Your welcome discount probably has a loop in it. Here's how to close it.
We discovered a loop in our welcome email flow which meant customers were applying a one-time, fist purchase discount code multiple times.
We found it on a client account a few weeks ago. A customer who'd placed somewhere around seventeen orders over about eighteen months, every single one of them with a 10% welcome discount applied. The orders looked normal. The discount looked normal. Nobody had flagged it because individually each order made sense. It was only when I was looking at customer LTV data that the pattern showed up.
When I pulled the order history, it was the same email address every time. Same shipping address. What the customer had worked out, whether deliberately or by accident, Is that unsubscribing from the email list and re-subscribing resets their status in the Klaviyo welcome flow. Klaviyo sees a new subscriber. The welcome email fires. A new discount code lands in their inbox. They use it.
This isn't an unusual exploit. It's a structural gap in how most Shopify and Klaviyo setups handle the definition of "new customer," and it exists on a lot of stores that have never looked for it.
Here's how to close it, in the order that actually matters.
Fix the checkout first, everything else second
The most important thing you can do is restrict the discount at the Shopify checkout level, and it surprises me how often this isn't set up. In Shopify Admin under Discounts, when you configure the welcome discount code, there's a customer eligibility setting.
Set it to "First-time customers" specifically.
What this does is cross-reference the email address on the order against Shopify's internal purchase history at the point of checkout. If that email address has any previous order attached to it, the discount throws an error at checkout such as "This discount is not available to you". The customer can have a valid unique discount code in hand and it won't apply.
This is the most robust single fix because it operates at the transaction layer, not the email layer. It doesn't matter whether the Klaviyo flow fired correctly, whether the customer used a slightly different email variant, or whether someone else shared the code. If the email on the order has previous purchase history, the discount doesn't apply.
Do this first. Everything else is defence in depth.
Then fix the Klaviyo trigger
The reason the loop exists in Klaviyo is that most welcome flows are triggered by "Joins a List”.This means the email fires every time someone subscribes, regardless of whether they've bought before. Unsubscribe, re-subscribe, flow triggers again. This is the loop hole we were seeing exploited the clients flows.
The fix is to add a flow filter with the condition: "What someone has done > Placed Order > zero times > over all time." Klaviyo retains purchase history independently of subscription status. A customer who unsubscribes and re-subscribes is still in Klaviyo's system with their order history intact. If they've placed an order before, this filter prevents the welcome email from sending at all.
Set this filter on the flow entry point, not just on individual emails within the flow. If it's only on the discount email and your welcome sequence has multiple emails before it, someone could still enter the flow and navigate to the discount through other means.
This stops the loop from being triggered. The Shopify checkout restriction stops the discount from being used even if the loop does trigger. You want both.
Use unique codes, but understand what they actually prevent
If you're running a single static code such as ’NEW10’ switch to Klaviyo's dynamic coupon feature, which generates a unique one-time-use string for each recipient. This is worth doing regardless of the loop issue because static codes get posted to discount code aggregator sites and used by people who never even saw your email.
What unique codes don't prevent is the loop itself. A customer who triggers the welcome flow gets a new unique code each time.
If the flow fires and the Shopify checkout restriction isn't in place, they can use it. Unique codes solve the sharing problem. They don't solve the re-subscription problem. That's why the order of fixes matters.
The same-household different-email problem
The Shopify checkout restriction catches the same email used repeatedly. It doesn't catch the same person using multiple email addresses which is less common but worth understanding.
Within Shopify, you can cross-reference by shipping address. If you go into the customer record for someone who's flagged as suspicious, look at the shipping address and search for other customer records with the same address. You'll occasionally find two or three accounts, different emails, same household, all with welcome discounts used.
For this specific gap, the practical fix at checkout isn't native to Shopify. You'd need a fraud prevention app that matches on address or phone number rather than just email. For most brands, this is probably more complexity than the problem warrants unless you're seeing it at meaningful scale. The Shopify first-time customer restriction and Klaviyo flow filter will catch the vast majority of cases.
If you only do one thing
Set the Shopify checkout restriction to "First-time customers." It's a two-minute change in Shopify Admin and it's the hardest block in the stack. Everything else such as the Klaviyo filter, the unique codes, the address cross-reference simply adds layers on top of it. But if you only have time for one fix right now, that's the one.
The customer we found on the client account was still active. We didn't cancel the orders. They were placed in good faith and the gap was on our side, not theirs. They were also a customer with many previous orders. We closed the loop, applied the checkout restriction, and moved on. If it happens again from that email address, Shopify will block it at checkout before it becomes anyone's problem.
Q: How do customers exploit Klaviyo welcome discount loops on Shopify stores?
The exploit works by unsubscribing from the email list and re-subscribing. Klaviyo sees a new subscriber, the welcome flow triggers, and a fresh discount code lands in their inbox. Most welcome flows are triggered by the Joins a List event with no check on whether the subscriber has placed a previous order. The customer's subscription status and purchase history are tracked independently in Klaviyo, so re-subscribing resets their eligibility for the flow without erasing their order history.
Q: How do I stop welcome discount codes being used by existing customers in Shopify?
In Shopify Admin under Discounts, set the customer eligibility on your welcome discount code to First-time customers. Shopify cross-references the email address on the order against its internal purchase history at checkout. If that email has any previous order attached to it, the discount is blocked at the transaction level regardless of whether the code is valid. This is the single most effective fix because it operates at checkout, not in the email flow.
Q: How do I fix the welcome flow loop in Klaviyo?
Add a flow filter at the entry point of the welcome flow with the condition: What someone has done > Placed Order > zero times > over all time. Klaviyo retains purchase history independently of subscription status, so a customer who unsubscribes and re-subscribes still has their order history intact. This filter prevents the flow from triggering for anyone who has placed a previous order. Set it on the flow entry point rather than on individual emails within the flow.
Q: Do unique discount codes in Klaviyo prevent the welcome discount loop?
No. Unique codes prevent a single code from being shared across multiple people, which is worth doing regardless. But they do not prevent the re-subscription loop. Each time the welcome flow triggers for the same person, Klaviyo generates a new unique code. The loop still works. The Shopify first-time customer restriction and the Klaviyo flow filter are what close the loop. Unique codes solve the sharing problem. They do not solve the re-subscription problem.