Vouchers that keep working: expired, leaked and unlimited

You launch a discount code for the weekend. On Monday there are still orders with that code. A month later it appears on a coupon website, and someone is using it on products you never meant to discount. None of this is a sophisticated attack: these are cart rules with gaps, and in PrestaShop there are a few that come up again and again.

The expired voucher that keeps discounting

This is the most baffling case. PrestaShop checks whether a voucher is valid when the customer applies it to the cart. If it is valid at that moment, it stays attached to the cart. But if the customer leaves the cart and comes back days later, when the voucher has already expired, the discount may still be there and end up in the order.

The typical scenario:

1. You launch a promotion that ends on Sunday.
2. A customer applies the code on Sunday and does not complete the purchase.
3. On Wednesday they pick up the cart again, from an abandoned cart email or simply by returning to the shop.
4. They complete the order with the discount from a promotion that ended days ago.

A single case will not sink anyone. But if the campaign was big and you also send abandoned cart reminders, the number of orders with out-of-date discounts grows precisely because of your own sales efforts. The same happens with vouchers that had a future start date, that you disabled manually or that had already used up their quantity.

How a code ends up on a coupon website

Coupon websites feed on what their users find and on bots that test codes. The most common routes:

• A customer shares it, sometimes in good faith, on a forum or on the coupon website itself.
• An influencer or partner code meant for their audience, which spreads beyond it.
• Easy-to-guess codes: WELCOME10, SUMMER20, the shop's name followed by a number. There are tools that try variants automatically at checkout.
• A compensation voucher you gave a customer after an incident and that was not restricted to them.

A code circulating is not always bad; sometimes it is free advertising. The problem is when it has no limits and is used in conditions you did not foresee.

The limits every cart rule should have

In Catalog → Discounts → Cart Rules, each rule has conditions and actions. Go through these before publishing a code:

Unique codes instead of generic ones

For anything other than a public campaign, a unique code per customer prevents almost all abuse: it cannot usefully be shared, it cannot be guessed and you know exactly who used it. Welcome, compensation, abandoned cart and second-purchase codes should always be like this. Make them long and random, not sequential.

Prepaid credits: the other kind of «voucher»

Some shops use vouchers for something that is not a discount: the customer pays in advance for a pack of classes, sessions or services and then uses it up over time. Doing this with cart rules ends badly: codes that get shared, balances nobody can work out, expiry dates that are not applied. A prepaid pack is a customer balance and should be managed as such, with a record of every use.

How to tell whether you already have the problem

• Look for orders with a discount after the rule's end date. If there are any, you have the old cart problem.
• Review the uses of each code in the rule's details and compare them with what you expected.
• Search for your brand on coupon websites from time to time.
• Look at orders with several stacked discounts and the margin they left.
• Review the active rules: it is common to find dozens of old rules with no end date that nobody disabled.

Margin comes before the code

Before creating any voucher, do the maths backwards: with the discount applied to the smallest order that allows it, free shipping if included and the payment gateway's fee, is there still a margin? If the answer is «it depends on the product», restrict the products. If the answer is «no», raise the minimum amount or lower the discount. A voucher that loses money on some of the orders is not fixed by more sales: it gets worse.

And think about stacking. A ten per cent voucher on a product that is already discounted, with free shipping and a gift from an automatic rule, can turn a profitable order into a loss-making one without any single rule looking dangerous on its own.

A clean-up rule

At the end of each campaign, disable its cart rule even if it has an end date. Once a quarter, review all active rules and disable whatever no longer makes sense. Keeping the shop and its modules up to date helps too: discount calculation bugs are fixed in new versions, and a shop several versions behind carries behaviours that are no longer the expected ones.

How to solve it in PrestaShop

RKR Cupones caducados closes the old cart loophole: it removes from the cart vouchers that have expired and those not yet valid and, if you enable it, also those that are disabled or have used up their quantity, before any total is calculated, both in the cart and throughout checkout. It informs the customer with a clear, translatable message, has a grace period in minutes so a voucher does not drop out in the middle of payment, and adds no queries outside the cart. It works without overrides, from PrestaShop 8.0 to 9.x. For prepaid credits, RKR Smart Coupons manages them as a customer balance, with batches that expire on their own, reminders before they expire, automatic refund if the order is cancelled and a ledger of movements that cannot be edited; gifts are generated with random codes and failed attempts to redeem them are limited per customer and IP.