Skip to content

Blog

Bonus Abuse Prevention: Why Verified Spend Isn't Enough

Bonus abuse prevention is the set of checks that stops one person, or one organised group, from collecting an incentive many times over; it matters because incentives get farmed even when the activity behind them is real, as a study of crypto airdrops found when up to 66% of airdropped tokens were sold quickly, often in the recipient's first transaction after claiming. Real activity is the starting condition for an incentive. It doesn't stop the incentive from being farmed.

Most bonus abuse guides are written by fraud-tool vendors and focus on fake sign-ups and bots. This one is for crypto trading venues and prop firms paying for acquisition with credit, bonuses or cashback. It covers the abuse that survives identity checks and verified activity, and the two controls that decide whether credit stays credit: when you check, and how much turnover you require.

What bonus abuse looks like on crypto venues

GeeTest's overview of bonus abuse groups it into sign-up, referral, deposit or cashback, loyalty and promo-code abuse. On a crypto venue the same groups show up with a crypto signature:

Type What it looks like Signal that links it
Sign-up bonus farming Many new accounts, each taking the welcome credit once Shared devices, IPs or funding wallets
Referral farming One person referring their own second, third and tenth accounts Referrer and referee share a funding source or device
Deposit bonus cycling Deposit, take the bonus, meet the minimum activity, withdraw, repeat Deposits and withdrawals to the same external wallet
Cashback farming Real spend or trades routed through many accounts to collect cashback on each One wallet funding many accounts; one payout account shared by many earners
Community-coordinated claims A group shares instructions to extract an incentive at scale Similar timing, amounts and destination accounts across unrelated-looking users

The last two are the hardest, because every individual action is genuine. The spend settled. The trades happened. Each account, viewed on its own, looks like a customer.

Why verified spend isn't enough

Verification answers one question: did this activity really happen? Bonus abuse asks a different one: is the person collecting the incentive the customer you meant to pay for?

The two separate quickly. A group can spend real money on real cards, or trade real volume, and still collect an incentive designed for one new customer ten times over. The airdrop research makes the same argument at a larger scale. Its authors list Sybil vulnerability (one actor posing as many) among the common design pitfalls, and they attribute most of the fast selling to "airdrop farmers" who tune their activity to the eligibility rules.

So prevention has to answer three questions, not one:

  1. Is the activity real? Settled, not reversed, counted once.
  2. Is the claimant who they say they are, and allowed to claim here? Terms accepted, country permitted, not on a blacklist.
  3. Is this claimant linked to other claimants? Shared funding wallets, shared payout accounts, shared devices.

Most programs check the first question well, the second partly, and the third by hand after the money has gone.

Turnover: the control that keeps credit from becoming cash

The strongest single control isn't a detection rule. It's what the credit can do once it lands.

Credit that can be withdrawn immediately is cash, and it gets farmed like cash. Credit that must be used on the venue first costs the venue far less, and is far less attractive to a farmer. That's the job of a turnover requirement (called a wagering requirement in gambling): the multiple of the credit that must be traded, wagered or applied before anything can be withdrawn.

Turnover can be set too high as well as too low. In the UK, the Gambling Commission capped wagering requirements at ten times on gambling incentives from January 19, 2026, saying the cap "decreases the likelihood of harm, reduces complexity, and improves transparency." The announcement used a 50 times requirement on a £10 bonus to show the problem. The rule binds licensed gambling operators, but the reasoning carries over: a requirement nobody can meet isn't an incentive, it's a trap.

For a trading venue or prop firm, the useful equivalents are simpler:

Platform type Turnover that fits What it stops
Trading venue Trade a multiple of the credit (for example 1x) before withdrawal, or credit it as fee credit Deposit-withdraw cycling of free credit
Prop firm Credit applies only toward a challenge purchase Cashing out credit without ever taking a challenge
Casino A play-through multiple within local rules, such as the UK's ten-times cap Withdrawing credit untouched

Check at claim, and again before you pay

Timing matters as much as the checks themselves. A check at sign-up sees an empty account. A check after payout is a recovery exercise. The useful moments are the claim and the payout batch.

At claim. Confirm the terms were accepted, the claimant's country is one you serve, and they aren't on your blacklist. Refuse cleanly and say why.

Before payout. Run the blacklist again, because people get added between claim and payout. Hold claims whose accounts link to others through a shared funding wallet or a shared payout account. Confirm the destination account exists on your venue. If it doesn't, pay nothing until it's fixed.

GeeTest's guidance lands in the same place: "Release bonuses only after verifiable engagement" and "assess risk before issuing any bonus." The difference on a crypto venue is that the strongest links between accounts are on-chain and in payout details, not in browser fingerprints.

Where Fanback fits

Fanback runs Platform-funded cashback for crypto cards, and the checks sit between the cardholder's claim and the Platform's payout. On the checks page they are:

  1. Settled. Only settled card purchases earn, verified at the issuer, and each purchase earns once. Refund reversal is coming.
  2. Terms. Accepted before the first claim.
  3. Country. The Platform's restricted countries are refused at claim.
  4. Blacklist. Checked at claim, and again before export.
  5. Shared identity. Coming: one wallet funding many accounts, or one username across cardholders, held before anyone pays.
  6. Account. The Platform confirms the account. If it isn't found, nothing is paid until the cardholder fixes it.

On top of the checks, the Platform sets turnover before withdrawal, and unclaimed cashback expires after 90 days at no cost. The fifth check is the one that matters most for organised farming, and it's marked as coming, not live. Until it ships, a Platform can refuse any claim before it pays, and every claim arrives with a username it can check.

Frequently asked questions

What is bonus abuse?

Bonus abuse is collecting a promotional incentive in a way its terms don't allow, usually by claiming it many times through multiple or linked accounts. GeeTest groups it into sign-up, referral, deposit or cashback, loyalty and promo-code abuse. The activity behind it is often real, which is what makes it hard to catch.

How do crypto venues detect multi-accounting?

Venues link accounts through what they share: funding wallets, withdrawal addresses, payout accounts, devices and IPs. On-chain data is especially useful, because one wallet funding many accounts is visible even when every account passed its own checks. Linking should happen before payout, not after.

What is a turnover requirement?

A turnover requirement is the multiple of a bonus or credit that must be traded, wagered or used before it can be withdrawn. In gambling it's called a wagering requirement, and the UK Gambling Commission has capped it at ten times since January 19, 2026. Credit with no turnover behaves like cash.

Can cashback be farmed if the spend is real?

Yes. Real spend proves the purchase happened, not that each earner is a separate new customer. A group can route genuine spend through many accounts and collect cashback on each, which is why claims need checks for shared funding wallets and shared payout accounts on top of spend verification.

Should bonus abuse checks run at sign-up or at payout?

Both, but the checks that catch the most run at claim and again before payout. At sign-up an account has no history to link. Before payout you can see shared wallets and destination accounts, and you can still refuse without having paid.

The bottom line

Fraud tools are good at stopping fake accounts. The expensive abuse on crypto venues comes from real accounts with real activity, coordinated to collect an incentive more times than it was meant to pay. Verification can't see that. Linking claims to each other can, and turnover makes the prize small enough that most groups move on.

If you fund acquisition with credit, set the turnover first and the detection rules second. The first decides what a farmer can take. The second only decides how often. For how this sits inside a wider acquisition budget, see crypto exchange user acquisition beyond affiliates, and for the Card program side of the same network, how crypto card cashback is funded and merchant-funded rewards for crypto cards.

Sources