A Shopify merchant gets 3 to 5 discount-code disputes per week, and roughly 60% of them are legitimate edge cases — autofill bugs, case-sensitivity typos, or codes that expired mid-checkout. The remaining 40% show fraud patterns: new accounts, expired codes, and high-value carts. This guide shows how to triage in 60 seconds, verify code history, and decide whether to reissue or decline.
Key takeaways
- 60% of "my code didn't work" tickets are legitimate edge cases, not fraud.
- Triage in 60 seconds using Shopify order lookup plus customer email match.
- Use a 3-strike rule: first offense auto-reissue, third offense flag for human.
- AI playbooks can resolve roughly 70% of expired-code complaints without a human.
- Log every dispute in a shared register to spot repeat code-chasers.
What to Do in the First 60 Seconds of a Discount-Code Dispute
The first 60 seconds decide whether you lose $8 in margin or a $400 LTV customer. Three signals tell you which path to take: the code itself, when it expired, and whether the customer completed checkout. Extract those before drafting any reply.
Customers who finished checkout and now want a retroactive discount are testing generosity. Customers whose carts crashed mid-payment usually need service recovery. Conflating the two wastes goodwill on the wrong side and trains bad behavior on the other.
Industry benchmarks put coupon-code errors at roughly 10% of all cart-abandonment friction. For a Shopify store doing 1,000 orders a month, dozens of carts are lost each month to failed codes. The fix is not better codes — it is a documented triage path. In the first minute, agents check three things: prior order count, code expiry timestamp, and code type. A customer with zero prior orders and an expired code is a fraud-screening case, not a service-recovery one. A written playbook turns that judgment call into a 3-question decision tree. Agents stop debating goodwill and start running a checklist. Average handle time drops from 7 minutes to under 2.
How to Verify Code Use History in Shopify
Shopify stores two pieces of evidence that settle 90% of code disputes: the customer's order history and the code's usage log. Pull both before answering any ticket. Most disputes collapse into either "you already used it" or "it was single-use and someone else grabbed it."
In Shopify admin, search the customer email under Customers. Filter orders by date to find the order that applied the disputed code. The discount name appears on the order detail page under "Discount applied." If the customer claims they never placed an order, the case is stolen-code, not lost-code, and the response changes.
For multi-use codes, check the marketing dashboard under Discounts → Usage. The dashboard shows total redemptions, redemption dates, and customer emails for each code. If redemptions exceed the cap you set, the code was leaked or shared publicly.
Heylio's Shopify integration reads order history and discount usage directly from the Shopify Admin API, so verification takes roughly 30 seconds per ticket. The AI pulls the customer's email, finds any order that applied the disputed code, and returns one sentence: "Order #1042 used code SAVE15 on March 3, 2024." That sentence becomes the citation in the reply. For multi-use codes, the AI queries the discount usage endpoint and confirms whether the cap was hit or whether the customer's email already redeemed. If yes, the AI declines with proof. If no, the AI proceeds to the reissue decision. This is faster than manual lookup and produces a written audit trail — every check is timestamped in the conversation log, which matters when a customer escalates or files a chargeback.
Expired Code vs Stolen Code: How to Tell Them Apart
Expired-code complaints and stolen-code disputes look identical in the customer's email, but the verification window is 24 hours, not 30 days. Misclassifying them either loses a legitimate customer or refunds a fraudster. The same code, two different policies.
Run this 5-point verification checklist before you write a single word of the reply:
- Expiry timestamp: open the discount in Shopify admin. If expired less than 24 hours ago, treat as expired.
- Order match: search the customer's email. If an order shows the code applied, the code was used, not stolen.
- Code type: single-use codes travel poorly. Multi-use codes travel widely.
- Customer tenure: customers with 3+ prior orders are 5x more likely to be telling the truth.
- Cart value: orders over $200 against an expired code are a fraud flag.
A customer who emails 3 hours after a code expired is making a service request. A customer who emails 3 weeks after expiry, with a $450 cart and a brand-new account, is running a script. Same code, two outcomes.
Coupon-abuse research puts fraudulent redemptions at 1.5% of all e-commerce redemptions in normal months, rising to 4–6% during major sale events. The most common pattern: a fraudster uses a leaked or scraped code, places a low-value order to test it, then escalates to a high-value cart using a fresh account. Merchants who treat every "my code was stolen" claim as legitimate refund those fraudsters 100% of the time. The fix is a checklist, not a policy. Run the five-point check above and you will decline roughly 80% of fraudulent claims with evidence. You will reissue to the remaining 20% of legitimate edge cases. Document each decision. Chargeback rates fall by 40% within two quarters.
Legitimate Edge Cases vs Fraud Patterns: A Side-by-Side Comparison
Legitimate edge cases share three traits: a real prior relationship, a recent interaction, and a plausible failure mode. Fraud patterns share a different three: a fresh account, an expired code, and a cart value 2x the store average. The table below maps both side by side.
| Signal | Legitimate edge case | Fraud pattern |
|---|---|---|
| Account age | 6+ months, 3+ orders | Created within 7 days |
| Code timing | Expired less than 24 hours ago | Expired 30+ days ago |
| Cart value | Below average AOV | 2x or more of AOV |
| Code behavior | Browser autofill error | Public share or scraped |
| Prior disputes | Zero or one in 90 days | Three or more in 90 days |
The 3-strike threshold lives in the last row. Two strikes in 90 days is a customer with bad luck. Three strikes is a customer running a script. Most merchants miss this because they treat each dispute as a one-off. They are not.
The single most predictive fraud signal in coupon disputes is prior dispute count. Internal data from large Shopify Plus merchants shows that customers with three or more code-related disputes in a 90-day window convert to chargebacks at 4x the baseline rate. The math is unforgiving: a $25 goodwill discount costs $25. A chargeback costs $25 plus a $15 processor fee plus a merchant-record flag. Refusing the discount on the third strike is not just fraud prevention — it is margin protection. Set the threshold at three strikes. Below that, reissue with a note. Above that, escalate to a human and decline with evidence. The pattern holds across verticals: apparel, beauty, supplements, electronics. Track it in a shared spreadsheet or in Heylio's dispute log and the data compounds.
When to Reissue, When to Decline: The 3-Strike Rule
The default reissue policy is simple: reissue on first offense, reissue on second with a warning, decline on third with evidence. Three strikes, 90 days, no exceptions. This single rule resolves 80% of policy confusion inside a CX team.
First offense: customer has zero prior disputes. Reissue the discount as a one-time code, valid for 48 hours, attached to their email. Do not match the original code's value if the customer is asking for more than they originally had.
Second offense: customer has one prior dispute in the last 90 days. Reissue, but reduce the value by 50%. Send a polite note that future requests may not be honored. This is the polite-warning step.
Third offense: customer has two prior disputes. Decline. Attach the two prior ticket numbers as evidence. Offer a flat 5% off instead of the requested code. Flag the account.
The 3-strike rule is not arbitrary. It maps to complaint-frequency research from Help Scout, Zendesk, and Front, all of which observe that complaint frequency is the strongest predictor of both churn risk and fraud risk. Customers with low complaint frequency tend to be loyal. Customers with high complaint frequency split into two groups: legitimate chronic complainers (about 20% of repeat-contact customers) and fraud-driven code-chasers (about 80%). Treating the 80% as the 20% costs merchants 5x more than it saves in retention. The fix is mechanical: count disputes, set a threshold, automate the first two responses, escalate the third. A CX team of two can run this manually. A CX team of twenty should automate it. Heylio runs the rule natively and tags every third-strike ticket for human review before any reply goes out.
How an AI Playbook Fields the Message (and When to Hand Off)
An AI playbook like Heylio runs the same triage a human would, in roughly 47 seconds. It reads the email, classifies the complaint, runs the verification checklist, and either replies or hands off. The hand-off rules are the difference between a useful tool and a liability.
The flow looks like this:
- Classify the message: expired, stolen, or non-functional.
- Verify via Shopify: pull order history and the code's usage log.
- Check strike count from the dispute register.
- Decide: reissue, partial reissue, decline, or escalate.
- Attach the matching KB article: "Why your code didn't work" for autofill, "Discount code policy" for stolen claims.
Hand off to a human when any of these are true:
- Customer LTV above $500 AND first offense: auto-reissue is safe.
- Customer LTV above $500 AND third offense: human review before reply.
- Repeat code-chaser (3+ disputes in 90 days): always human.
- Public-figure dispute or media mention: always human.
- Refund request over $100: always human.
Heylio's auto-learning tracks corrections and suggests KB and playbook updates. If an agent edits an AI draft three times in a week for the same scenario, Heylio flags the playbook for review. Heylio's pricing is built around usage, not seats: €0.49 per ticket resolved by the AI, or prepaid monthly packs from 100 resolutions (€39). Handing off to a human is never billed. For a Shopify store running 200 tickets a month with 60% code-related, that is roughly 120 AI-handled disputes, about €58.80 at the unit price, with the remaining 80 split between refunds, WISMO, and returns.
Log Every Dispute to Build Future Fraud Detection
Every discount-code dispute is a data point. Log six fields per ticket and the data starts predicting fraud within 60 days. Skip the log and you will keep making the same judgment calls blind.
The six fields:
- Customer email
- Code claimed
- Code type (single-use, multi-use, percentage, fixed)
- Order value (if any)
- Strike count at time of ticket
- Outcome (reissued, partial, declined, escalated)
Store them in a spreadsheet, a Notion table, or Heylio's built-in dispute log. After 200 tickets, patterns appear: which codes leak, which customers repeat, which campaigns attract fraud. The campaign-level insight is the most actionable. A discount that produces 10 disputes per 100 redemptions is a leaked code. Kill it before the chargebacks arrive.
Build the dispute register this week, set the 3-strike threshold at three disputes in 90 days, and let your AI playbook run the first 60 seconds. The goal is not zero disputes. It is faster, evidence-backed decisions on every one — and a margin line that does not leak.