“A Bot, Not a Hacker, Is Making Money”

Reward & Coupon Automation Abuse Prevention

“Is it really possible to have this many event participants?”

A food and beverage app launched attendance events and coupon promotions to acquire new customers.

During the first week after launch, the internal dashboard looked impressive.

• Event participation increased rapidly
• Coupon usage exploded
• DAU and MAU increased

However, one month later, the numbers started telling a different story.

• Revenue remained unchanged
• Marketing costs continued to increase
• Normal customers’ coupon usage rate actually decreased

The ones enjoying the benefits were not customers.

They were bots.

Why Is Reward & Coupon Automation Dangerous?

The biggest problem with this attack is:

“It does not look like hacking.”

Characteristics of Reward Automation

• Almost identical to normal user behavior
• Server requests appear legitimate
• No payment or login errors occur

In other words, it is a business-damaging activity that does not look like a security incident.

Real Case: Fake Customers Created by an Emulator Farm

This occurred in a membership-based food and beverage app.

Discovered Symptoms

• Massive spikes in attendance check-ins during specific time periods
• Repeated patterns of new account creation
• Identical behavior flows occurring simultaneously across hundreds of accounts

Investigation Results

• Dozens of emulators running simultaneously
• Automated clicks using macros
• Attendance → Mission → Coupon issuance → Point accumulation
• Some coupons immediately sold through second-hand marketplaces

The event was being harvested not by people, but by an automated environment.

How Did the Attack Work?

1) Multiple Emulator Execution

• Disguised as real Android devices
• Randomized device IDs and OS information

2) Macro & Automated Input

• Automatic attendance button clicks
• Automated event participation
• Repeated account creation

3) Server Processed Everything Normally

• Login succeeded
• Event participation succeeded
• Coupon issuance succeeded

From the server’s perspective:

“A normal user made a normal request.”

Where Was the Security Problem?

The issue was clear.

“The app did not verify the execution environment or the actual source of input.”

Specific Security Gaps

• No emulator execution blocking
• No detection of automated input or abnormal touch behavior
• No client-side verification of repeated behavior patterns
• No integrity or trust-based restrictions applied

The problem was trusting the assumption:

“A human pressed the button.”

How Did LIAPP Defend Against It?

Reward automation must be blocked at the app level before relying only on server-side controls.

• Emulator environment detection
• Rooting, virtualization, and hooking environment detection
• Restricting app execution in abnormal environments
• Detecting repeated touches at identical coordinates
• Detecting unrealistic response speeds

Changes After Security Implementation

After applying security:

• Emulator-based participation was reduced to almost zero
• Coupon abuse stopped
• Marketing costs returned to normal
• Real users experienced greater benefits

The most important change was:

The recognition that rewards are not simply expenses, but “trust-based incentives.”

Lessons for Food & Beverage Apps

Rewards and coupons are benefits for customers, but for platforms they are assets equal to cash.

And these assets must be protected before the server.

• The app being executed
• The hand creating the input
• The screen displaying the content

Final Lesson for Food & Beverage Apps

Security incidents in delivery and membership apps do not begin with servers.

They begin with:

the app that creates orders,
the hand that presses buttons,
and the screen that displays information.

These three elements are not optional.

They are the fundamental security defense line for operating food and beverage applications.

#FoodAppSecurity #DeliveryAppSecurity #RewardAbuse #CouponAutomation #MacroAttack #EmulatorSecurity #MarketingCost #PointSecurity #MembershipApp #MobileSecurity #AppIntegrity #AutomationPrevention #LIAPP #LISS #LIKEY