Bot Traffic Around Loyalty Points Sales and Bonus Events
Points promotions create predictable, valuable targets. How bots farm bonus events, and what loyalty teams should watch during a promotion.
Loyalty promotions are announced in advance, run on a schedule, and attach real value to account actions. That makes them a clean target: bots create or take over accounts, farm bonus points on cheap qualifying actions, and convert the balance before anyone reconciles the promotion.
This guide covers the patterns that show up during points events, why normal sales defences miss them, and the monitoring and promotion design choices that keep a bonus event generous for members and useless for farms.
Why points events attract farming
A bonus event lowers the cost of value: points that normally require real spending arrive for signups, referrals, app installs, or small purchases. Anything that can be obtained cheaply and converted, into discounts, gift cards, or resold accounts, will be industrialised if the event allows volume.
Account takeover is the other half. Dormant loyalty accounts with old balances are soft targets, and a promotion gives attackers a reason to spend harvested points quickly while the victim assumes the flurry is the brands own event marketing.
Patterns that separate farms from members
Watch for clusters: accounts created in bursts just before or during the event, qualifying actions completed at minimum cost and identical patterns, referrals forming closed loops, and redemptions that follow bonuses immediately rather than at the members usual pace.
Geography and device signals help when read with the behavioural ones: many accounts sharing infrastructure, or a long dormant account suddenly active from a new context at promotion start. Single signals accuse honest members. Clusters are what justify a hold and a review.
Promotion design is a defence
Cap the farmable value: limit bonus earning per account and per payment method, weight bonuses toward actions with real cost or history, and delay convertibility of promotional points for a short window so review can happen before value leaves. A delay members barely notice breaks the farm economics completely.
Keep a hold and review path in the terms, written before the event, and staff it during the event. A promotion with no review capacity is an honour system, and honour systems at scale are just budgets for whoever arrives with the most automation.
Measure the event honestly afterwards
Report promotional cost with the farming estimate included, even if it is a range. An event that looks efficient because abuse was never counted teaches the business to run bigger versions of the same exposure next quarter.
Keep the signal library from each event: the clusters, timings, and redemption paths observed. Farms adapt, but they repeat more than they innovate, and last events patterns are the fastest detection rules for the next one.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: Price Scraping Bots: Reading the Traffic and Protecting Your Catalogue, Bot Traffic During Holiday Sales: Separating Hype From Harm, and Credential Stuffing Bots Are Flooding Your Login Pages.
Frequently asked questions
Why are loyalty promotions targeted by bots?
They attach convertible value to predictable, scheduled actions, often at low cost during a bonus event. Anything cheap to earn and easy to convert will be automated at volume. Dormant accounts with existing balances are targeted at the same time.
What patterns indicate a points farm?
Clusters rather than single signals: burst account creation, identical minimum cost qualifying actions, closed referral loops, immediate redemption after bonuses, and many accounts sharing infrastructure. Clusters justify review. Single odd signals often have honest explanations.
How can promotion design reduce farming?
Cap bonus value per account and payment method, weight bonuses to actions with real cost or history, and delay how soon promotional points can be converted. A short delay barely affects members and removes the instant cash out farms depend on.
How should an event be reported afterwards?
With the estimated abuse included as a range in the promotional cost, and with the observed farming patterns saved to the signal library. Honest reporting prevents the business scaling an exposure it believes was efficient, and speeds detection next event.