Blog

How to stop referral and signup bonus abuse

10 November 2026 · 7 min read · SignupVet team

To stop referral and signup bonus abuse, pay the bonus only after a real action, limit how much one person can earn, and check every new account at signup against the account that referred it. Most abuse comes from one person collecting the same bonus again with a second, third or tenth account, and that leaves traces you can catch.

This guide shows what the abuse looks like, the steps that stop most of it, and the mistakes that end up cancelling bonuses for real customers.

What bonus abuse looks like

• Self-referral: someone signs up, then refers a second account they also own, and collects both sides of the reward.
• Welcome bonus farming: one person or a script creates many accounts, each claiming the free credits, cashback or sign-up reward.
• Referral rings: a small group refers each other in circles, or trades referral codes in forums and chats, so the rewards go to people who were never real leads.

The first two are the most common and the easiest to catch, because one person is behind the accounts. If you want to put a number on what they cost, the fake signup cost calculator takes about five minutes.

Seven steps that stop most of it

1. Pay the bonus after a real action, not at signup

A bonus that arrives the moment an account is created is free money for anyone who can create accounts. Pay it after something that costs the user effort or money: a first purchase, a first top-up, a verified phone number, or a few days of real use. This one change removes most of the reason to farm.

2. Put a cap on rewards per person

Limit how many referral rewards one account can earn per month, and how much in total. Real customers rarely hit a sensible cap. Someone farming with a script hits it on the first day.

3. Check every new signup

Throwaway inboxes, datacenter IPs and bursts of signups from one network are typical for farmed accounts. Check the email, phone number and IP address when the account is created, before any bonus is granted. Our guide on stopping fake signups covers this layer in detail.

4. Compare the new account with its referrer

This is the step that catches self-referral. When an account arrives through a referral link, compare it with the account that sent it:

• the same email after normalization (Gmail ignores dots and everything after a +)
• the same phone number
• the same IP address or network around the time of signup
• the same card, if both added one (Stripe returns a fingerprint per card)

Our guide on detecting multiple accounts shows how to normalize these values and store them as keyed hashes instead of raw personal data.

// at signup, when the account came through a referral link
const matches = [
  emailKey(newUser.email) === referrer.emailKey,
  phoneKey(newUser.phone) !== null && phoneKey(newUser.phone) === referrer.phoneKey,
  newUser.network === referrer.lastNetwork,
].filter(Boolean).length;

const bonus = matches >= 2 ? "hold_for_review" : "pay_after_first_purchase";

5. Hold, don't cancel, when it looks suspicious

When a referral looks suspicious, keep the bonus pending and look at it later, or pay it once the new account makes a real purchase. A held bonus costs a real customer a short wait. A cancelled one costs you their trust.

6. Watch for waves

A referral code that suddenly brings twenty signups in an hour, or numbered addresses like max1@, max2@, max3@, is almost never organic. Pause rewards for that code and look at the accounts together.

7. Write the rules down

Put the conditions in your terms: one reward per person, no self-referral, rewards paid after the first purchase, and the right to cancel rewards that break the rules. Clear rules make it easier to act and easier to explain to the rare real customer who gets caught by mistake.

Common mistakes

• Cancelling on a shared IP alone. Families, flatmates and colleagues share an IP address, and they are exactly the people who refer each other.
• Paying instantly. Once the bonus has been withdrawn or spent, there is nothing left to hold.
• Telling abusers which rule they hit. A neutral message ("your reward is being reviewed") gives a real customer a way forward and a script nothing to adapt to.
• Only looking at the referrer. Welcome bonuses without a referral link get farmed too, so check every new signup, not just referred ones.

Checking new signups with one API call

SignupVet handles step 3 and part of step 6: it checks the email, phone number and IP address of each new signup and compares it with your recent signups. You get a risk score, the reasons and a recommendation to allow, review or block.

const res = await fetch("https://www.signupvet.com/score", {
  method: "POST",
  headers: { Authorization: "Bearer " + process.env.SIGNUPVET_KEY, "Content-Type": "application/json" },
  body: JSON.stringify({ email, phone, ip: req.ip }),
});
const { recommendation, reason_codes } = await res.json();
// "review" or "block": hold the bonus instead of granting it

Reasons that matter most for bonus farming include disposable_domain, ip_datacenter_asn, signup_velocity_ip, email_series_pattern and phone_reused.

What it does not do: it knows nothing about your referral program, so it does not compare a new account with its referrer (step 4) or pay and hold rewards. It only compares signups within short time windows, and it has no device fingerprinting. The documentation lists every reason code.

Frequently asked questions

What is referral abuse?

Referral abuse is when someone collects referral or signup bonuses they were not meant to get, most often by referring themselves with a second account, or by creating many accounts that each claim a welcome bonus.

How do I stop people from referring themselves?

Compare the new account with the account that referred it: a normalized email address, the phone number, the IP address and the card. If two or more match, hold the bonus for review instead of paying it out. Paying only after a real action, such as a first purchase, removes most of the reason to try.

Should I remove the referral program if it gets abused?

Usually not. Most programs keep working well once the bonus is paid later, capped per person and checked at signup. Abuse is a sign the bonus is worth something, which is also why it works for real customers.

Will these checks block real friends and family?

They can, if you block on a single shared signal. People in the same household often share an IP address, so a shared IP alone should never cancel a bonus. Hold for review on strong or combined signals and block only clear cases.