Stopping Discount Leakage with Single-Use Codes Locked to the Cart

Any system that gives different shoppers different prices has a leakage problem waiting for it. One shopper negotiates a good deal, screenshots the code, and posts it to a coupon site. Within a week, everybody has your best price and you did not agree to that with any of them.

The mechanism to prevent this is not complicated, but it has to be complete. Half of it is worse than none, because it looks safe.

Four scopes, all of them necessary

A negotiated discount code should be bounded on four axes.

Single use. The code works once and is consumed. Shopify supports a usage limit of one directly, and this is the floor of the protection, not the whole of it — a code posted publicly with a usage limit of one still means one stranger got a deal that was not theirs.

Scoped to the product. The deal was struck on one item. The code should apply to that item and nothing else. Without this, a shopper who negotiates hard on a cheap item can take the percentage they won and spend it on your most expensive one, which is a strictly worse trade for you than the one you agreed to.

Scoped to the quantity. If the negotiation was for one unit, the discount applies to one unit. A percentage that silently applies to a cart of ten is a different deal entirely.

Expiring with the deal. This is the one people leave out, and it is the one that does the most work. A negotiated price should carry a clock — thirty minutes is reasonable — after which the code stops working. A screenshot posted to a forum is worthless by the time anyone reads it.

Miss any one of these and the leak reopens. Together they make a code that is genuinely only useful to the person who earned it, in the window in which they earned it.

The timer does double duty

Worth pausing on the expiry, because it is doing two jobs and both are useful.

Defensively, it is what makes a leaked code harmless. Offensively, it is the thing that closes the sale. A shopper who has just negotiated a price and can see a clock on it behaves very differently from one who has an open-ended code sitting in their inbox. They bought in — they spent three rounds working for that number — and now there is a reason not to leave and think about it.

This is loss aversion, and it is entirely legitimate here in a way that a fake “only 2 left!” banner is not. The deadline is real. The deal genuinely does expire. Nothing is being fabricated to create urgency; the urgency is a side effect of a security property.

Apply it, don’t ask them to type it

Once the code exists, hand it over properly. A shopper should not have to copy a string and paste it into a discount box at checkout, for two reasons.

The obvious one is drop-off. Every manual step between “I want this” and “I have paid” costs you a proportion of the people standing in it, and a copy-paste on a phone costs more than you would guess.

The subtler one is that the code becomes visible and portable the moment you show it. If the shopper never needs to see the string, it is considerably less likely to end up on a forum.

Applying the discount through the cart on the way to checkout solves both. The shopper taps through and the price is simply correct.

Re-check basket conditions at the end

One more failure mode, specific to rewards earned by doing something to the cart.

Suppose a shopper earns a reward for adding a companion item, strikes a deal that includes it, and then removes the companion item before checking out. If the discount was computed when the deal was struck and never revisited, they now have the reward without the condition.

The fix is to have checkout evaluate the basket conditions itself, at the moment of checkout, rather than trusting a decision made minutes earlier in a widget. Shopify’s discount functions are the right tool: they run against the actual cart at the actual time. A condition that is no longer met simply does not produce its discount, and the shopper sees the correct total.

The general principle: anything the shopper can change after the deal is struck must be verified after they have stopped changing it. Anything they cannot change — the product, the quantity you scoped to, the clock — can be settled up front.