How to Stop Stamp Card Cheating (Customers and Staff)

Last updated: September 2026

Give a stamp only with a paid purchase, make the stamp hard to copy, limit how many stamps one card can get in a day, and keep a record of who gave each stamp. That covers both kinds of cheating: customers filling in their own cards, and staff stamping cards for friends. Paper cards can manage the first three with a custom stamp, initials and a house rule. Paper struggles with the last one: a reliable record of who gave each stamp.

This guide starts with paper: how people cheat, how to spot it, and rules that cost nothing. Then it looks at digital cards, with FaveCard’s actual limits as the example.

How do customers cheat on paper stamp cards?

Most customers who cheat simply stamp the card themselves. On a small-business marketing forum, a pizza shop owner asked how to stop people punching all six holes at home. A salon owner on SalonGeek asked the same about clients stamping their own cards. The methods are low-tech:

• Buying the same stamp. If yours is a star or a heart from a craft store, anyone can buy one.
• Punching at home. A standard hole punch makes a standard hole.
• Copying the card. A card printed on plain stock is easy to reprint.
• Reusing a redeemed card that nobody marked or kept.

At scale, this can end a program. Subway dropped its Sub Club stamps in 2005, when, as the Associated Press reported, thousands of stamps were for sale on online auction sites and franchise owners kept finding counterfeits. A café won’t see that volume. The weak spot is the same, though: if your stamp can be bought or copied, sooner or later someone will do it.

How can you tell a stamp card is fake?

Five physical tells give most fakes away:

What you see	Why it’s suspicious
A full card that looks brand new	Real cards spend weeks in wallets and get worn. One bakery owner treats a crisp, full card as a fake.
Every stamp in the same ink shade, at the same angle	Stamps given on ten different days vary. Ten identical marks were probably made in one sitting.
A stamp that’s close to yours but not quite	Someone found a similar one. Keep a stamped sample card at the register to compare.
Marks without initials or a date	If your staff always add them, a bare stamp didn’t come from them.
A full card from someone nobody on staff remembers	Not proof, but worth a friendly “when were you in last?”

Don’t accuse anyone over a single tell. A crumpled card with smudged stamps usually belongs to a regular with a messy bag.

Is staff fraud a bigger problem than customer fraud?

It can be. In the same forum thread, the owner of a small bakery chain said customers weren’t their problem at all; employees were. A staff member can stamp a card, claim the free item and sell it at full price. That owner also phones a few of the people who redeemed a card, from time to time, to ask whether they really used it.

Staff fraud is usually smaller than that: a couple of extra stamps for a friend. It doesn’t feel like taking anything, yet every card they complete ends in something you give away free.

There’s also a difference in effort. A customer who fakes stamps has to buy a stamp and hope nobody looks closely. An employee is at the counter all day with the real one.

Which rules stop staff giving away stamps?

Write them down and go through them when someone starts. Four cover most of it:

1. One stamp per qualifying purchase, given at payment. No stamps “for next time”, and no stamps without a sale on the register.
2. Staff never stamp their own cards. If you want to reward your team, give them a staff perk, so the loyalty card isn’t their only route to a free coffee.
3. Initial and date every stamp. On paper, initials turn each mark into a record. Salon owners on SalonGeek do exactly this.
4. Keep the stamp behind the counter, out of reach from the customer side, and put it away at closing.

Then check the numbers once a week. On a 10-stamp card, redeemed rewards can’t honestly exceed a tenth of the stamped purchases. If redemptions jump in a week when sales didn’t, look at who was on shift.

Leave room for judgment, too. An extra stamp for a regular whose order came out wrong is good service. Tell staff when a free stamp is fine, so the rule is about stamps nobody paid for and nobody knows about.

Should you limit stamps per day?

For self-service stamping, yes. Owners on Square’s seller forum have asked for exactly this: a way to stop one customer collecting several stamps in a day. Without a limit, someone can pay for three coffees separately and walk out with three stamps, or a group can put every drink on one card.

One or two stamps per card per day suits most shops. Two lets someone who comes back in the afternoon still get their stamp. For a group order, staff can add the extra stamps by hand, so the exception has a name on it.

A limit also sets the fastest possible pace. With a 10-stamp card and a limit of two a day, nobody can finish in under five days. If you’re still choosing the card length, our guide on how many stamps a loyalty card should have has completion data by length.

Can people cheat a digital stamp card?

Yes, if the stamp comes from something that never changes. A QR code printed and taped to the counter is the weak spot: someone photographs it once and scans the photo whenever they like. A fixed code that staff show on a phone has the same problem.

Before you choose a digital card, ask how a stamp actually gets added:

• Does the code change? It should rotate every minute or two and work once.
• Is there a daily limit, and a gap between stamps?
• Does sign-up check anything? An email or phone code makes fake accounts slow to create.
• Is there a log? Every stamp should show when it happened, and staff stamps should show who gave them.

Digital doesn’t mean cheat-proof. It means the rules are enforced by software instead of by memory. If you’re still deciding whether to switch at all, we’ve compared paper and digital loyalty cards on real costs and when each one works best.

How FaveCard’s kiosk stops self-stamping

FaveCard’s kiosk mode turns a phone or tablet on your counter into a self-service stamp point. The screen shows a QR code, and the customer scans it with their own phone and collects the stamp there. These are the checks, taken from the product code:

• Every code is signed by our server and works once. Each business has its own signing key, which never leaves the server, and changing any part of a code breaks it. A second scan of a code that was already used is rejected.
• A code expires after 120 seconds. The kiosk switches to a new one every 60 seconds, and straight after each scan. A photo of the screen is dead within two minutes, and even then it works only if nobody has scanned that code yet.
• Two kiosk stamps per card per day by default. You can set anything from 1 to 5 in the app.
• 15 minutes between kiosk stamps on the same card. Someone who scans again right away sees their card, but can’t collect another stamp until the 15 minutes are up.
• New customers confirm their email with a 4-digit code. The code is valid for 5 minutes and allows 5 tries. One address can request 3 codes per 15 minutes, and the address has to be able to receive mail. A customer who is still signed in on their phone skips the code and just taps “Collect your stamp”.

The stamp is stored on the server and the card in Apple Wallet or Google Wallet only displays the count, so there’s nothing on the card to copy. For setting up the device itself (locking it to one app, where to put it, keeping it running all day), see our iPad kiosk mode guide.

How do you see who gave each stamp?

Staff stamp from the FaveCard app: they scan the customer’s card or look the customer up, choose how many stamps, and tap to add them. Staff stamps skip the daily limit and the 15-minute gap on purpose. That’s how you handle a group order, or carry over stamps from someone’s old paper card.

So for staff, the control is the record. Every stamp shows up in the customer’s activity with the time, and a staff stamp shows the name of the person who gave it, like “+1 stamp · By Anna”. Tap an entry for the details: the date, the card, and either “Kiosk” as the source or the staff member’s name. With a separate login for each employee, that name is always the right one.

With a kiosk on the counter, customers collect most stamps themselves, within the daily limit and the 15-minute gap. Staff stamps become the exception, and each one has a name. If one name keeps appearing next to extra stamps for the same few customers, the activity feed will show you.

Kiosk mode and separate staff logins are part of the Business plan. See pricing for what each plan includes.

What can’t any system stop?

Two friends sharing one card. A regular with two email addresses and two cards, since the daily limit counts per card, not per person. These cost you little, and chasing them costs goodwill.

Set the rules, keep the record, look at it once a week, and let the small stuff go. A program that treats every regular like a suspect won’t keep many regulars.