Guide 28 · Risk and fraud
Loyalty fraud: types and defenses
Loyalty fraud falls into a few main types: account takeover, promotion, referral and enrollment abuse, earning on purchases that were never made or were returned, employee abuse, and laundering or reselling points. Build controls where points change hands or turn into value: logins, balance changes, transfers and redemptions. When a member's points are stolen, restore them quickly, secure the account, then investigate.
Loyalty fraud is any use of a loyalty program to take value it was not meant to give: stealing members’ points, earning without a genuine purchase, or abusing offers and transfers. A loyalty balance is stored value. Members build it slowly and spend it in one go, and in many programs it is protected by less than a bank account. That makes programs a target for criminals, for some members and sometimes for staff. Losses are usually small per incident but add up, and every case damages trust. This guide sets out the main types of loyalty fraud, the controls that stop each one, how to spot it early, and what to do when a member’s points are stolen.
The main types
What are the main types of loyalty fraud?
| Type | How it works | Main controls |
|---|---|---|
| Account takeover | Criminals log in with stolen or reused passwords, often tested in bulk by bots, then redeem or transfer the balance | Breached password checks, login limits, extra verification for redemptions and account changes, alerts |
| Enrollment, referral and promotion abuse | Multiple fake accounts claim sign-up bonuses, referral rewards or one-per-customer offers | Bot checks and identity checks at enrollment, device and payment matching, rewards paid only after the referred member stays active |
| Fake or reversed earning | Points earned on purchases that were returned, canceled or never happened | Reverse points on returns, delay posting until the return window closes, receipt checks |
| Social engineering | A caller talks a service agent into changing account details or issuing points | Identity checks before any agent adjustment, limits on agent credits, call logs |
| Employee abuse | Staff add their own card to customers’ purchases or adjust balances | Role permissions, audit logs, exception reports by store and employee |
| Laundering and resale | Points are bought with stolen cards, moved across accounts and turned into gift cards or other resellable rewards | Transfer limits, holds on new accounts, checks on high-value and gift card redemptions |
| Partner and channel abuse | Partners or trade buyers earn on activity the rules do not allow | Clear eligibility rules, claim validation, partner audits |
Rewards that work like cash, such as gift cards, are the usual end point, because they can be sold on quickly. Each type has its own guide in more depth: see employee loyalty fraud, points laundering and resellers and capping earning and promotion stacking. For partner programs, see channel incentive claims and leakage.
Do you need a taxonomy
Should you build a formal fraud taxonomy?
Only if it changes what you do. A taxonomy is useful when each category leads to a different response: block, hold for review, reverse the points, educate the member or do nothing. If two categories always lead to the same action, merge them.
A quick test: write down the five fraud patterns you see most often, and next to each the action you would take today. If every pattern ends in “block and reverse”, you need better controls, not more categories. If several need different treatment, such as instant blocking for takeover and manual review for suspected employee abuse, a short list of categories will speed up decisions. Review it every quarter and delete any category that no longer changes an action. One exception: if a partner contract or regulator requires you to report certain types separately, keep those categories.
Stop account takeover
How do you defend accounts against takeover?
Most takeovers start with credential stuffing: bots try usernames and passwords leaked from other sites until some work. Treat takeover as a design problem for the points ledger, not only a login problem, and put controls at four points:
- Login. Reject passwords known to be breached and limit failed attempts. NIST’s authentication guideline for government systems is a useful benchmark: it requires checking new passwords against a blocklist of commonly used, expected or compromised passwords, and capping consecutive failed attempts on one account at no more than 100, with lower limits allowed.
- Balance changes. Require re-verification, such as a one-time code, before a redemption above a set value, a points transfer, or a change to the email, phone number or password.
- Redemption speed. Use a rate limit on how many points can leave an account in a day, and hold unusual redemptions, such as a full balance spent minutes after a password reset, for review.
- Recovery. Notify members of every redemption and every account change, through a channel the attacker cannot easily change.
Apply the same identity checks to your contact center, so an attacker cannot simply call in and ask for the email to be changed. How far to go depends on what an attacker can do with the points. A program whose points can be transferred or swapped for gift cards needs all of these controls. A program with low balances, no transfers and rewards tied to the member’s own name can rely on standard authentication and monitoring.
Spot it early
How do you spot loyalty fraud early?
Most loyalty fraud leaves no chargeback, so you only see it if you look. Watch for:
- redemptions within hours of a password, email or phone change, or from a new device;
- many accounts created from one device, address or payment card, especially around a sign-up or referral offer;
- points earned on orders that are later returned or canceled;
- a store, agent or employee with far more manual point adjustments than peers;
- sudden spikes in transfers between accounts or in gift card redemptions.
Track a few numbers every month: confirmed fraud cases, points reversed and restored, the share of redemptions held for review, and how many held redemptions turn out to be genuine. That last figure tells you whether controls are blocking real members. Start with simple rules and tighten them as you learn your own patterns.
When points are stolen
What should you do when a member’s points are stolen?
Restore first, investigate second. The program alone issues and adjusts points, so a theft is a correction to its own ledger. A practical sequence:
- Freeze the account as soon as theft is reported or detected.
- Restore the stolen balance quickly, ideally within one business day.
- Re-verify the member’s identity and reset credentials before unfreezing.
- Review the case afterward: how the attacker got in, and whether the same pattern hit other accounts.
Making the member wait weeks while you establish fault costs more than it saves. In a hypothetical case, a member who would spend $1,200 a year at a 10% margin brings $120 of margin annually; losing that member over a $120 balance is a poor trade. Reverse the order only when there is clear evidence the member shared credentials or took part, and say in your terms how theft claims are handled.
Reporting and disclosure
Why is loyalty fraud often underreported?
Payment card fraud is reported through the payments system; loyalty fraud usually has no equivalent channel. A program can reverse a redemption, reissue a balance and close the case without any outside party knowing. Some fraud is also never detected: points have no cash value on paper, balances per member are often small, and without monitoring, a takeover may surface only when a member complains.
This makes industry-wide fraud levels hard to know, and your own fraud rate easy to underestimate. Measure it anyway, with the numbers above. Always tell affected members what happened and what you did. Whether to disclose more widely depends on the incident and your legal obligations, which your legal team should decide.
Size the defenses
How do you size your fraud defenses?
Compare the expected loss with the cost of the controls. Multiply active members by the average balance and your cost per point to get the value at risk, then estimate what share of it fraud could reach each year. In a hypothetical program with 1 million members, an average balance of 4,000 points and a cost of one cent per point, members hold $40 million in value. If stronger controls cut successful takeovers from 0.2% to 0.05% of accounts a year, expected losses fall from $80,000 to $20,000, a saving of $60,000 a year to set against the build cost and the friction for genuine members.
Run the same calculation for each fraud type. Spend first where the value at risk is high and points can leave the program easily, and review the numbers whenever you add a new way to earn, transfer or redeem.
More answers
Frequently asked questions
What is loyalty fraud?
Any use of a loyalty program to take value it was not meant to give: stealing members' points, earning points without a genuine purchase, abusing sign-up, referral or promotional offers, or turning points into cash through transfers and resale. Balances build up over months and are often protected by little more than a password, which makes them an easy target.
What are the warning signs of loyalty fraud?
A full balance redeemed soon after a password, email or phone change; many accounts sharing one device, address or payment card; points earned on purchases that are later returned; and one employee or store with far more manual adjustments than its peers.
How do you prevent loyalty account takeover?
Block known breached passwords, limit failed login attempts, and protect the moments when value moves: require extra verification for redemptions, transfers and changes to email or phone, limit how fast balances can be spent, and notify members of every redemption and account change.
Is stealing loyalty points a crime?
Points have real value to the member and the program, and taking them from someone else's account without permission is treated as theft or fraud in most places. How a case is handled depends on the jurisdiction and the amount, so keep evidence and let your legal team decide when to involve law enforcement.
Should a program restore points stolen from a member?
In most cases, yes, and quickly. The program controls the ledger, and a member who has to prove innocence for weeks is likely to leave. Freeze the account, restore the balance, re-verify the member, then investigate.
Should a program tell members about fraud?
Members whose accounts were affected should always be told what happened and what you did about it. Wider disclosure depends on the incident and on legal obligations, which your legal team should assess.