Receipt fraud detection for loyalty programs and cashback promotions: a field guide

Most receipt fraud in loyalty programs is not clever. It is the same receipt again. Once you have seen a few hundred thousand submissions to cashback and loyalty promotions, the patterns settle into a short list, and each one has a check that catches it. This is that list.

1. Duplicate receipt photos

The simplest and by far the most common. A participant submits a receipt, gets a reward, and submits the same photo from a second account. Or sends it to a friend. Or posts it in a group chat where forty people submit it. Often the image is cropped or rotated slightly, or has gone through a messaging app that recompressed it, so a byte-for-byte comparison misses it.

What catches it. A perceptual hash of the image, compared against every submission the workflow has processed. Perceptual hashing is tolerant to cropping, rotation, and recompression, which is what makes it useful here. The match is recorded with the submission it matched so a reviewer can see both side by side.

2. Duplicate purchases with a new photo

Slightly more effort. The same paper receipt photographed twice, from two phones, in two lighting conditions. Image matching does not see it. The purchase is identical.

What catches it. An identity fingerprint built from fields that define a unique purchase. Merchant plus date plus time plus total is a good default. Receipt number where the retailer prints one. Exact match on the fingerprint flags it. Similarity matching handles the case where OCR read the total as 87.43 on one photo and 87.48 on the other.

3. Edited totals and inserted lines

A receipt photographed, opened in an image editor, and changed. A total bumped over the minimum basket. A qualifying product pasted in from another receipt. Quality varies from obvious to quite good.

What catches it. Arithmetic. Line items must sum to the subtotal, taxes must be consistent with the subtotal, the subtotal plus tax must equal the total. An edited receipt almost always breaks one of these because editing every dependent figure correctly is tedious. A rule that says “items sum to total” catches a surprising share of tampering with no image forensics at all.

4. Reprints and duplicates from the till

Some retailers reprint a receipt on request. Some print a customer copy and a merchant copy. Both copies of the same purchase get submitted.

What catches it. The same identity fingerprint as pattern 2. The date, time, and total are identical because it is the same transaction. This is also where a “print date versus purchase date” rule helps if the retailer marks reprints.

5. Photos of screens

A receipt displayed on a monitor or another phone, then photographed. Sometimes it is an innocent participant photographing an e-receipt. Often it is a receipt image circulating online.

What catches it. Two things. A capture quality gate scores framing and exposure and rejects many screen photos for moiré and glare before they enter the pipeline. For the ones that pass, the duplicate checks in patterns 1 and 2 catch them, because a receipt that is circulating has usually been submitted before.

6. Out-of-window and out-of-scope receipts

Not exactly fraud, but the same cost. A real receipt from before the campaign started. A real receipt from a retailer that is not participating. The right product from the wrong country.

What catches it. Rules. Purchase date inside the window. Merchant on the participating list. Currency matches. Each one returns a reason, and the reason goes back to the participant, which cuts support tickets more than any other single change we see teams make.

7. Structured abuse

Resellers and organised groups. Dozens of accounts, each submitting just under the per-person limit, all real receipts from bulk purchases. Each submission passes every per-receipt check.

What catches it. Per-participant limits enforced across all channels at once, so the same person cannot claim through the app and then again through the web form. Then reporting. A campaign where 3 percent of participants account for 40 percent of approved receipts is telling you something, and you only see it if approvals are logged with identity.

8. Generated receipts

New in the last two years. A receipt image produced by an image model from a text prompt. Layout plausible, fonts plausible, totals that add up because the model was told to make them add up. These are getting good and there is a separate post on them coming.

What catches it, today. Mostly the same checks as above, because a generated receipt is usually generated once and submitted many times, and because models are still bad at consistency between the merchant name, the address, the tax identifier, and the store number. A rule that cross-checks the tax identifier against the merchant catches many. This is the one category where the checks need to keep moving.

What this list says about loyalty fraud prevention

Two things stand out when you look at the list as a whole.

First, most of the catches come from rules and matching, not from image forensics. Arithmetic, date windows, and duplicate history do most of the work. That is good news, because rules are cheap to write and cheap to explain.

Second, every check in receipt fraud detection depends on history. The same photo, the same purchase, the same participant. A reviewer looking at one receipt cannot see history. A system that indexes every submission can. That, more than any accuracy figure, is why moving from sampled manual review to checking every submission changes the fraud rate.

If you run promotions and want to know which of these patterns show up in your submissions, book a demo and bring an export from a past campaign. Running the duplicate checks over it is usually an interesting afternoon.