Loyalty integrity

Letting customers enrol themselves removes the cashier bottleneck, but it also removes the human check that used to sit in the enrolment path. Once a customer can claim points by photographing a receipt, four abuse patterns appear: submitting the same receipt twice, submitting somebody else's receipt, reusing an old image, and probing the system with invalid images to learn what it accepts.

Integrity controls answer each pattern specifically. Per-customer rate limits by hour and by day cap how fast a single account can claim. Receipt-age limits reject a bill from last month. Receipt-total thresholds keep trivial claims out. Cross-customer duplicate-image matching, with a similarity threshold the operator can tune, catches the same photo submitted by two different accounts. Repeated-failed-scan detection flags probing. Risk-tiered actions decide what happens on a hit: block outright, hold for manual review, or notify a manager.

Integrity is a spectrum, not a switch, and it cuts both ways. Thresholds set too tight generate false positives and hold honest customers' scans for review; set too loose they do nothing at all. Any vendor that advocates self-enrolment should be able to name its controls and show where the thresholds are set.

A useful buyer's question: what stops the same receipt being scanned twice, by two different people, on two different days? A vendor without a specific answer is offering enrolment growth without cost control.