Identifying Fake “New User” via Promotion to achieve Sustainable Business Growth

—

Originally published on Medium on September 2, 2024.

Background

1 of most important metrics on top of margin in early business running is: number of active transacting users. It become one of some indicators that indicates the product / service has a demand (product-market fit).

To grow our active or transacting users, not only retained our existing (returning) user, we also need to acquire new user. There are several channel / source that commonly used to acquire new customer:

• Organic: User that join into the business without any incentive or for free
• Referral: User that join into the business through his/her friend invitation (usually equipped with some benefit — money or other thing)
• Promotion: User that join into the business and receive some promotional reward (money / other benefit)
• Performance / Paid Ads: User that join into the business through performance ads (Facebook Ads, Instagram Ads, TikTok Ads, or Media Partner)

Nah, on this session we will specifically deep-dive new user that join to the business through promotion. Why — because the user that came from this channel is potentially “infected” by abusive activities due to some reward offered.

Objective

Short Term: prevent “dump” user to join our business due to this kind of user will generate fake achievement and low margin contribution.

Long Term: Acquire only “legit” user for long-term sustainable business growth.

Method

After we get some data related to new user that join our business via promotion, we can do several actions below to identify is there any abusive activity within the process.

First Thing First

Based on my experience and identify fraud (or even do fraud activities) — there are some variable that highly tend to be manipulated.

• Phone Number / Whatsapp
• OTP
• Email
• Device Id
• KYC
• Internet Network

1. Data Cleansing — Cleanse the Number

Nah, on this process, let’s start with exclude the number. Abuser tend to use similar email in abusing the rule. We can start using REPLACE or REGEXP on SQL for this case.

Several actions on this steps that considerably implementable:

• Cleanse the punctiotion (., ,, _ etc.)
• Lower the cases (to ensure the cleansing process)

More advanced option: Consider to use similarity checking via levenshtein function — we can consider it as similar if the similarity > 0.6 of 1.0. The threshold is adjustable following business requirement and sensitiveness required.

2. Pattern Capturing — Using Percentile

After we got some cleansed data → Let’s we group them. Abuser tends to do multiple activities in order to get “higher” reward.

We can start to develop simple bar/line chart to distribute number of new user based on cleansed email — the abuser is tend to gathered on high percentile.

3. Abusive Activity Identification

After we found several “suspicious” users. We can dive deeper into these kind of users. User who have higher similarity.

If we found something suspicious and occurred recursively, We can decide it as a Abusive Activity.

• Count the loss through total reward/ promotion disbursed — since this kind of users will generate no margin at all for our business
• From this kind of things also, we can know which rule that generate highest abusive activity rate → to be prioritized

4. Rule Definition

As a future preventive action, we can convert the findings above to prevent any similar or future loss.

Collaborate with engineering / risk team to achieve more reliable solution since the abusive activity tend to occured in very short period of time (in minutes, or even seconds) → so our solution need to be responsive / near real-time responsed.

Conclusion

Finding an abusive activity is one thing but developing responsive rule to prevent future similar events is another thing.

Highly recommend to develop the resolution (near real time) to make our findings regarding to abusive activity become useful.