How to stop QR coupon fraud in trade reward programmes

Every valid code in a reward programme is worth money, so some people will try to claim codes they did not earn. In programmes for mechanics, electricians, painters and dealers, fraud is rarely one dramatic attack. It is a steady leak: a few duplicate claims here, a bag of empty packs there, a counter that scans stock nobody has sold.

This guide sets out the common kinds of QR coupon fraud, the control that stops each one, and how to stop fraud without making life harder for the genuine trade.

Why do QR reward programmes attract fraud?

A QR reward programme turns a printed code into a payment. Three things make that attractive to abuse:

• The reward is real money or its equivalent. Cash, bank transfers and vouchers are easy to spend.
• The code is physical. Anyone who can see or photograph a code can try to claim it, whether or not they bought, fitted or used the product.
• Many parties touch the product. Distributors, counter staff, mechanics and customers all handle it, so there are many chances to claim before the intended person does.

The aim is not to make fraud impossible, which no system can promise. It is to make each kind of fraud unprofitable, visible and stoppable before payout.

What are the most common types of QR coupon fraud?

How do layered fraud controls work?

No single check catches everything. Programmes that keep fraud low check at five points, in order.

1. At the code. Every unit gets its own code, generated at random so it cannot be predicted, and linked to the product, batch and production date it was printed for. Where the code sits matters: inside the pack, under a lid or behind a scratch panel, it can only be read after purchase or use.
2. At the scan. The server decides, never the app. It checks that the code exists, was issued for an eligible product, has not been used and is being scanned at a plausible time, for example not before that batch could have left the factory.
3. At the participant. The server checks that this person is enrolled, allowed to claim this product, and within their limits for the day or week.
4. At the pattern. Over time, the system looks at behaviour rather than single scans: bursts of scans from one device, scans clustered at a dealer's premises, runs of consecutive serial numbers, or volumes far above what a workshop of that size could use.
5. At the payout. Suspicious claims wait for review before any money moves, and bank details are verified before the first transfer.

The first three layers stop most simple fraud at once. The last two catch the organised kind, which looks normal one scan at a time.

Should you hold suspicious claims or recover them later?

Hold them. Once a reward has reached a bank account or a voucher has been spent, getting it back is slow, costly and often impossible. It also turns a quiet control into a public dispute with a member of the trade.

A good hold process has four parts:

• Clear triggers. Write down which patterns put a claim on hold, and review them as you learn.
• A review queue. Someone, or a model with a person checking its decisions, works through held claims every day.
• A message to the participant. Tell them the claim is being checked and when they will hear back. Silence reads as theft.
• A record of every decision. Released, rejected or escalated, with the reason. The record shows whether your triggers are too tight or too loose.

How to stop fraud without blocking genuine trade

Every control has a cost: a genuine painter whose scan is held for a week may never scan again. Good programmes match the response to the risk.

• Grade the response. Allow normal scans, allow but flag mildly unusual ones, hold clearly unusual ones, and block only what is certainly invalid, such as a code that does not exist.
• Set limits by category and role. A fastener counter may scan hundreds of boxes a day; a painter scans a few packs a job. One limit for everyone is wrong for both.
• Explain rejections. "This code was already claimed on 12 March" is fair. "Scan failed" is not.
• Offer an appeal. A simple route to query a decision keeps trust when a control gets it wrong.
• Decide assisted scanning on purpose. Some programmes let counter staff scan on behalf of a mechanic; others forbid it. Either can work if the rule is clear and the system enforces it.

What to measure

• Rejected scans by reason. Duplicates, invalid codes, limits and holds, by region, batch and period. A sudden rise in one reason points to a specific problem.
• Value held and value saved. The rewards held for review, and the share that turned out to be invalid.
• False alarms. The share of held claims released as genuine. If most holds are released, the triggers are too tight.
• Review time. How long held claims wait. Long waits cost you participants.
• Repeat patterns. Accounts, devices, shops or bank accounts that appear again and again in held claims.

For how fraud losses feed into programme returns, see how to measure the ROI of a loyalty programme.

Fraud control checklist

• Every unit has its own randomly generated code, linked to product, batch and production date.
• Codes are protected inside the pack or under a panel where the product allows.
• Every scan is validated on the server, and each code is accepted once.
• Scans of codes from batches that could not yet be in the market are rejected.
• Daily and weekly limits are set per participant, by role and category.
• Clusters of scans at one location, device or serial range are flagged.
• Suspicious claims are held before payout, with a daily review.
• Bank details are verified before the first payout.
• Participants are told why a claim was held or rejected, and can appeal.
• Rejections, holds and releases are reported every week.

For the wider picture of how QR programmes work, read how QR-based loyalty programmes work for manufacturers.

Where Rewardix fits

Rewardix puts a unique code on each unit and checks it against production data at the moment of the scan, so duplicate, empty-pack and counterfeit claims stop there. Behavioural checks look at scan velocity, clustering at dealer premises, device fingerprints and serial-range patterns, and anything suspicious is held before the money moves. Read how models detect fraud on the AI page, or see the building materials page, where dealer self-scanning is one of the most common patterns.