A scratch card game that cannot be won by reloading the page

The rules on the card say "one card per person per day". A visitor scratches, finds 5% off, and does the obvious thing: reloads the page. If the shop deals a fresh card, they scratch again. And again, until the 25% card turns up. By the end of the day the shop has given away a stack of top prizes to the most patient visitors, and the chances you set mean very little.

A scratch card is a nice piece of theatre on a shop, especially around Black Friday. But the theatre only works if what happens behind it is a real draw. This post explains what that takes on a Magento 2 store, using our Scratch & Win module as the example: when the prize is decided, what stops a second card, what happens to prizes nobody claims, and how to make the card usable for people who cannot scratch.

The prize is decided when the card is dealt

In Scratch & Win the prize is drawn on the server at the moment the card is handed out, using the chances, prize limits and budget you set. The prize is then bound to that card. Scratching only reveals what was already drawn. A visitor who reloads the page while a card is open gets the same card with the same prize again, never a new draw. Reopening a finished card shows the code that was won, not a new card.

The prize label is sent to the browser with the card, because it has to sit under the scratch surface. The coupon code is not: it is only sent after the card has been scratched, and a card can only be revealed once. The visitor cannot change the prize, and seeing the label early does not give them a code.

Play limits decide how many cards a person gets: cards per day per browser, per customer account, per e-mail address and per IP address, and cards per person over the whole campaign. Parallel requests from the same player or e-mail address are handled one after the other, so the limits cannot be passed by sending several requests at once. The card endpoints only accept POST requests from pages of your store with a valid form key, have a hidden honeypot field and a rate limit, and you can add Magento's reCAPTCHA v3 check before a card is dealt when that module is installed and its keys are set.

Chances, limits and a budget

Each card has a list of prizes: percent off the items, an amount off the basket, free shipping, no prize, or a code of one of your own cart price rules (a "Specific Coupon" rule with "Use Auto Generation", so each winner gets a new code). Every prize has a weight, and the admin shows each prize's chance in percent as you type. The module's own example is the weights 50, 30, 15 and 5 for 5%, 10%, 15% and 25% off, which gives 5% off half of the time.

Each prize can have a minimum subtotal, a maximum number of winners in total and per day, and a validity in days. When a prize runs out, the fallback prize (or a "no prize" row) is given instead. Above that sits a budget: a maximum number of prizes and a maximum prize value. Value is estimated from a typical basket and shipping cost you enter, unless you set the value per prize yourself. When the budget is used up, visitors see "All prizes have been given away. Thank you for playing."

Every win becomes a personal, single-use coupon code through the shared Promotions core, and by default only the winner's e-mail address or customer account can use it.

Prizes nobody collects

Drawing the prize when the card is dealt has a side effect. Some visitors get a card and never scratch it. Others, when you ask for the e-mail address only after scratching, see that they won and then close the tab without entering it. Those prizes were counted against your limits and budget when the card was dealt.

Scratch & Win gives them back. Cards that were never scratched, and wins nobody entered an e-mail address for, return their prize to the prize limits and the budget after a set time (24 hours by default). An hourly cron job does this, and there is a CLI command to do it by hand. Without that, a popular card could run out of top prizes on paper while most of them sat on cards nobody finished.

A card everyone can play

The scratch surface is a canvas that works with a mouse, a finger or a pen. When a share of the surface is scratched (55% by default), the rest disappears and the prize shows. Phones that support vibration give a small buzz.

Scratching is not something everyone can do, so the card has a Reveal button that does the same thing for keyboard and screen reader users. Visitors who have set "reduce motion" in their operating system get no confetti and no delay.

Winners see their code with Copy code and Apply to basket, the validity date and the minimum subtotal. If the basket is empty, the code is kept and applied when the first product is added. You can also have the code applied automatically as soon as the prize is revealed, and send it by e-mail. If you use Coupon Wallet, logged-in winners also find the code in My Coupons.

When the card opens is up to you: after some seconds, after scrolling, on exit intent, straight away, only from a floating "Scratch & win" tab, or only when another module offers it. The checkout is never included. Only one automatic promotion popup opens per page view, shared with the other promotion modules.

Limits and when you do not need it

The results on each card's page show views, cards played and scratched, prizes won, codes used in orders, revenue and discount, budget used, and how often each prize was drawn. A Preview link lets you try the card on the storefront without counting anything or issuing a code.

Amounts of fixed prizes and minimum subtotals are in the base currency. Prize e-mails use Magento's e-mail sending, so on a store with mail switched off only the card shows the code.

If all you want is a welcome discount for new subscribers, a plain sign-up form is simpler and cheaper. A scratch card is for when you want a moment of fun around a campaign and are willing to give away prizes for it, with a fixed limit on how many.

The Scratch & Win module page has the full card settings and more screenshots on Luma and Hyvä.