Guide 60 · Risk and fraud
How to prevent employee fraud in a loyalty program
Treat points like cash and design the controls before launch. Separate the people who create points from the people who approve them, cap how many points any one employee can issue, require a reason code for every manual change, and keep an audit log no employee can edit. Then review exception reports regularly, because controls reduce fraud but do not catch all of it.
Employee loyalty fraud is the misuse of points, rewards or member accounts by the people who run the program day to day. Most loyalty fraud discussions focus on outsiders: account takeovers, resellers and fake sign-ups. The people with the easiest access to points, though, are often your own employees. A cashier, a store manager or a customer service agent may be able to add points, move them or approve a redemption in a few clicks. This guide covers where employee fraud happens, which controls prevent it, how to catch what gets through, and how to keep the controls from slowing down honest service.
Why it matters
Why is employee fraud a design problem?
Because points behave like money that is paid out later. Every point issued is a promise the business has to honor, and many companies record unredeemed points as a liability; Starbucks, for example, defers revenue for the Stars members earn and records a liability for them. An employee who can create points without a second person checking is holding something close to the keys to a cash drawer.
Fraud research usually describes three conditions behind employee fraud: pressure, a rationalization and an opportunity. Only the opportunity is under your control, and in a loyalty program it is created by access rights. The fix is not to distrust staff. It is to make the program’s economics depend on controls rather than on each person’s honesty. Controls are much cheaper to build before launch than after an incident, when they arrive as rushed patches and members feel every new restriction. If your program already runs, the same controls still apply; they just take more care to roll out.
Where it happens
Where does employee fraud happen?
It follows access. Map every point where an employee can touch a balance, and you have mapped the risk.
| Scheme | How it works | Who can do it | Main control |
|---|---|---|---|
| Unclaimed purchase capture (sweethearting) | Scanning their own or a friend’s card when a customer pays without one | Cashiers | Flag staff-linked accounts; watch earn frequency |
| Manual credits | Adding points through a service tool as fake “goodwill” | Service agents, managers | Daily caps, reason codes, approval above a limit |
| Dormant account redemption | Redeeming points from inactive members who will not notice | Anyone with redemption access | Extra verification on dormant accounts |
| Account takeover from inside | Changing a member’s email or phone, then redeeming | Service agents | Notify the old contact; delay redemption after changes |
| Reversal manipulation | Returning an item without removing the points it earned | Cashiers, returns staff | Automatic point reversal on refunds |
| Stacking | Combining staff discounts, coupons and bonus points beyond the rules | Store staff | Clear stacking rules enforced at the till |
Some of these need no special rights at all, which is why the cashier schemes are usually the most frequent. Manual credits and dormant account redemptions are less frequent but larger, because one person can move many points quickly.
Prevent it
Which controls prevent it?
Five controls cover most of the risk:
- Separation of duties. The person who requests a large adjustment is not the person who approves it. No employee can adjust or redeem on their own account or accounts linked to them.
- Limits. Cap the points any one employee can issue manually per day and per adjustment. Above the cap, a supervisor approves.
- Reason codes. Every manual change needs a reason from a fixed list and, for larger amounts, a reference such as an order number or case ID.
- An audit log no one can edit. The points ledger should record who changed what, when and why, and no employee, including administrators, should be able to alter or delete their own entries.
- Least privilege. Give each role only the rights it needs. A cashier does not need to edit member contact details; a marketing analyst does not need to issue points. Remove access on the day someone changes role or leaves.
Give staff a way to report concerns without going through their own manager, such as an ethics line or a named contact in loss prevention. Collusion with outsiders, where an employee passes account details to a fraud ring, is often spotted first by colleagues.
Automate where you can. Point reversals on refunds, expiry and promotional credits should run from rules, not from staff actions, so there is nothing to manipulate.
Detect the rest
How do you detect what the controls miss?
Controls narrow the opportunity; exception reports catch what remains. Review them on a fixed schedule, weekly for a large program, and assign one named person to act on them. Useful reports include:
- Manual adjustments per employee, ranked, with the largest totals and the most frequent users at the top.
- Adjustments and redemptions on accounts that were dormant for six months or more.
- Points earned on accounts linked to employees, by address, phone, payment card or device.
- Contact detail changes followed by a redemption within a few days.
- Refunds where the original points were not reversed.
Compare each employee with peers in the same role and store, not with the whole company. A high adjustment count may be normal at a busy flagship store and unusual at a quiet branch. When an outlier appears, look at the detail before drawing conclusions: some high numbers have a legitimate explanation. The patterns overlap with outside fraud, so the same reviews support your wider loyalty fraud defenses.
Keep service fast
How do you keep controls from slowing service?
Every control an employee feels, a member may feel too: a delayed credit while a supervisor approves it, or a redemption held after a phone number change. Set limits too low and agents escalate routine goodwill gestures; set them too high and the control does little.
Use your own history. Look at a few months of manual adjustments and set the per-employee limit so that most routine cases pass without approval while the large ones do not. In a hypothetical program where most goodwill credits are under 500 points, a cap of 2,000 points per adjustment and 5,000 points per employee per day would let routine service run untouched while sending unusual activity to a second person. Review the limits every few months, and give supervisors a quick approval path so that a held credit takes minutes, not days.
Test your program
How do you test your own program?
Run a short audit of roles. It takes a few hours and usually shows where the gaps are.
- List every role that can create points, move points between accounts, change member contact details or approve a redemption.
- For each role, ask whether one person can do it without a second sign-off. If yes, ask how much points liability that person could create in a week.
- Ask whether that person can change or delete the record of their own actions. If yes, the control does not really exist for that role.
- Check whether staff accounts are flagged and linked to employee records.
- Check that refunds reverse points automatically.
Where a role has both high value and no second check, add a preventive control: a cap or an approval step. Where the value is low, a detective control such as a weekly report is usually enough. The risk depends less on the size of the program than on how much point-moving power sits in a single pair of hands.
More answers
Frequently asked questions
How common is employee fraud in loyalty programs?
There is no reliable public figure, partly because companies rarely disclose it. What is clear is where the opportunity sits: any employee who can add points, attach purchases to an account or approve redemptions without a second check. Design for that opportunity rather than waiting for evidence that it is being used.
What is the most common type of employee loyalty fraud?
Schemes that need no special access tend to be the most frequent: a cashier scanning their own card, or a friend's card, when a customer pays without one. Manual point credits through a customer service tool are less frequent but usually larger, because one person can move many points quickly.
What is sweethearting in a loyalty program?
Sweethearting is a retail term for an employee giving friends or family goods, discounts or benefits they are not entitled to. In a loyalty program it usually means a cashier attaching a customer's purchase to a friend's card, or adding points or rewards for people they know.
Should staff be allowed to join the loyalty program?
Many programs let them, because employees are customers too. Flag staff accounts, link them to the employee record, and watch them in exception reports. Block employees from adjusting or redeeming on their own account or accounts linked to them, and make sure staff discounts and loyalty earn follow clear stacking rules.
Who should own employee fraud controls?
The loyalty owner, with finance, internal audit and IT security. Finance cares because points are a liability, audit tests the controls, and IT manages access rights. One person should be accountable for reviewing the exception reports and acting on them.
What should you do when you find employee fraud?
Freeze the affected accounts, preserve the audit log, and involve HR, legal and loss prevention before speaking to the employee. Reverse fraudulent points where your terms allow it, then fix the control that failed so the same scheme cannot be repeated by someone else.