Why IP validation matters for Shopify discount protection

New email, same network

Your customer used the welcome discount last Tuesday. Today they're back with a fresh email, a guest checkout, and the same 15% code. Shopify sees a brand new person.

But they're sitting at the same desk, on the same Wi-Fi, with the same IP address.

Email addresses are easy to change. You can create a new one in thirty seconds. IP addresses are different. Most people browse from one or two locations, home and work, and their IP stays consistent for weeks or months at a time.

That makes IP validation one of the most reliable signals for catching repeat discount abuse.

What is IP validation?

IP validation is simple in concept. When a customer reaches checkout, you capture their IP address and compare it against the IPs from previous orders that used the same discount.

If someone at 72.134.88.12 used your welcome discount on March 3rd, and someone else at 72.134.88.12 tries to use it on March 10th with a different email, that's a flag.

It doesn't mean it's fraud. Two roommates might share a network. A family might share a connection. But combined with other signals like email normalization and phone matching, it paints a clear picture.

Why email checks alone aren't enough

Email normalization catches Gmail dot tricks and plus aliases. That handles a lot. But it can't connect [email protected] to [email protected]. Those are two completely different email providers. No amount of normalization links them.

IP validation fills that gap. Different email, different provider, but same IP? That order deserves a closer look.

Here's a real pattern that email checks miss:

1. Order #1: [email protected] uses WELCOME15 from 72.134.88.12
2. Order #2: [email protected] uses WELCOME15 from 72.134.88.12
3. Order #3: [email protected] uses WELCOME15 from 72.134.88.12

Three different email providers. Three different customer records in Shopify. One person at one computer.

What about VPNs?

This is the first question everyone asks. Yes, VPNs exist. Yes, some customers use them. But the numbers tell a different story than you might expect.

The vast majority of discount abusers are not sophisticated. They're regular customers who figured out the Gmail dot trick or the guest checkout loophole. They're not launching a VPN to save 15%.

For the small percentage who do use a VPN, the IP check still has value. VPN exit nodes are shared. If ten orders all come from the same known VPN IP, that's worth flagging. And VPN users still have other signals, phone numbers, shipping addresses, device fingerprints, that tie their orders together.

IP validation doesn't need to be perfect. It needs to be one layer in a stack of checks.

Static vs dynamic IPs

Residential internet connections get dynamic IPs that change occasionally. But "occasionally" means every few weeks or months, not every few hours. For the purpose of catching someone who reuses a discount within the typical abuse window of a few days, the IP is almost always the same.

Business connections and mobile hotspots tend to be more stable. And mobile carrier IPs (4G/5G) are often shared across many users in a region, so they carry less weight on their own but still contribute to the overall signal.

How OfferGuard uses IP validation

OfferGuard checks the IP at checkout as one of several validation layers. Here's how the signals stack:

• Email normalization catches Gmail tricks and aliases
• Phone matching catches different emails with the same phone number
• Address matching catches the same shipping address across accounts
• IP validation catches the same network across different identities
• Browser fingerprinting catches the same device across sessions

No single check is bulletproof. But when three or four of them agree, you can be confident it's the same person.

IP validation is available on the Sentinel plan alongside phone, address, and device detection. Every flagged checkout shows you exactly which signals matched, so you can see the full picture in your Shopify admin.

The bottom line

IP addresses aren't magic. They don't uniquely identify a person. But they're extremely hard to change casually, and most discount abusers don't bother trying.

If you're only checking emails at checkout, you're missing repeat customers who simply use a different email provider. Adding IP validation closes that gap and gives you a much clearer view of who's actually new and who's coming back for another discount.

Related reading

• Same customer, multiple emails, same discount - how email normalization works
• Why Shopify's "limit one per customer" isn't enough - the built-in limitation
• 5 ways customers game your new customer offers - all the common abuse patterns
• Why frontend discount protection doesn't work - why server-side validation matters
• Shopify docs: Discount codes - Shopify's built-in discount settings
• Shopify docs: Fraud analysis - Shopify's native fraud tools