Prevent Coupon Abuse & Multi-Account Promo Exploitation

// Promo code redemption handler (Node.js example)
import axios from 'axios';

app.post('/api/apply-promo', async (req, res) => {
  const { email, promoCode, userId } = req.body;
  const userIP = req.ip;

  try {
    // Validate with IPASIS
    const ipasisResponse = await axios.post(
      'https://api.ipasis.com/check',
      {
        ip: userIP,
        email: email
      },
      {
        headers: {
          'Authorization': `Bearer ${process.env.IPASIS_API_KEY}`,
          'Content-Type': 'application/json'
        }
      }
    );

    const { trustScore, signals } = ipasisResponse.data;

    // Check if promo has been used before
    const promoUsage = await getPromoUsageHistory(promoCode);

    // Define abuse risk level
    let abuseRisk = 'low';
    let allowPromo = true;

    // High-value promos: stricter threshold
    const isHighValuePromo = promoCode.includes('50OFF') || 
                            promoCode.includes('FREE');

    const threshold = isHighValuePromo ? 70 : 50;

    if (trustScore < threshold) {
      abuseRisk = trustScore < 30 ? 'high' : 'moderate';
      allowPromo = false;

      await logBlockedPromoAttempt({
        email,
        ip: userIP,
        promoCode,
        userId,
        trustScore,
        signals,
        reason: `Trust score ${trustScore} below threshold ${threshold}`
      });

      return res.status(400).json({
        error: 'Promo code not eligible',
        message: 'This promo code cannot be applied to your account.'
      });
    }

    // Check for suspicious patterns
    if (signals.isDisposableEmail || signals.isVPN) {
      await flagSuspiciousPromoUse({
        email,
        ip: userIP,
        promoCode,
        userId,
        trustScore,
        signals
      });

      // Allow but require verification for moderate risk
      if (trustScore < 60) {
        return res.status(200).json({
          success: false,
          requiresVerification: true,
          message: 'Please verify your email to apply this promo.'
        });
      }
    }

    // Apply promo code
    const discount = await applyPromoCode({
      userId,
      promoCode,
      email,
      trustScore,
      ipAddress: userIP
    });

    // Track for analytics
    await trackPromoRedemption({
      userId,
      email,
      promoCode,
      discountAmount: discount.amount,
      trustScore,
      timestamp: new Date()
    });

    res.json({
      success: true,
      discount: discount.amount,
      message: `Promo code applied! You saved $${discount.amount}`
    });

  } catch (error) {
    console.error('Promo validation failed:', error);

    // Fallback: require manual approval
    await queueForManualReview({
      email,
      promoCode,
      userId,
      reason: 'IPASIS_CHECK_FAILED'
    });

    res.status(400).json({
      error: 'Unable to apply promo',
      message: 'Please contact support to apply this code.'
    });
  }
});

// Trial signup with abuse prevention
app.post('/api/start-trial', async (req, res) => {
  const { email, plan } = req.body;
  const userIP = req.ip;

  const ipasisResponse = await axios.post(
    'https://api.ipasis.com/check',
    { ip: userIP, email },
    { 
      headers: { 
        'Authorization': `Bearer ${process.env.IPASIS_API_KEY}` 
      } 
    }
  );

  const { trustScore } = ipasisResponse.data;

  // Prevent trial abuse: require trustScore >= 50
  if (trustScore < 50) {
    return res.status(400).json({
      error: 'Trial not available',
      message: 'Paid plans start at $9/month. Sign up now!'
      // Don't reveal fraud detection
    });
  }

  // Grant trial access
  const user = await createTrialUser({ email, plan, trustScore });
  res.json({ success: true, userId: user.id });
});