Spotting registration promo code abuse before it dents the paid mix

Registration revenue for the month came in at 412,000 against a paid registration count that should have produced closer to 590,000. The count is right. The money is not, and nobody can say why from the dashboard, because the dashboard reports registrations and the finance system reports cash.

The gap is a code. Registration promo code abuse never announces itself, and somewhere in the 40 or so promo codes running that season one of them is doing far more work than anyone agreed to. By the time the reconciliation surfaces it the registrations have been confirmed and the badges have been printed.

How does a code get out?

Codes leak in a small number of ways and they are worth naming, because the detection tests below map onto them.

The first is publication. A partner or an exhibitor puts a discount code somewhere public. A LinkedIn post and a forwarded newsletter are the two common routes, and a slide deck parked on a resources page does the same job more slowly. From there it reaches the deal aggregation sites, which index conference discount codes systematically, and the code stops being addressed to anyone.

The second is internal reuse. A code written for one audience gets pasted into a different campaign by somebody who needed a discount on a Thursday and knew that one worked.

The third is the exhibitor staff route, which is the one that damages the audience rather than the revenue. An exhibitor registers people as buyers instead of as booth personnel, either to avoid badge fees or to give staff access the exhibitor badge does not carry. Those registrations enter your file as buyers, count in your buyer subtotal, and are then quoted to the exhibitors who paid to meet buyers. What that does to the published type mix is A31's subject.

CONEXPO-CON/AGG's own mechanism for 2026 shows how ordinary the distribution problem now is. Its 2026 registration policy tells exhibitors they may share a link carrying a unique discount so their guests register and pay for their own badge, which the policy notes is at no cost to the exhibitor. That is a sensible mechanism, and it puts a live discount in the hands of every exhibiting company's marketing team, none of which you control.

Redemptions against the cap, per code

The first test is the one most registration platforms can answer today and most organisers have never asked.

For every code, report redemptions to date against the cap agreed when the code was created. If a code has no agreed cap, that is the finding.

Sort by redemptions as a multiple of cap and look at the top of the list weekly. A code at 1.2 times its cap is a conversation with a partner. A code at four times its cap is a leak that has already happened.

The comparison against the rest of the estate is worth having on the same report. If the median code across your 40 codes has produced 18 redemptions and one has produced 640, that ratio is doing more work than any threshold you could set in advance. I would flag anything above the 95th percentile of the code population regardless of cap, because a code behaving unlike every other code is interesting whether or not somebody wrote a number down at the start.

Concentration by email domain

The second test catches the codes that leaked and the exhibitor staff route in one pass.

For each code, compute the share of redemptions coming from free email domains, and compare it with the same share across the whole registration file. Compute the file-wide baseline first, because it varies enormously by sector and there is no borrowable industry figure. Whatever your file runs at, a code running at three times it is being redeemed by people who are not registering through their employer, which is what a publicly posted code looks like.

Then compute redemptions per unique domain within the code. A media partner's readership is spread across thousands of companies, so a code issued to that partner should produce roughly one redemption per domain, with a handful of twos and threes. If one domain has produced 34, somebody has bulk-registered a team using a partner's discount.

The third cut on the same data is the exhibitor test. Join redeeming domains against your exhibitor account list. Any redemption from a domain belonging to an exhibiting company, on a code intended for buyers, is a registration that should be checked before the badge is printed rather than argued about afterwards.

The first forty eight hours

The third test looks at the shape of the redemption curve.

Record redemptions per hour for the first 48 hours after a code goes live, then keep recording for a fortnight. A legitimate partner mailing produces a sharp burst, most of it within a day, decaying to almost nothing over about five days, because a newsletter is sent once and read quickly.

A published code produces a different curve. The initial burst may be similar, and it does not decay. It keeps producing redemptions weeks later from unrelated domains, because the code has been indexed somewhere and is being found by people searching for a discount rather than receiving a mailing.

Velocity alone will not tell you which one you have, which is why the measurement runs for a fortnight and why what you are looking for is the tail.

One partner code, 640 redemptions

Put numbers on it. A code was agreed with a trade publication for 50 redemptions at 50 per cent off a 715 standard rate, so a discount of 357.50 each. The agreement was worth 17,875 in foregone revenue and everyone signed it happily.

The code produced 640 redemptions.

The overrun is 590 redemptions above the cap, and at 357.50 each that is 210,925 of discount issued outside the agreement.

Now be honest about what that figure is. It is a ceiling on the loss. Some share of those 590 would never have registered at 715, and their half-price registration is revenue you would not otherwise have had. The floor on the loss is the number of the 590 who would have paid full price, and nothing in your file identifies them. What you can say precisely is that 210,925 of discount was issued against an authorisation for 17,875.

The effect on the paid mix is the part that reaches the commercial plan. On a file with 9,400 paid registrations, spreading 210,925 across them takes 22.44 off the average yield per paid registration, since 210,925 divided by 9,400 is 22.44. The paid registration count looks healthy all season, because these are paid registrations. The yield per head quietly falls by more than 22 units and nobody notices until the margin review. That is 22 units off a ladder somebody designed carefully, which is A13's work being undone by a code nobody was watching.

Run the three tests against that code and every one of them fires. Redemptions came in at 12.8 times the cap, a third of them landed on personal email addresses, and the launch burst was still producing registrations six weeks later.

What does the policy have to say for the tests to matter?

Detection without a stated remedy produces a report that circulates and changes nothing, because cancelling a confirmed registration three weeks out is a decision nobody wants to take on their own authority.

The NACS Show's 2026 exhibitor registration rules are a good model for writing the remedy down in advance. Booth personnel badges may not be used for retailers, buyers or other customers and clients. Exhibitor booth personnel rosters will be audited, unauthorised retailer or customer registration credentials will be cancelled, and the exhibitor is liable for anyone they register as booth personnel under their company. Naming the audit in the rules is most of the deterrent, because the exhibitor knows the roster is going to be read by somebody.

The same show prices show rule violations in the currency exhibitors care most about. NACS assigns exhibit space in priority points order, and under the points criteria it published for the allocation system running from November 2025, a show rules violation carries a deduction of one point per infraction. A cancelled badge costs an exhibitor a badge. A deducted point costs them position in the queue for stand location, which is the thing they have been accumulating points towards for years.

Two rules do most of the work on the code side. Every code has a cap and an expiry date written at creation, with no exceptions for codes created during show week, which is the same discipline a comp entitlement needs and A17's document. And discounts apply at the point of registration only. CONEXPO-CON/AGG's 2026 policy puts that second rule in plain language: discounts must be applied at the time of registration and cannot be applied once the registration fee has been paid. That single sentence removes the retrospective discount request, which is where a large share of code pressure originates.

Where this stops

Every test above produces false positives, and the domain concentration test produces the most.

A genuine group booking from one large employer looks exactly like abuse: many redemptions, one domain, a short window. So does a legitimate association chapter mailing to members who use personal addresses because their employer does not give them one, which is common in trades, hospitality and healthcare. Treating either as fraud will cost you real registrants and an angry phone call from a partner who did nothing wrong.

So the tests should route to a review queue rather than to an automatic cancellation, and the queue should be worked by someone with the authority to phone the partner and ask. That capacity is the actual constraint. If nobody owns the queue, building the report achieves nothing.

There is also a limit on what the tests can see. A code redeemed by a genuine buyer who found it on a deals site is indistinguishable in your data from one redeemed by a genuine buyer who received the partner's newsletter. The person is real, the registration is real, and the only thing wrong is that they paid less than your ladder intended. Whether that matters is a commercial judgement about your price integrity rather than something the data can settle.

This week, export every promo code with its redemption count and its agreed cap into one sheet, alongside whatever attendee analytics view you already run by registration type. Any code with a blank in the cap column is the first thing to fix, and the ratio in the codes that do have caps will tell you within ten minutes whether you have a leak running right now. If the codes in question are exhibitor guest codes, check the redemption rates as well, since A18's finding is that most of them go unused and a code running hot against that backdrop is unusual twice over.