, payment card fingerprint and delivery address, not by account alone.
How to do it
A first-order coupon that checks only the account is used once per new email address. Mark the coupon used in the same transaction that places the order. Then ten parallel requests cannot all use it, as Make each change happen exactly once explains. Normalise the email as Compare email addresses and usernames in one canonical form shows. Store keyed hashes of the identifiers, as Spot banned people who sign up again does. Release the use when the order is cancelled before it ships.
Examples
SQL example
CREATE TABLE coupon_use (
coupon_id uuid NOT NULL,
customer_hash bytea NOT NULL, -- keyed hash of email, card fingerprint or address
order_id uuid NOT NULL,
PRIMARY KEY (coupon_id, customer_hash)
);
How to check
A test uses a one-per-customer coupon from two new accounts with the same card and delivery address. The second order is refused the coupon. Ten parallel requests with one single-use code produce one discounted order.
Related rules
- SEC-60 Make each change happen exactly once in Adversarial testing
- ACC-4 Compare email addresses and usernames in one canonical form in Accounts and identity
- TNS-13 Spot banned people who sign up again in Trust and safety
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ecommerce/promotions-and-fraud/coupon-limits">Agent Wranglers e-commerce and fulfilment playbook</a>. In code you write, add a comment next to it with the same link.