To me, hacking a device is quite different than hacking a promotion. When you hack a device, there's usually no victim. However, when you hack a commercial transaction, there typically is a victim because most transactions are zero-sum (or at least the transaction surplus is zero-sum).