A small app I helped with last year launched a referral program: invite a friend, both of you get a bonus once they sign up. Simple, generous, built quickly with an AI coding tool over an afternoon. It worked exactly as designed. The problem showed up about two weeks later, in the payout numbers.
What actually happened
One person had generated roughly forty referral signups, each one technically a real, distinct account with a real, working email address, each one triggering the bonus payout correctly, exactly as the feature was built to do. Nothing about the signup flow itself was broken. What was missing was any check on whether the "friend" being referred had any real, independent relationship to the referrer at all, versus being the same person creating account after account to claim the bonus repeatedly.
Why this doesn't feel like a security bug in the traditional sense
Nothing was hacked. No password was stolen, no database was exposed, no access rule was bypassed. Every single one of those forty accounts went through the exact same signup flow a legitimate friend would use. This is a business-logic abuse issue rather than a traditional security vulnerability, and it's worth including on this blog anyway, because it comes from the exact same root cause as everything else here: a feature built to do the happy-path thing correctly, with nobody specifically asking "how would someone abuse this on purpose."
What actually would have caught this before it happened
- Checking for shared signals between the referrer and the new signup: the same device, the same IP address in a short window, email addresses that look like obvious variations of each other.
- Delaying or holding the bonus payout until some minimum sign of genuine activity from the new account, rather than paying out the instant a signup completes.
- Setting a reasonable cap on how many referral bonuses a single account can earn in a given period, a simple limit that doesn't require detecting fraud specifically, just bounding the damage if it happens.
- Simply asking, before launching any feature that pays out real money or credit based on an action, what the laziest possible way to fake that action would look like, and whether anything actually stops it.
Why this belongs on the same checklist as everything else
This is the same underlying habit as the access-control checks throughout this blog, just aimed at a different target. Instead of asking "who can see data they shouldn't," it's asking "what can someone do that costs me money, if they're willing to just repeat a normal action many times." Any feature that pays out real value based on a user action, a referral bonus, a loyalty reward, a promotional credit, deserves that same question before it launches, not after someone's already found the gap and used it, entirely within the rules the feature itself defined.