Finic
ContactTry the API
Merchant and platform risk

Detect sign-up bonus and referral reward abuse

Grayson decides whether a sign-up bonus or referral reward is being claimed through multiple accounts, a referral ring or staged deposits, and whether to pay it, hold it, deny it or close the account.

Grayson reviews a reward your rules held before paying it, such as a sign-up bonus, referral reward, cash-back or offer payout, and returns how likely it is to be abuse, which pattern it follows, whether the account is controlled by the same person as other accounts, and whether to pay, keep holding, deny, or deny and close. It reads what your platform already holds, from the promotion's terms and the signup checks to devices, the referral tree, linked accounts and every transaction since opening, and costs about $0.35 to $0.40 per 1,000 decisions.

  • Decides: Whether a sign-up, referral or offer reward is being abused, how, and whether to pay, hold, deny or close.
  • Call it: When a rewards rule holds a sign-up bonus, referral reward or offer payout before it is paid
  • Questions: 1 score, 2 choice, 1 yes/no
  • Cost: $0.00035 to $0.00040 per decision ($0.35 to $0.40 per 1,000) for these examples' 10,027 to 11,330 input tokens
  • Latency: 182 to 205 ms for these examples, the median of 5 calls each through api.finic.ai from US-West

Examples

Three held rewards at a consumer fintech app, each sent with the promotion's terms, the signup checks, devices and logins, every transaction since opening, the referral tree and the accounts that share something with it. They are a referee in a 17-account referral ring run from emulators, a husband his wife referred, and a deals-site customer whose phone opened a different customer's bonus account last year.

Open in Playground

Open in Playground

Open in Playground

A yes/no answer is Grayson's probability that it's true. A choice answer is the top option and Grayson's confidence: 0% when every option is equally likely, 100% when one option has all the probability. A score answer is the expected level, numbering the levels in its criteria from 0, with its confidence measured the same way and, when no level reaches 70%, each level's probability. A multiple-choice answer lists the options at 50% or more.

  • action routes the reward: pay or deny automatically when one option clears a high bar, and send the rest to your analysts. In the ambiguous example Grayson favors paying while giving the deny options about 10%; a team that holds whenever the deny options pass a few percent would hold it.
  • abuse_pattern picks the follow-up: a referral ring means reviewing the referrer and every account in its tree, multi-accounting means checking the other accounts of the same person, and a bust-out means checking for returned deposits and chargebacks.
  • linked_to_other_accounts is about the account, not the reward: when it is high, review the linked accounts' rewards too, even ones already paid.

Call it from your code

Save an example as request.json, such as legitimate.json, and send it with your API key in GRAYSON_API_KEY:

curl https://api.finic.ai/v1/decide \
  -H "Authorization: Bearer $GRAYSON_API_KEY" \
  -H "Content-Type: application/json" \
  --data @request.json

The problem

Abuse rules key on shared attributes, and so do real households: spouses share an address, Wi-Fi and a surname, and roommates share an IP. A rule strict enough to catch a ring that rotates emulators and prepaid cards also holds every family referral, and a person with a factory-reset phone and a new email passes rules that look only at one attribute at a time. Analysts end up reading the whole account by hand to tell the two apart.

What to send

Send the held reward with what your platform knows about the account and the people around it. The examples send about 10,000 to 11,500 input tokens each.

  • The promotion's terms. Who is eligible, what counts as qualifying activity, and the limits, so the answer follows your program's rules.
  • Signup checks. Identity verification, email and phone age and type, and the signup session: a two-day-old email, a VoIP phone and fields pasted in seconds describe a farmed account.
  • Devices and networks. Emulator, app cloner and root detections, how many accounts each device has opened, and proxy scores. A device reset between owners is common with used phones.
  • The qualifying activity and the money afterward. Who sent the "direct deposit" and how many new accounts it paid, and how fast the money left and to where.
  • Payout and funding methods across accounts. One prepaid card receiving payouts from a dozen names is the clearest link in a ring.
  • The referral tree and linked accounts. The referrer's own history, its other referees and their status, and every account sharing a device, card, bank account, address or phone, with what that link is.
  • Earlier rewards and clawbacks, and anything the customer has said.

Add your own policy

Programs differ on who may refer whom and on when to close an account, so put your operating rules in the request and Grayson applies them. This one makes referrals between people at the same address ineligible, without treating them as abuse.

Your household rule adds this to the state of the legitimate example:

{
  "rewards_policy": "Referral program operating rule RP-6 (rev. 2026-07): A referral between two people who live at the same residential address is not eligible for either referral reward, even when each has their own identity, phone, device and pay, because the program pays for bringing in new households. Deny both rewards with the standard household notice and keep both accounts open. Don't treat it as abuse, and don't close or restrict either account unless there is other evidence of abuse."
}
QuestionWithoutWith your household rule
abuse_likelihood0.02 of 4, confidence 98%0.05 of 4, confidence 97%
abuse_patternlegitimate, confidence 99%legitimate, confidence 50%
linked_to_other_accountsUnder 1% true1% true
actionpay, confidence 99%deny, confidence 98%

In the likely legitimate example, Marcus and his wife Megan co-own the home at the shared address, so under this rule the action moves from paying the referral reward to denying it, while the abuse likelihood stays low and the accounts are still judged to belong to two different people. abuse_pattern moves part of its weight to other_abuse, because the rule makes the referral ineligible without making it abuse.

Where to call it

  • When a rewards rule holds a payout, before an analyst opens it, so clear cases are paid or denied on the spot.
  • Before paying out at scale, for example on every referral reward from a referrer with an unusual number of referrals this month.
  • On already-paid rewards when a new link appears, such as a shared payout card, to decide whether to claw back and close.

Cost and latency

ExampleInput tokensPer decisionPer 1,000 decisionsLatency
Obvious10,058$0.00035$0.35185 ms
Legitimate10,027$0.00035$0.35182 ms
Ambiguous11,330$0.00040$0.40205 ms

You pay only for input tokens, at $0.035 per million, and each request is rounded up to the next millionth of a dollar, so a request with a larger state costs proportionally more; every response reports its size in usage.input_tokens. Latency is the median of 5 calls each through api.finic.ai from US-West, and grows with the number of input tokens. Add your own network time to api.finic.ai.

Evaluate on your own data

Score Grayson on your own past cases before you use it: a CSV with one row per case and a column with the right answer to each question. Every other column is sent as the case.

pipx install https://docs.finic.ai/downloads/grayson_cli-0.4.0-py3-none-any.whl
grayson eval my-cases.csv --questions https://docs.finic.ai/recipes/promotion-abuse-detection/questions.json --label abuse_likelihood=<column> --label abuse_pattern=<column> --label linked_to_other_accounts=<column> --label action=<column>

Each --label names the column with that question's right answer:

  • abuse_likelihood: a level, such as "Very likely (over 90%)"
  • abuse_pattern: legitimate, multi_accounting, referral_ring, fake_offer_completion, bonus_bust_out, other_abuse
  • linked_to_other_accounts: true or false
  • action: pay, hold_for_review, deny, deny_and_close

Or run grayson on its own to set up your questions step by step. You get each question's accuracy and a CSV with Grayson's answer next to yours for every case.

Evaluate on your own data

How it works, what you get, and every option.

FAQ

Is a customer who joins only for the bonus committing abuse?

Not by itself. Someone who opens their first account for a bonus and meets the terms has done what the promotion asked, even if they move the money out afterward. The questions here treat abuse as breaking the terms: an extra account for a person who already has one, a self-referral, or qualifying activity that was staged or will be reversed. If your program also excludes people who open accounts mainly for bonuses, say so in the request, as with the household rule above.

Can Grayson see a whole referral ring from one account?

Only what the state contains. Send the referrer's other referees with their devices, payout methods, deposits and status, and the counts your link analysis already computes, such as how many accounts a payout card or deposit originator serves. With that, one referee's request is enough to judge the ring and to decide to close the accounts it controls.

What should we do when the answer is uncertain?

Keep holding the reward and ask for the one fact that would settle it. In the ambiguous example that is how the customer came to have the phone, and a document and selfie check showing that he isn't the earlier account's owner. Then call Grayson again with the answer in the state.

Detect account opening fraud and synthetic identities

Approve, step up or decline a deposit account application at risk of stolen or synthetic identity fraud.

Review merchant risk alerts on your payments platform

Whether a flagged merchant's activity is real business or fraud, how likely a loss is, and whether to hold payouts

Recipes

Every use case, with its questions and cost per decision.

Merchant risk alerts

Grayson reviews a flagged merchant's processing, payouts and onboarding record, separates real growth from bust-out fraud, transaction laundering and stolen-card attacks, and picks the action, from clearing the alert to holding payouts or closing the account.

Claims and customer contacts

Fraud and scam claims, and the customer calls, chats and emails that report them. Ready-to-run Grayson recipes with real responses, cost and latency.

On this page

ExamplesCall it from your codeThe problemWhat to sendAdd your own policyWhere to call itCost and latencyEvaluate on your own dataFAQIs a customer who joins only for the bonus committing abuse?Can Grayson see a whole referral ring from one account?What should we do when the answer is uncertain?Related recipes