Editorial illustration, not a live product screen or a promise of results. Open the full-size illustration.
Make the reward hard to farm and easy to appeal. Pay for verified actions rather than sign-ups, keep rewards non-transferable, cap and delay payouts, collect the minimum data, and give real customers a human route to challenge a block.
This is the verification step of rewards-based marketing. It is written for brand campaigns, with or without a token. For the crypto version of the problem, see our article on quest farming in Web3 loyalty.
What the evidence shows
When rewards can be claimed cheaply and repeatedly, farming follows. LayerZero reported 803,093 potential sybil addresses in its 2024 airdrop, and ran a self-report phase in which people who came forward received 15% of their intended allocation (LayerZero, May 2024). That is a crypto example and a company report, so treat the figures as the company's own.
Two lessons carry beyond crypto. Farming scales when the reward is transferable and the action is cheap. And any filter tight enough to catch farmers will catch some real people, so the appeal has to exist before launch.
What farming looks like
- Multiple accounts. One person claims many times.
- Bots and click farms. Automated or paid low-effort completion.
- Referral rings. Groups that refer each other with no real customer behind them.
- Promotion abuse. Stacking or repeating a bonus the rules did not intend.
- Receipt fraud. Reused, edited or invented proof of purchase.
- Spoofed activity data. Fake movement or location signals in fitness rewards.
- Low-effort completion. Finishing a task without engaging with it, such as clicking through a course.
Controls and what they cost in privacy
| Abuse | Control | Privacy trade-off |
|---|---|---|
| Multiple accounts | Eligibility rules, non-transferable rewards, delayed payout, pattern analysis | Needs a documented lawful basis for the analysis |
| Bots and click farms | Rate limits, quality checks inside the task | Low |
| Referral rings | Reward the referred person's qualified action, not the sign-up | Low |
| Promotion abuse | Caps and clawbacks, stated as significant conditions | Low |
| Receipt fraud | Automated receipt checks, duplicate detection | Moderate, so limit how long receipts are kept |
| Spoofed activity data | Plausibility checks on the data | Location data is intrusive, so prefer aggregated activity to raw location |
| Low-effort completion | Pass thresholds and answer checks | Low |
| Wrongful exclusion | Human review and an appeal route | Needed for fairness |
Where the privacy line sits
- Device fingerprinting. PECR covers storing or accessing information on a person's device. Current ICO guidance identifies fraud prevention as a possible strictly-necessary exception to consent, but only where it meets the conditions: essential to the user-requested service, reasonable and proportionate, and used solely for that purpose. UK GDPR lawful basis and transparency still apply. Advertising or unrelated secondary uses are not covered by that exception. Get advice on your particular implementation.
- Identity checks. Use them only where the law or a cash-out step requires them, because they carry the highest privacy cost.
- Biometric proof of personhood. We would not use it in a brand campaign. The privacy cost is very high and the customer gets little in return.
- Consent. Taking part in an incentivised action is not consent to unrelated marketing (ICO guidance on valid consent).
Design principles
- Reward the qualified action, not the sign-up.
- Keep rewards non-transferable, and delay payout until verification has run.
- Cap rewards per person and state the caps. Under the CAP Code, significant conditions need to be made clear to the customer.
- Minimise data. Collect what verification needs and keep it no longer than it is needed.
- Sample by hand. Human review of a small sample tells you what the automated checks miss.
- Publish the appeal route. Give a contact, a response time and a named human decision-maker.
Price the leak
Fraud losses belong in the numerator of your cost per verified qualified action, as set out in How to Measure a Rewards-Based Campaign. Here is the arithmetic, with invented figures. If 10% of the rewards you pay go to farmed claims that produce no genuine action, your cost per genuine action rises by about 11%. The lower your unit cost, the less room there is to absorb that leak.
Where Zenko fits
For a campaign with Zenko, agree how each action will be verified, when the reward will be released and what per-person limits apply. A review and appeal route should be part of the campaign design, not an assumed platform guarantee. Confirm the available controls, integration and human responsibilities before launch.
If verified actions also fund a reward for good, agree the contribution and delivery evidence in advance. Report the stages separately so a record is never mistaken for an outcome.
A low unit cost still needs effective controls. Verification and fraud losses belong in the full campaign cost, not outside the headline price.
Tell us the action you want to reward and the outcome you need. We will show you how a campaign could work.
Plan a rewards-based campaign with Zenko
Frequently asked questions
What is reward farming?
Reward farming is claiming incentives repeatedly or with fake accounts, without doing the genuine action the reward was meant to encourage. It is most common where rewards are cheap to claim, easy to transfer and paid out immediately.
How do you stop fake sign-ups without collecting ID?
Pay for a verified action rather than the sign-up, keep rewards non-transferable, cap them per person, delay payout and check a sample by hand. Reserve identity checks for cash-out or legal requirements, because they carry the highest privacy cost.
Is device fingerprinting legal in the UK?
Fingerprinting is covered by PECR. Consent is not required where use properly meets the narrow strictly-necessary fraud-prevention exception, but necessity, proportionality, purpose limitation, UK GDPR lawful basis and transparency still matter. Advertising and unrelated secondary uses are not covered by that exception. Get advice on your implementation.
Do incentives attract low-quality participants?
They can. Low quality shows up when the action is cheap to fake, the reward is transferable and eligibility is open. Verification, caps, delayed payout and quality checks inside the task reduce it without needing more personal data.
Sources
- LayerZero, sybil self-report update, May 2024 (company-reported)
- ICO, current storage and access technology exceptions
- ICO, what is valid consent
In this rewards-based marketing series
- Rewards-Based Marketing: How to Reward Actions That Actually Matter
- How to Choose the Right Customer Action to Reward
- How to Measure a Rewards-Based Campaign
- Incentive Marketing Examples That Work Beyond Discounts
Related acquisition measurement
Related acquisition measurement: compare marketing channels at matched pipeline age.