A large entry count is only useful if the entries are real. Bots, fake email addresses, and people entering under several identities inflate your numbers, contaminate your data, skew your analytics, waste email sends, and undermine the fairness that a legitimate promotion depends on.
This guide covers the major fraud threats facing sweepstakes and contests, the specific tools and techniques for preventing each one, and how to build a fraud prevention strategy that protects your promotion without creating so much friction that legitimate entrants give up.
If your team is deciding whether to implement these controls itself, review what a production promotion platform must handle.
Why Sweepstakes Fraud Matters
Fraud isn't just an annoyance — it has measurable business impact. Every fraudulent entry creates downstream costs and data quality problems.
| Impact Area | What Fraud Does | Business Cost |
|---|---|---|
| Data quality | Fake emails, names, and phone numbers enter your CRM | Inflated list metrics, higher bounce rates, email deliverability damage |
| Email costs | You pay to email fake addresses that bounce | Wasted sends, reduced sender reputation |
| Analytics accuracy | Bot entries skew conversion rates and engagement data | Misleading ROI calculations, bad budget decisions |
| Winner fairness | Fraudulent entries dilute legitimate participants' odds | Legal risk, brand reputation damage, participant complaints |
| Ad spend | Retargeting campaigns target fake profiles | Wasted ad budget on non-existent people |
| Campaign ROI | Inflated entry counts mask actual performance | Overestimated campaign value, continued investment in ineffective formats |
Any online form that offers a chance to win can attract duplicate or automated entries. Monitor actual participant records and choose controls appropriate to the campaign.
Types of Sweepstakes Fraud
Understanding the specific fraud threats helps you deploy the right countermeasures. Here are the most common types:
| Fraud Type | How It Works | Severity | Detection Difficulty |
|---|---|---|---|
| Bot entries | Automated scripts submit forms thousands of times | High | Medium — patterns are detectable |
| Duplicate accounts | One person enters with multiple email addresses | Medium | Medium — IP and device signals help |
| VPN/proxy abuse | Users mask their location to enter geo-restricted promos | Medium | Medium — VPN detection available |
| Sweepstakes hobbyists | Serial entrants from contest directories with no purchase intent | Low-Medium | Hard — these are real people |
| Organized gaming rings | Groups coordinate to submit mass entries and share winnings | High | Hard — coordinated but legitimate-looking |
| Fake referrals | Self-referrals using multiple accounts to earn bonus entries | Medium | Medium — referral chain analysis helps |
| Disposable email abuse | Temporary email addresses used for one-time entries | Medium | Easy — domain pattern detection |
IP-Based Fraud Prevention
IP filtering is the first line of defense against most automated fraud. By limiting the number of entries allowed from a single IP address, you can prevent scripts and bots from submitting thousands of entries from one machine.
| Revup Security Level | Entries per IP | VPN/Proxy Blocking | Best For |
|---|---|---|---|
| Strict | 1 | On | High-value prizes where one entry per household or network is acceptable |
| Medium | 3 | On | Campaigns where a few people may share a network |
| Low | 5 | Off | Lower-risk campaigns where accessibility matters more |
| Off | No IP limit | Off | Promotions where IP-based checks should not apply |
| Custom | Your choice | Your choice | A specific entry policy that doesn't match a preset |
Don't set IP limits too strict for shared networks
Office buildings, universities, and coffee shops share IP addresses among many users. A one-entry-per-IP limit can block legitimate entrants in these environments. A small allowance, such as three entries per IP, limits repeat entries while leaving room for people who share a connection. Choose the least restrictive setting that matches your official rules.
Revup offers five security levels: Strict, Medium, Low, Off, and Custom. Strict allows one entry per IP address, Medium three, and Low five; Strict and Medium also block known VPN and proxy connections. Entries over the limit are marked invalid. New promotions start on Strict, so review the level before running a shared-network event. CAPTCHA is a separate form field, and you can also allow or block specific IP addresses.
CAPTCHA and Bot Detection
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) remains one of the most effective tools against automated bot entries. It forces entrants to prove they're human before submitting the form.
| Approach | Friction Level | Bot Prevention | Best For |
|---|---|---|---|
| CAPTCHA on every entry | Low to moderate | Stops many automated submissions | Most public promotions |
| CAPTCHA only on suspicious activity | Low for most users | Depends on the detection signals | Platforms that support adaptive challenges |
| No CAPTCHA | None | None | Low-risk, trusted-audience campaigns |
| Honeypot fields (hidden form fields) | None — invisible to users | Catches simple bots only | Supplement to other measures |
CAPTCHA and other controls can add friction for legitimate participants. Review completion problems alongside fraud indicators rather than assuming a fixed conversion cost.
In Revup, CAPTCHA is a form field: when it is on the form, it applies to every submission. New promotions normally include it, and selecting the Off security level does not remove it. For extra assurance, the primary email or phone field can require a verification code before the form is accepted.
Revup
Revup forms support CAPTCHA, email and phone verification codes, email-domain rules, and the same IP and VPN controls used in promotions.
Geofencing and Location Restrictions
Many promotions are legally restricted to specific countries or regions. Geofencing enforces these restrictions at the entry level, preventing entries from locations outside your promotion's eligible territory.
This isn't just a compliance tool — it's a data quality tool. Entries from countries outside your market have no business value and dilute your metrics. A promotion for U.S. consumers gains nothing from entries in places where you can't award prizes or serve customers.
Geofencing Best Practices
- Match geofencing to your official rules eligibility — if rules say U.S. only, enforce U.S. only
- If your rules exclude any U.S. states, set the same eligible states in the promotion and check registration needs, such as New York and Florida when total prizes are more than $5,000
- Enable VPN blocking alongside geofencing — without it, users can bypass country restrictions more easily
- Disclose geographic eligibility clearly on the entry page — don't let ineligible people waste time entering
- Test from an eligible location and, when practical, an ineligible one before launch
Revup supports country restrictions (geofencing), eligible U.S. states, minimum ages, and VPN/proxy blocking to reduce ineligible entries. Location signals are imperfect, and geofencing is not proof of residency; review suspicious records and verify winner eligibility against your rules. See the sweepstakes law map and state registration and bonding requirements.
Preventing Duplicate Entries
Duplicate entries — one person entering multiple times with different email addresses — are harder to detect than bot traffic because each individual entry looks legitimate. The patterns only become visible when you analyze entries in aggregate.
| Detection Method | What It Catches | Limitations |
|---|---|---|
| Email deduplication | Same email used twice | Doesn't catch different email aliases |
| IP address tracking | Multiple entries from same IP | Shared networks create false positives |
| Email domain analysis | Disposable email services | Doesn't catch unique Gmail aliases |
| Entry timing analysis | Rapid sequential submissions | Doesn't catch spaced-out duplicates |
| Name + location matching | Same person, different email | Common names create false positives |
No single detection method catches everything. The most effective approach is layered prevention — combining IP limits, email deduplication, and entry timing analysis to catch more duplicates than any single method, while reviewing flagged records to limit false positives.
Don't be so aggressive that you block real entrants
Fraud controls can affect legitimate participants on shared networks or VPNs. Review blocked attempts and support requests before tightening settings, and investigate specific patterns.
VPN and Proxy Detection
VPN and proxy services allow users to mask their real IP address and location. Fraudsters use them to bypass IP limits (appear as different users), circumvent geofencing (appear to be in an eligible country), and hide their identity when submitting mass entries.
VPN blocking flags entries from known VPN and proxy networks. This is particularly important for promotions with geographic restrictions, where a user in an ineligible country could use a VPN to appear as if they're in the United States.
| Scenario | VPN Blocking Recommended? | Reason |
|---|---|---|
| High-value prize | Yes | Higher incentive for fraud |
| Geographically restricted promotion | Yes | Prevents geo restriction circumvention |
| International promotion (no geo restrictions) | Optional | Lower fraud incentive |
| Internal or employee promotion | No | Trusted audience, may use corporate VPN |
| Low-value or no-prize promotion | No | Low fraud incentive, not worth the friction |
Revup's Strict and Medium levels block known VPN and proxy connections; Low and Off don't, and Custom lets you turn it on or off. Matching entries are marked invalid for review. No network list is perfect, so check flagged entries before disqualifying anyone.
Referral Fraud Prevention
Referral mechanics — where participants earn bonus entries by inviting friends — are highly effective for campaign growth but create specific fraud opportunities. The most common scheme: self-referral, where one person creates multiple accounts to refer themselves and accumulate bonus entries.
Referral Fraud Prevention Measures
- Decide in your official rules whether referral bonus entries are capped per participant, and keep the referral entry value proportionate
- Require referred entries to be unique — the referred person must be a new email address not already in the system
- Apply IP limits to referral chains — if the referrer and referred person share an IP, flag it for review
- Monitor referral patterns — a single person generating 50+ referrals in an hour is likely gaming the system
- Award referral entries only after the referred person completes their own entry — prevents credit for clicks alone
- Use unique referral links that can be tracked and audited
In Revup, each participant gets a unique referral link, and a referral award is normally created only when the referred friend follows that link and completes the required participation. Customer profiles record who each person referred, which helps when you review suspicious referral chains.
Building a Fraud Prevention Strategy
Effective fraud prevention isn't about deploying every tool at maximum intensity. It's about matching your security measures to your risk profile — which varies by prize value, audience type, and campaign visibility.
Fraud Prevention Strategy Development
Assess your risk profile
High-value prizes, national promotions, and campaigns promoted on sweepstakes directories face higher fraud risk. Low-value prizes, local promotions, and campaigns promoted only to existing customers face lower risk.
Choose your security level
Medium (3 entries per IP, VPN blocking) suits many public campaigns. Strict (1 entry per IP, VPN blocking) fits high-value prizes where one entry per network is acceptable. Use Low or Off for lower-risk or trusted audiences. Keep the CAPTCHA field on public forms.
Add geo restrictions if applicable
If your promotion has geographic eligibility requirements (most do), enable geofencing and eligible-state settings to match your official rules. Add VPN blocking if the geographic restriction is important.
Monitor during the campaign
Watch for sudden entry spikes, unusually high entries from single IP ranges, or clusters of entries using disposable email domains. These patterns indicate fraud in progress.
Audit before winner selection
Before drawing winners, review the entry pool for obvious fraud — duplicate names with different emails, entries from blocked countries, or entries that somehow bypassed your security settings. Remove invalid entries before the draw.
Revup
Set a security level for each Revup promotion, then add CAPTCHA, verification codes, country restrictions, minimum ages, and eligible U.S. states to match your risk profile and official rules.
Fraud Prevention and User Experience
The tension in fraud prevention is always the same: more security means more friction. Every CAPTCHA, IP restriction, and verification step can turn away some legitimate entrants along with the fraudulent ones.
| Security Measure | Fraud Prevented | Recommendation |
|---|---|---|
| CAPTCHA | Some automated entry attempts | Review the campaign risk and keep required controls enabled |
| IP limits | Repeat entries from one network | Use a limit that fits shared networks |
| VPN blocking | Geo circumvention, IP masking | Use for geo-restricted or high-value |
| Email verification and domain rules | Fake or disposable emails | Use when contact quality matters |
| Geofencing | Ineligible entries | Use when eligibility is geographic |
Evaluate security controls using actual blocked attempts, participant support requests, and entry quality. Some legitimate users share IP addresses or use VPNs, so investigate before treating every block as fraud.
Post-Campaign Fraud Auditing
Even with prevention measures in place, some fraudulent entries will get through. A post-campaign audit before winner selection catches entries that slipped past your automated defenses.
Post-Campaign Fraud Audit Checklist
- Check for email address patterns — sequential addresses (user1@, user2@, user3@) suggest a single person
- Review entries from disposable email domains — mailinator, tempmail, guerrillamail, etc.
- Look for clusters of entries with the same IP address that exceeded normal limits
- Check for entries from countries or regions outside your eligibility zone
- Review referral chains for self-referral patterns (referrer and referral share IP or name patterns)
- Verify that the winner pool excludes disqualified entries before the draw
- Document your audit process — this protects you legally if a winner's eligibility is challenged
Review participant records and draw settings before selecting winners. Revup lets you validate or remove participant records in bulk, surfaces the fraud flags a promotion collected, and provides verifiable random drawings, ranked alternates, and claim records; your team remains responsible for investigating suspicious entries and deciding whether a winner meets the official rules. See random winner selection.
Sweepstakes Hobbyists: A Different Kind of Problem
Sweepstakes hobbyists aren't fraudsters — they're real people who enter dozens or hundreds of sweepstakes through directories and deal sites. They're not breaking your rules, but they're also not your target audience.
You can't (and shouldn't try to) block hobbyists. But you can minimize their impact on your campaign quality:
| Strategy | How It Works | Impact on Hobbyists |
|---|---|---|
| Brand-relevant prizes | Give away your products, not cash | Hobbyists skip promotions for products they don't want |
| Don't list on directories | Avoid submitting to sweepstakes aggregator sites | Reduces hobbyist traffic |
| Segment by source | Track where entries come from using UTM parameters | Lets you measure hobbyist impact separately |
| Post-entry qualification | Add a survey or quiz after entry | Identifies entrants with genuine interest |
| Email engagement filtering | Suppress contacts who don't engage after a set period | Removes hobbyists who never open emails |
The most effective anti-hobbyist strategy is prize selection. A $1,000 Visa gift card will attract every sweepstakes hobbyist on the internet. A $1,000 bundle of your products will attract people who actually want what you sell.
Frequently Asked Questions
How much fraud should I expect in a typical sweepstakes?
There is no reliable universal figure. The share of invalid entries depends on prize value, promotion visibility, whether the campaign is listed on sweepstakes directory sites, and the controls you use. Track invalid and flagged entries for each campaign and compare against your own baseline.
Will fraud prevention tools reduce my entry count?
Security controls can affect legitimate participants as well as abusive traffic. Review actual completion and support data, and adjust settings to the campaign without assuming that every excluded entry was fraudulent.
Should I use Strict security for every campaign?
No. Strict security (one entry per IP and VPN blocking) is appropriate for high-value prizes and nationally promoted campaigns. For lower-risk campaigns — local promotions, internal campaigns, or campaigns promoted only to your existing audience — Medium or Low security is sufficient and creates less entry friction.
What should I do if I discover fraud during a live campaign?
First, tighten your security settings — lower the IP limit, block VPNs, add the CAPTCHA field, or block specific IP addresses. Changing a preset replaces its IP and VPN settings, so check them after the change. Second, document the fraudulent entries (save IP data, timestamps, email patterns). Third, audit and remove confirmed fraudulent entries before the winner draw. Fourth, note the patterns for future campaigns so you can set stronger initial prevention.
Can I be held legally liable if a fraudulent entrant wins?
Your official rules should include a fraud disqualification clause that gives you the right to disqualify any entrant suspected of fraud. Include language stating that the sponsor reserves the right to void entries obtained through fraudulent means. This supports your decision if you need to disqualify a winner and select an alternate. Consult with a promotion attorney to ensure your rules are comprehensive.
For a complete overview of running legally compliant, fraud-protected promotions, explore our sweepstakes marketing strategy guide or start with the fundamentals in how to run a sweepstakes legally.
