Guide
How shoppers reuse one-time discount codes
A first-order discount is supposed to be claimed once. Getting round that takes no technical skill and about four seconds. Here is exactly how it works, how to check your own orders by hand, and how to work out what it has actually cost you — rather than taking anyone’s word for a number.
Shopify checks the email address, not the person
When you set a discount to “one use per customer”, Shopify enforces that against the customer account — in practice, the email address. That works exactly as designed. The problem is that one person can hold an unlimited number of email addresses that all deliver to the same inbox.
Four common routes, in rough order of how often they turn up:
1. Plus-aliases
Gmail, Outlook, Fastmail and others treat everything after a + as a label.
jane.doe+1@gmail.com, jane.doe+shop@gmail.com and
jane.doe+again@gmail.com all arrive in the same inbox. To Shopify they are
three unrelated customers.
2. Dot variants
Gmail ignores dots entirely. janedoe@gmail.com,
jane.doe@gmail.com and j.a.n.e.d.o.e@gmail.com are one mailbox.
This one is less well known than the plus trick and correspondingly harder to spot by
eye, because the addresses genuinely look different.
3. Disposable inboxes
Temp-mail services hand out a working address that survives long enough to receive an order confirmation and then evaporates. There are hundreds of such domains. A shopper using one is not necessarily abusing anything — some people simply do not want marketing email — but a discount claimed from a throwaway address that has never been used before and will never be used again is worth a second look.
4. Guest checkout
No account, no history, nothing to match against. Guest checkout is the plainest route of all, and the hardest to do anything about at the moment of purchase.
Check your own store, by hand
Before believing anyone about the scale of this — including us — look at your own orders. This takes about twenty minutes for a store with a few hundred orders and needs no software.
- In your Shopify admin, open Orders and filter by the discount code you want to check. Use a first-order or welcome code; those are the ones worth protecting.
- Export the filtered orders to CSV. You want the email, shipping address and total columns.
-
Add a column that normalises the email: lowercase it, delete everything
between
+and@, and for Gmail addresses remove dots from the part before the@. Sort by that column. Anything appearing more than once is the same mailbox claiming the code more than once. - Now sort by shipping address instead. Look for the same street address under different names. Be careful here: this on its own proves nothing — see the warning below.
- Finally, scan the email domains for throwaway providers. You will recognise most of them on sight.
A shared address is not evidence on its own. Roommates, couples, families and student houses legitimately share one doorstep. If you treat a repeated address as proof, you will accuse real customers, and that costs far more than a discount. Treat it as corroboration for something else — a matching mailbox, a repeated phone number — never as the reason on its own.
Work out your own number
There is no credible industry figure for this, and you should be suspicious of anyone who quotes you one, ourselves included. What matters is your store. The arithmetic is simple:
(repeat redemptions you found) × (the discount amount) = what it has cost you.
If a £10 welcome discount was claimed 40 times by mailboxes that had already used it, that is £400 of margin given away against your intent. Whether £400 matters is your call and nobody else’s. The figures in this paragraph are an illustration of the arithmetic, not a claim about any real store.
Two things worth adding to the sum. First, the discount is usually not the whole cost: a repeat claimant may also be taking a free-shipping threshold or a bundled offer with it. Second, Shopify’s standard order-access permissions expose roughly the last 60 days, so unless you keep your own exports, whatever you can measure is a floor rather than a total.
What you can do about it
Not all of these involve buying anything, and the first two are free.
Change the offer, not the enforcement
A discount that triggers on a threshold rather than on being new — spend over a certain amount, or buy a specific bundle — cannot be farmed by making new accounts, because the condition is about the order rather than the person. For some stores this removes the problem entirely and is the right answer.
Shorten the window
Codes that expire quickly and campaigns that run for days rather than permanently give a repeat claimant far less to work with. Less flexible, but free.
Check manually, periodically
The audit above, run once a quarter, will tell you whether this is a real problem for your store. Many stores will find it is not, and that is a perfectly good outcome.
Match identities automatically
If it is a real problem and the manual check is too slow to repeat, this is the point at which software earns its place — by normalising every email, comparing addresses and phone numbers, and telling you which orders are the same person, with the reasoning shown rather than a score.
See your own number
DupeGuard runs the audit described above across your recent orders automatically and shows you the figure, before you configure anything. Free plan, no card, and nothing is cancelled or blocked unless you turn that on yourself.