How to stop loyalty card fraud, on paper and on phones
The ways stamp cards get cheated, by customers and now and then by staff, and the checks that stop it without slowing the queue.
On this page
Loyalty card fraud in a café, salon or bakery is rarely clever. It is usually someone taking a small shortcut because the card makes it easy: a stamp that looks close enough, a card filled in with a pen, a code that works for whoever holds the photo. The good news is that a handful of simple habits stop nearly all of it, whatever card you use.
How stamp cards get cheated
On paper
A paper card trusts whoever holds the stamp, and anybody can buy one that looks near enough to yours. Some customers top a card up with a pen. Others pool cards from friends and family so that one person collects everyone’s rewards. Behind the counter, the most common leak is kindness: a stamp or two extra for a friend, or a full card handed over to someone the team likes.
None of this is dramatic. But with paper you can’t see any of it, so you can’t tell a lucky week from a leaky one.
On phones
Digital cards close the pen-and-stamp gaps and open a few of their own. A QR code that adds a stamp when anyone scans it can be photographed and shared, and from then on it stamps for everyone with the picture. A screenshot of a customer’s card can be passed round if the card gives stamps on sight. And a staff app on a shared tablet is only as careful as whoever is holding it.
What stops it
Keep a person in charge of every stamp
The single most effective rule is that no stamp lands without someone on your team deciding it should. On paper, that means the stamp lives behind the counter, not on top of it. On a phone, it means a member of staff scans the customer’s card, or approves the customer’s request at the till, rather than a code giving stamps by itself. A photo can then only ask, and your team can say no.
Cap what one visit can earn
Most cheating is about volume, so limits do a lot of quiet work. One stamp per visit, a sensible maximum per day and a short pause between stamps make a copied code close to worthless, and they protect your staff from awkward requests for “one for my mate as well”.
Leave a record of every stamp
When each stamp carries who gave it, where and when, two things happen. You can spot a problem quickly, and your team knows you can, which on its own prevents most of it. Corrections should leave a record too, with a reason, so putting a mistake right never looks like covering one up.
Make copies useless
Anything printed can be photographed, so plan for it. Use codes you can replace in a minute if a picture of them starts doing the rounds, and keep a code that gives stamps behind the counter or at the till rather than in the window. If you put an NFC tag at the counter, a secure tag that signs each tap is far harder to fake than a sticker holding a plain link.
Make the reward worth earning, not worth faking
A reward that costs you little and means a lot to a regular, such as a free coffee or money off a trim, gives honest customers a reason to come back and a cheat very little to gain. A big prize on a short card does the opposite. If you want to offer something generous, put it at the end of a longer card, or save it for people who have collected over months through a lifetime tier, so that faking a visit or two gets nobody close. Our ideas for loyalty rewards include a calculator for what each reward costs you.
Look at the odd ones out
You don’t need to check every card. Once a month, look for the outliers: a card that fills in a day, rewards used at an hour you weren’t open, or one person on the team approving far more stamps than their shifts would explain. Most turn out to have an innocent story. The few that don’t are worth knowing about early.
When the problem is behind the counter
Start by writing the rules down where the whole team can see them: one stamp per visit, no stamps without a purchase, and who to call when a customer disputes their card. Clear rules protect staff as much as they protect you.
If the records point at a member of staff, talk to them before you assume the worst. Busy counters produce honest mistakes, and someone may simply not have understood the limits. If it keeps happening, change what they can do: take away the permission to correct stamps, move them to outlets where someone else approves, or remove their access altogether. Whatever you decide, act on the record rather than a hunch, and keep the conversation private.
How NextStamp handles it
NextStamp is our product, so here is how it applies the habits above. Scanning a till poster or tapping a tag never adds a stamp on its own. It sends a request to the till, where a signed-in member of staff approves it, and a short code shown on the customer’s phone and on the till lets them check it is the right person. Requests reach only the tills of the outlet whose poster was used, and they close by themselves after 10 minutes.
Every card has limits per visit and per day, starting at one stamp a visit and five a day on a new card, and a card can’t be stamped twice within a minute. A poster can be replaced in seconds if a photo of it is going round, and secure tap tags sign every tap so a copied link can’t ask twice. Each stamp is recorded with who approved it, where and when; staff can undo their own stamp within 10 minutes, and corrections carry a reason. Owners and admins can see each team member’s activity at the till in Insights. The help article on stamp fraud goes through each protection in detail.
Questions owners ask
Should I worry about a little cheating?
Keep it in proportion. A few extra stamps cost you a few coffees, which is less than the regulars a fussy card would put off. The aim is a card that honest customers trust and that nobody can milk, not a card that treats every customer as a suspect.
Is a QR code safe to put in my window?
It depends on what scanning it does. A window code that only lets people join your card is safe anywhere, even online. A code that gives stamps should stay at the till, and with NextStamp it still only asks your team, who approve each one. Our page on QR code loyalty cards explains the difference.
What about customers sharing one card?
On paper you can’t stop it. With a digital card tied to each customer’s own account, everyone collects for themselves, and the limits mean a shared login can’t earn more than one person could anyway.