Coupon code leakage: stop paying for leaked codes

Coupon code leakage is what happens when a discount code you gave one partner turns up somewhere you never agreed to: a coupon site, a browser extension, a deal forum. Shoppers who were already at your checkout pick it up, and on an affiliate network the sale can then carry a commission for a publisher who didn't bring the customer. This guide covers how codes leak, how to block the next leak, and how to decline this month's commission on leaked codes before the network approves it.

It is written for Shopify brands running an affiliate programme on a network such as Awin, CJ, impact.com or Rakuten Advertising, where pending sales wait for your validation.

What coupon code leakage is

A code leaks when it is used outside the channel it was made for. The usual cases:

• A creator's code on a coupon site. You gave JANE10 to one creator for her audience; it now appears on a coupon or cashback site, or inside an extension.
• A generic code used by the wrong publisher. A newsletter or welcome code (WELCOME15) ends up credited to a voucher publisher that was never allowed to promote it.
• A private code that went public. A code for staff, customer service or one retention email gets shared and used far beyond the people it was meant for.

The discount is only half the cost. On a network, the same order can also pay commission, plus the network's fee, to whichever publisher the network credits for the sale.

How codes leak

Codes leave the channel they were made for in a few predictable ways:

1. Sharing. Anyone who sees a code in a video, a post or an email can paste it into a coupon site or a deal forum.
2. Collection by coupon sites and extensions. Coupon sites list codes for many shops, and browser coupon extensions try known codes at checkout. Leak-blocking apps on the Shopify App Store name Honey, RetailMeNot and Capital One among the extensions and sites they watch or block.¹²
3. Codes that never expire. A code with no end date and no usage limit keeps working for as long as someone keeps publishing it.

Merchants describe the result in their own words. One Shopify merchant, reviewing an in-house affiliate app, wrote that it “allows coupon aggregator websites (like Honey) to easily scrape codes and hijack regular customer sales”.³ The same thing happens on networks, with one difference: the commission waits in a pending list, so you still have time to act.

Why a network pays for it

A network credits a sale to a publisher by its own tracking rules, which depend on how your programme is set up (link clicks, code tracking or both). A shopper who was already at your checkout, found a code through an extension or coupon site, and used it can end up credited to that coupon publisher rather than to the creator the code belongs to, or to no publisher at all.

The network doesn't know which publisher each code belongs to unless you tell it, and it won't decline the sale for you. On Awin, anything you don't review is approved when the period ends: “If a commission isn't reviewed before the period ends, it will be automatically approved in line with your program's auto-validation settings.”⁴

Prevention: block the next leak

Prevention happens in Shopify, before the order exists. Shopify's discount settings give you three levers without any app:⁵

• Maximum discount uses. “Limit number of times this discount can be used in total” caps a code; set it to 1 for a code meant for one person, such as a customer-service goodwill code.
• One use per customer. “Limit to one per customer” stops the same shopper reusing a code, tracked by email address or phone number.
• Eligibility. Instead of “All customers”, limit a code to Specific customers, a Customer segment (for example, customers with no previous orders, if the code is a first-order offer) or certain Markets.

Add an end date to every partner code, and replace a creator's code when a campaign ends instead of leaving it live.

Leak-blocking apps go one step further. KeepCart describes itself as “Stop Coupon Leaks with Extension Blocking, Alerts, and more!”, with plans that block coupon extensions at checkout and alert you when codes appear on coupon sites.¹ Omnipotent's listing reads: “Regain lost profits. Monitor and block discount code leaks. Stop undeserved affiliate payouts.”² Other leak blockers are listed on the App Store too.

Correction: decline the commission while it is pending

On networks, the commission on a leaked-code sale is removed the same way as the commission on a refund: you decline it before the validation period ends.

Awin names it directly. Among the legitimate reasons to decline, its help centre lists a breach of programme terms, including “Unauthorized voucher code use”. It also recommends making sure your programme terms clearly set out partner restrictions, because “Inaccurate or unexplained declines can damage partner relationships.”⁶

That gives you two rules:

1. Your terms come first. Write down which publishers may use which codes, and that sales through a code a publisher wasn't given may be declined. Without that clause, a decline for voucher misuse is hard to defend. If your terms don't cover it yet, add the clause now and apply it from the next cycle.
2. Decline with the evidence in the reason. “Code JANE10 is assigned to publisher 123456 (creator); sale credited to publisher 654321 (coupon site). Unauthorised voucher use per programme terms §4.” A publisher can check that in a minute.

On Awin, declines can be done row by row, or in bulk on Awin Classic with the Declined template. The guide to declining Awin commissions has the menu paths and file rules.

A code-owner table you can copy

You can't tell a leaked-code sale from a legitimate one without knowing who owns each code. Keep one table, one row per code, and update it whenever you create a code. The rows below are sample data.

Three columns do the work: the code, the publisher allowed to earn on it (or “no publisher”), and the dates. Store it next to your programme terms, so the terms can point to it.

Finding leaked-code sales in your exports

The check needs two files you already export for returns: your network's pending transactions (with the order reference and the publisher) and your Shopify orders export, which has a Discount Code column. Match them on the order number, as in step 3 of the Awin decline guide, then add the code owner.

With the Shopify discount code in column J of the network sheet and the code-owner table on a sheet called Codes (code in column A, allowed publisher ID in column B):

=XLOOKUP(J2, Codes!A:A, Codes!B:B, "NOT IN TABLE")

Then compare that with the publisher the network credited:

• Allowed publisher = credited publisher → the code was used as agreed; leave it.
• Allowed publisher is a different ID, or “no publisher” → a candidate for decline as unauthorised voucher use, if your terms say so.
• NOT IN TABLE → an unknown code. Find where it came from before deciding, then add it to the table.
• No discount code on the order → not a voucher question; the order is checked for refunds and cancellations as usual.

Sales on refunded or cancelled orders are declined for that reason first. The voucher check is for orders the customer kept.

Evidence to keep

Publishers can ask about a decline after the fact. For each leaked-code decline, keep:

• the order number, date and discount code from the Shopify export;
• the network transaction ID and the publisher it was credited to;
• the code-owner row that shows who the code belongs to, as it was on the order date;
• the clause in your programme terms that the decline relies on;
• where the code was found, if you know (a dated screenshot of the coupon site or a leak alert).

Keep these with the batch file you uploaded. If the same publisher appears month after month, the record makes the conversation about their promotion method easier, or supports removing them from the programme.

When you want this every cycle without the spreadsheet, voucher rules keep the code-owner table and flag each sale where a code was used by a publisher it wasn't given, and decline files produce the upload.