The Promotion Abuse Prevention Checklist: 8 Questions Every Brand Should Ask Before Launching
Promotion abuse is more common than many brands anticipate- and the consequences are rarely limited to a single disqualified entry.
When a promotion is exploited at scale, it can compromise the integrity of the draw, expose the brand to ASA complaints, and leave the promoter without a defensible position if the Terms and Conditions were not written to support enforcement.
The most effective form of abuse prevention is structural: building the right controls into the promotion before it launches, rather than reacting to problems after they emerge. This checklist covers the eight questions every brand should be able to answer clearly before a promotion goes live.
If you cannot answer all eight of these questions with confidence before launch, your promotion has gaps- and gaps invite abuse.
1. Are your T&Cs explicit about ALL entry restrictions?
Why it matters
If a restriction is not documented in the Terms and Conditions, it is difficult to enforce. Brands that disqualify entries on reasonable but undocumented grounds are likely to find those decisions challenged- by the entrant, or through the ASA.
What to check
- Multiple entries from the same person or household
- Entries from shared IP addresses or devices
- Serial or high-frequency entrants
- Voting organised through forums, group chats, or social media campaigns
- Automated or bot-generated entries
- Entries submitted on behalf of another person
List every restriction explicitly. If there is any behaviour you would consider grounds for disqualification, it should be written into the T&Cs before the promotion opens.
2. Have you defined what ‘abuse’ means in practice?
Why it matters
Broad phrases such as “improper actions” or “fraudulent behaviour” are generally too vague to support a specific disqualification decision. The more precisely abuse is defined, the more defensible enforcement becomes.
What to check
- What constitutes a duplicate entry in your specific mechanic?
- At what volume of votes from a single source does behaviour become suspicious?
- Does using a VPN to circumvent geographic restrictions breach your rules?
- Is coordinating entries through a third-party platform a disqualifying act?
Vague T&Cs do not protect the brand- they protect the entrant.
Want a second pair of eyes before you launch?
3. Can you evidence a breach if you disqualify someone?
Why it matters
A disqualification decision needs to be defensible under the CAP Code. That means having data, documentation, and a clear audit trail, not just a reasonable suspicion that something went wrong.
What to check
- Does your entry platform log the data needed to identify duplicate or suspicious entries?
- Is your judging or verification process documented and consistently applied?
- Does your technical infrastructure record IP addresses, timestamps, and entry volumes at a useful level of detail?
- Is your audit trail maintained in a format that could be shared with a third party if required?
If your technology cannot support the evidence standard your T&Cs require, that is a structural issue worth addressing before launch.
4. Is your promotion mechanic open to loopholes?
Why it matters
Promoters are responsible for the structure of the promotion, not just the messaging. A mechanic that can be exploited is a mechanic that is likely to be exploited- and the brand bears the consequences.
What to check
- Mass entries: can a single person or coordinated group submit at volume, and does your system detect this?
- Coordinated voting: if your mechanic includes a public vote, can it be manipulated through organised group activity?
- Circumventing “one per person”: does your technical implementation actually enforce this, or can it be bypassed with a different email or device?
- Third-party tools: are there browser scripts or automation tools that could interact with your platform in unintended ways?
Every mechanic has at least one potential loophole. Finding it before launch is significantly less costly than addressing it after.
5. Are your judging criteria clear, objective and documented?
Why it matters
For competitions assessed on skill or merit, vague criteria invite complaints. If a judging decision is challenged, the brand needs to be able to demonstrate that the process was fair, consistent, and conducted as described in the T&Cs.
What to check
- Are the criteria published and clearly described in the Terms and Conditions?
- Are the same criteria applied to every entry, by every judge?
- Are judges’ assessments recorded- not just the final outcome?
- If subjective elements are included (“most creative”, “best captures the brand”), is there a documented framework for how they are assessed?
Subjectivity in judging is permissible. Undocumented subjectivity is harder to defend.
6. Are your voting systems fraud-resistant?
Why it matters
Voting mechanics are among the most frequently abused in consumer promotions. Cookie-based controls are generally insufficient- they can be bypassed by clearing browser data, using a private window, or switching devices.
What to check
- Can your system detect duplicate votes across sessions or devices?
- Is automated or bot-generated voting detectable and blockable?
- Does your platform flag IP clustering- where a disproportionate number of votes originate from the same address or range?
- Is someone actively monitoring voting data throughout the campaign, with authority to investigate anomalies?
A spike identified early in the campaign is manageable. The same spike identified on the day of announcement is not.
Not sure your voting controls would hold up in practice?
7. Are your mechanics final, with no need to change them mid-campaign?
Why it matters
ASA Rule 8.23 is clear that promoters should not change the rules of a promotion in a way that disadvantages participants who entered under the original terms. Retrospective changes- however well-intentioned- create compliance exposure.
What to check
- Does the entry mechanic work as described in the T&Cs, end to end?
- Is the prize structure confirmed and deliverable within the stated timelines?
- Have the T&Cs been reviewed against the live mechanic- not just the planned version?
- Has the promotion been tested under realistic entry conditions before it opens?
Changes made before launch are process improvements. Changes made after launch are compliance risks.
8. Have you stress-tested the promotion from both creative and compliance angles?
Why it matters
Creative review and compliance review serve different functions. Creative teams are focused on engagement and brand alignment. Compliance review is focused on identifying the ways a promotion can go wrong, be exploited, or fail to hold up to scrutiny. Both are necessary.
What to check
- Has someone reviewed the mechanic specifically looking for loopholes- not just for quality?
- If a high-value winner is disqualified, do the T&Cs clearly support that decision?
- Are all claims made in the promotional materials accurate and supportable?
- Has the promotion been reviewed by someone with promotional compliance experience, not just legal sign-off?
The strongest promotions are bold in idea and bulletproof in execution. Getting to both requires that the mechanic is reviewed by someone whose job is to find problems, not to champion the concept.
Prevention Is a Design Decision
Promotion abuse prevention is not primarily a technical problem- it is a structural one. The brands that manage it most effectively build compliance into the design of the promotion from the first brief, rather than treating it as a final check before launch.
That means involving compliance expertise early, stress-testing the mechanic before assets are produced, and writing T&Cs that reflect the actual promotion. It also means having the infrastructure in place to detect, evidence, and act on abuse if it occurs.
If you are planning a promotion and would like support ensuring it is structured correctly from the outset, PromoVeritas would be happy to help.
Want confidence before you launch? Book a pre-launch compliance review
Frequently Asked Questions
-
What is promotion abuse?
-
Promotion abuse refers to any attempt by consumers to gain an unfair advantage- through multiple entries, automated voting, coordinated campaigns, or other behaviours that breach the Terms and Conditions. It can compromise the integrity of a prize draw, expose brands to regulatory complaints, and result in drawn-out disqualification processes if the T&Cs are not written to support enforcement.
-
-
What does the ASA expect from promoters on compliance?
-
The ASA CAP Code requires promoters to produce clear Terms and Conditions, conduct promotions fairly and transparently, and be able to evidence their processes if a complaint is received. Promoters should also avoid making retrospective changes to the rules of a live promotion.
-
-
Can a promotion’s rules be changed after launch?
-
ASA Rule 8.23 states that promoters should not change the rules in a way that disadvantages participants who entered under the original terms. Any change after launch needs to be carefully assessed against the Code before it is implemented.
-
-
Are cookie-based voting controls sufficient?
-
Generally, no. Cookie controls can be bypassed by clearing browser data, using private browsing, or switching devices. A more robust system should be able to detect duplicate votes across sessions, flag IP clustering, and identify automated voting activity.
-
-
What is the difference between a prize draw and a competition?
-
A prize draw allocates prizes by random selection. A competition requires entrants to demonstrate skill, with prizes awarded to the best entries. Competitions require clear, documented judging criteria and a consistent assessment process. Both require compliant T&Cs and transparent winner selection.
-
-
How does independent verification support a brand if a promotion is challenged?
-
Independent verification creates an auditable record of the prize draw or judging process that is separate from the promoter. If an outcome is challenged, it provides the evidential basis to demonstrate that the process was conducted fairly and in accordance with the published Terms and Conditions.
-
