You sent a 20% VIP code to your 500 best subscribers. You did it on a Tuesday, to reward your loyal customers. By Thursday, it's circulating on a deals site.
Your team doesn't see it. Sales go up, and so does revenue. Nobody looks at what those sales cost in discounts.
What is a leaking promo code?
A leaking promo code is a code meant for a small audience but used by many other people. Every extra order costs you the discount granted. To limit the damage, you need to spot abnormal usage fast, put a figure on it in euros per day and alert the right person. It is a margin problem.
What it costs, in euros per day
Take an illustrative example, not drawn from any client.
Your average order value is €90. The code offers a 20% discount, or €18 per order. The code was only meant for 500 subscribers. Once posted on a deals site, it's used for 150 extra orders a day.
The math:
- 150 orders × €18 discount = €2,700 a day in margin given away.
- Three days before anyone notices: €8,100.
- One week: €18,900.
These orders aren't all lost. Some customers would have bought without a discount. Others would never have come. But you granted €18 off each one without deciding to.
This risk is common. According to the Merchant Risk Council, in 2024, 45% of merchants surveyed ranked first-party fraud (abuse committed by customers themselves) among their two biggest fraud problems (source: Merchant Risk Council, 2024). Promo codes are among the abuses in question.
How a code ends up in the wild
A code doesn't always leak out of malice. Here are the most common cases:
| Source of the leak | Concrete example |
|---|---|
| Voluntary sharing | A subscriber posts their VIP code on a deals forum |
| Browser extension | A comparison tool tests your codes on the customer's behalf |
| Throwaway account | The same customer creates ten accounts to reuse a welcome offer |
| Expired code still active | A rule not properly closed after a campaign |
| Unplanned stacking | Two promotions add up when you thought you'd blocked it |
None of these situations requires any intent to harm. A generous subscriber sharing their VIP code isn't thinking about your margin. A forgotten campaign code stays active simply because nobody thought to close it. The result is the same: discounts granted that you never decided on.
In all these cases, the code works perfectly. Your site doesn't crash. No standard alert fires.
That's why your usual tools don't show it. An audience analytics tool like GA4 describes your traffic. A technical monitoring tool like Datadog checks that your systems are running. Neither tells you: "this code is costing you €2,700 a day". We explain the difference in our article on what GA4 and Datadog don't see.
Why Black Friday makes it worse
Black Friday falls on November 27, 2026. Traffic is higher, there are more codes, and deals sites relay them within hours.
A code that leaks at that point hits more orders than on an ordinary Tuesday. The same mechanism, on multiplied traffic, therefore costs more. We detailed this calculation in our article on the cost of bugs during Black Friday.
Your team is also less available. Campaigns are live, the site is frozen, everyone is watching their own priority.
What you can do today
You can reduce the risk before even talking about tools. Here are five concrete actions:
- Limit each code to one use per customer. It's the simplest and most effective rule.
- Set a short end date. A code valid for 48 hours has less time to circulate.
- Cap the total number of uses. When the cap is reached, the code stops on its own.
- Replace visible codes with a personalized link when the campaign allows. The link follows the customer, not the code.
- Assign someone to check usage at the start of every campaign. Without an owner, nobody looks.
These five actions take less than a day to set up, and they cost nothing. Start with the codes for your next big campaign, Black Friday for example. For each one, check who should be able to use it, until when, and how many times in total.
These rules reduce the risk. They don't eliminate it. A badly set cap or a forgotten code will always slip through.
Which leaves one question: if one of your codes goes off the rails tonight, who will know tomorrow morning, and with what figure?
How Korvus sees the leak and alerts you
Korvus monitors your site continuously. When a code circulates outside its intended audience, it spots who is using it and since when. A referral code shared on a forum and a code left active after a campaign ends are two cases it detects.
It then puts the leak in euros. You get a message, with no chart to interpret: which code, how many orders, how much discount diverted.
The alert goes to the right person via Slack, email or SMS. Your tech team isn't involved. Setup takes 10 minutes, with no complicated configuration and no dashboard to open.
Korvus doesn't fix anything. It makes visible what's happening and what it costs. The decision stays yours: close the code, limit it or let it run for a specific campaign. But you decide with a figure in hand. You can see what this kind of alert looks like on the promo codes section of our Sentinels page.
Korvus works cookieless and without prior consent. The platform is French, hosted in Paris and GDPR compliant by design. To see this approach as a whole, read Revenue Leak Management: the category that didn't exist.
Frequently asked questions
How do I know if one of my promo codes has leaked?
Look at daily usage and compare it with the intended audience. A code sent to 500 people and used 800 times in two days has leaked. Also check where buyers come from: a surge from a deals site is a clear signal.
Should I stop using promo codes to avoid leaks?
No. Codes remain an effective lever. They need guardrails: one use per customer, a short end date, a global cap. And above all, seeing quickly when usage goes off the rails.
Is a leaked code always a pure loss?
No. Some buyers would have ordered without a discount, others wouldn't have come at all. Either way, you gave away margin without deciding to. The right reflex is to measure what the code costs, then decide whether it's worth keeping.
Who should be alerted when a code goes off the rails?
The person who can act: the CMO, the head of e-commerce or the promotions manager. Not the tech team, because the site works. The problem is commercial and it's solved in a few clicks on the promotions side.
Does Korvus replace my promotions management tool?
No. Your promotions tool creates and applies the codes. Korvus observes what actually happens on your site and puts the gap in euros.
Your site is losing money right now. Korvus alerts you and tells you how much.