Promo fraud abuses promotional incentives, such as signup rewards, referral bonuses, codes, or discounts, through fraudulent accounts or activity. It is a business-flow exploit: the attacker targets how the application creates value rather than only its technical controls. section 1.4
Fake accounts drain promotions
An attacker creates many fake accounts to collect signup or referral rewards. PayPal reportedly closed 4.5 million fake accounts in Q4 2021, and its stock value fell 25%. section 1.4
Figure 1.5 Every input parameter in an API represents an attack vector, including URLs, query and path parameters, request headers, and payloads. Unconstrained user input allows hackers to send malicious requests to our API to harm our system or cause unexpected behaviors.
Treat promotional endpoints and every input parameter as potential attack surfaces; unrestricted inputs can enable malicious requests and unexpected behavior. section 1.4
