Loyalty fraud is stealing or fraudulently cashing in loyalty points, miles, or rewards. Points are real value, yet customers watch them far less closely than cash, so a takeover can run unnoticed for a long time.
What is loyalty fraud, in plain English?
Loyalty fraud is the theft or fraudulent redemption of loyalty points, airline miles, or rewards. These programs hold genuine value, points convert into flights, gift cards, merchandise, or cash, but they live in a part of the customer relationship that gets far less attention than a bank balance or a credit card. That gap between real value and low scrutiny is exactly what fraudsters exploit.
Two patterns dominate. The first is account takeover of loyalty accounts, especially dormant ones, where a fraudster logs in, then drains or transfers the points. The second is point farming, generating rewards through fake activity, abused promotions, or bogus transactions, so the balance itself is illegitimate. Either way the points are converted into something spendable before anyone notices.
Because customers rarely check their points, loyalty fraud can go undetected for weeks or months. The defenses are practical: extra authentication at the point of redemption, velocity limits on how fast points can be cashed out, and anomaly detection on activity in dormant accounts. It overlaps with account takeover and promotion abuse.
How loyalty fraud is carried out
A takeover-driven loyalty fraud usually runs like this:
- Target — Find dormant accounts. Fraudsters go after rarely used loyalty accounts with built-up balances that owners are unlikely to be watching.
- Access — Take over the login. Using breached or reused credentials, they log in from a new device, often changing contact details to lock the owner out.
- Convert — Redeem or transfer fast. Points are bulk-redeemed for gift cards or goods, or transferred to accounts the fraudster controls.
- Vanish — Cash out before it is seen. The value is spent or resold, and because the owner was not watching, the loss surfaces late if at all.
What it looks like in practice
In practice
A retailer's rewards program sees a login on a loyalty account that has been quiet for over a year. The session comes from an unfamiliar device and region, the email on file is changed, and within minutes the full points balance is redeemed for digital gift cards. The customer, who had forgotten the account existed, notices nothing.
The pattern repeats across a batch of dormant accounts in the same week, all redeemed to the same handful of gift-card types. Only when the program runs anomaly detection on dormant-account activity does the cluster surface. Step-up authentication at redemption, and a velocity limit on how fast a balance could be cashed out, would have stopped most of it.
Why it matters to operators
Loyalty programs are often treated as a marketing feature rather than a store of value, so they get lighter controls than payment products, even though the points are convertible into cash-equivalent rewards. That mismatch makes them a soft target, and the low customer vigilance means the fraud runs quietly and is under-reported, which in turn keeps it under-resourced.
The good news is that the defenses are straightforward and effective. Require step-up authentication at redemption, the highest-risk moment, so a stolen login alone is not enough to cash out. Apply velocity limits so a balance cannot be drained in one burst. And run anomaly detection on dormant accounts, since sudden activity on a long-quiet account is one of the clearest signals. Treating points like the real value they are, rather than an afterthought, closes most of the gap.
What to watch in the data
- Dormant account wake-ups. Sudden logins or activity on accounts that have been quiet for months, a top signal of takeover.
- New-device logins. Access from unfamiliar devices or regions, especially followed by a contact-detail change.
- Bulk or rapid redemption. A whole balance cashed out quickly, often into gift cards or transfers.
- Transfers to unfamiliar recipients. Points moved to accounts with no prior relationship to the owner.
- Clustered cash-outs. Many accounts redeeming to the same reward types or destinations in a short window.
Quick questions
Why do fraudsters target loyalty points?
Because points hold real, convertible value but sit behind lighter controls than money, and owners rarely check them. That combination of value and low vigilance makes loyalty accounts an easy, low-risk target.
Is loyalty fraud just account takeover?
Takeover is the most common form, but not the only one. Fraudsters also farm points through fake activity or abused promotions, creating illegitimate balances rather than stealing an existing one.
Why is it under-reported?
Because customers rarely monitor their points, the theft can go unnoticed for a long time. Many victims only discover it when they try to redeem and find the balance gone, well after the fraud.
What stops it most effectively?
Step-up authentication at redemption, velocity limits on how fast points can be cashed out, and anomaly detection on dormant-account activity. Together they protect the moment value actually leaves the program.
How does it relate to promotion abuse?
Point farming overlaps with promotion abuse: exploiting sign-up bonuses, referral rewards, or promotions to generate rewards that were never genuinely earned, inflating balances that are then cashed out.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.