If a user is able to redeem endlessly, make sure to check if Superuser access is provided to the guest.
Having Superuser access allows guest accounts bypass any earning, redeeming or fraud-related settings that are configured for the business. This feature allows accounts to be used for extended testing, but should be monitored appropriately.
To confirm the Guest Access:
- View guest profile
- Click on edit profile
- Click on Guest Functions available at top right corner
- For Guest with Superuser access an option to remove as Superuser will be provided 
Disclaimer:
In an effort to supply information as quickly as possible, this article has been published prior to a formal technical review, and is subject to factual, grammatical, and various structural errors. Data may be incomplete, misordered, or incorrect.
This additional disclaimer will be removed upon formal review of this article. The standard Punchh Inc. KB Disclaimer still applies, and can be found at: https://support.punchh.com/hc/en-us/articles/360040100273-Punchh-Inc-Knowledge-Base-Disclaimer
If further assistance is required, submit a ticket to Punchh Support. (For help submitting a ticket, click here)