Guide 63 · Risk and fraud
Points laundering and reseller abuse
Points laundering turns stolen or illicit money into clean value by buying points, moving them between accounts and redeeming them for rewards that can be resold. Reseller abuse is a related leak: trade buyers earn consumer rewards on stock bought for resale. Both are controlled by mapping how value enters and leaves the program, limiting transfers and high-value redemptions, and deciding reward eligibility on each transaction rather than on each customer.
Loyalty points move value, and anything that moves value can be abused. Most writing on loyalty points fraud stops at stolen accounts; this guide covers what happens next, when the value is cashed out. Points laundering uses a program to turn stolen or illicit money into clean goods or cash. Reseller abuse is quieter: trade buyers earn rewards meant for consumers on stock they will sell on. Neither looks like classic fraud on a single transaction, which is why both are easy to miss. This guide explains how each works, which program features create the risk, and the controls that close it.
What laundering is
What is points laundering?
Laundering uses the gaps between a program’s ways in and ways out. A typical chain looks like this: points are bought with a stolen payment card, transferred through several new or dormant accounts, combined into one balance, and redeemed for a gift card or electronics that can be sold for cash. By the time the card owner disputes the charge, the program has paid for the reward and has nothing to recover.
The program bears the loss twice: it refunds the stolen card payment and it has already given away the reward. The underlying issue is that points can work like stored value, but are rarely checked as carefully as money moving between bank accounts.
Laundering can also use points that were never bought. Balances stolen through account takeover, or earned through fake accounts and promotion abuse, are often moved and redeemed the same way. Insiders can be part of the chain too, for example a staff member who moves points out of dormant accounts; see employee loyalty fraud. That is why laundering controls and the defenses in our guide to loyalty fraud work best together: one stops value getting in illegitimately, the other stops it getting out.
Find the exit routes
Which program features create laundering risk?
List every way value enters and leaves your program. The risk sits where the two connect without checks.
| Feature | Why it creates risk | Lower-risk alternative |
|---|---|---|
| Buying points with a payment card | Stolen cards can buy points | Caps per card and per account, holds before purchased points can be spent |
| Transfers between members | Points can be moved away from the account that bought or earned them | Transfers only between verified accounts, with daily limits |
| Gift cards and electronics in the catalog | Easy to resell for cash | Higher verification for these items, or limits per account |
| Rewards in another person’s name | Travel or tickets can be sold to strangers | Restrict to the member and named household members |
| Instant redemption after enrollment | No time to spot a pattern | A short hold on redemptions from new accounts |
A program with none of these features, where points cannot be bought or transferred and rewards are tied to the member, leaves little room to launder: a stolen balance can only become a reward in the account holder’s own name. It still needs basic redemption limits and audit logs. A program with two or three of these features needs dedicated controls. See points purchase and points transfer for how those features are usually designed.
Laundering controls
What controls stop points laundering?
Place friction where the chain can be broken:
- Limit purchases. Cap points bought per payment card and per account, and hold purchased points for a period before they can be transferred or redeemed. If you take card payments for points, PCI DSS applies to entities that store, process or transmit cardholder data, including merchants and service providers.
- Restrict transfers. Allow transfers only from verified accounts with some history, cap daily amounts, and block transfers into accounts created in the last few days. Our guide to point transfers covers the design trade-offs.
- Check high-value redemptions. Require identity verification for redemptions of resellable rewards above a set value.
- Watch the patterns. Flag rapid movement of points into one account, transfers into long-dormant accounts, and redemptions shortly after a purchase or transfer. A rate limit on these actions slows an attacker while you review.
- Log everything. Keep an audit trail of every purchase, transfer and redemption, so one case can be traced across all the accounts involved.
Reseller arbitrage
What is reseller arbitrage?
A reseller buying stock already gets a trade price. If the same purchase also earns consumer loyalty points, the program gives a second discount from retail margin on a wholesale transaction. The reseller then redeems the points like a consumer, or sells the rewards. The problem is often not the reseller who asks, but the mixed account that buys both stock for resale and goods for its own use. This is a form of incentive leakage, and it upsets ordinary members who learn that trade buyers earned rewards at prices they could never get.
Keep trade out
How do you keep resellers from earning on trade purchases?
Decide eligibility on each transaction, not on each customer:
- Trade invoice, stock for resale: no consumer points.
- Retail invoice, goods for the buyer’s own use: points earn as normal.
Mark this on the transaction itself, so a mixed account earns correctly on each purchase. Publish the rule in the program terms, so it is visible rather than a hidden exclusion. Then check it: run a monthly query for accounts flagged as trade that earned points on trade-priced purchases. If the query returns anything, the rule is not being enforced. If you want to reward resellers, do it through a separate trade program, such as a reseller program with its own rebates, where the cost is planned and booked as a trade expense.
Size the controls
How do you size laundering controls?
Estimate what one incident costs and compare it with the cost of the controls. In a hypothetical program where a point costs one cent, a launderer buys 500,000 points for $5,000 with a stolen card and redeems them for a $5,000 gift card. The program refunds the card payment and has already paid for the gift card, so it loses about $10,000 plus support time. If basic controls (purchase caps, transfer limits and a review queue) cost $15,000 to build and $500 a month to run, they pay for themselves in the first year if they stop a few such attempts. Repeat the calculation whenever you add a new way to buy, move or redeem points, because each one is a new exit route.
Respond to a case
What should you do when you find a laundering chain?
Treat the chain as one case, not a set of unrelated accounts.
- Contain. Freeze every account that sent or received the points, and hold any redemption still pending. Stopping only the account that redeemed leaves the rest of the chain open.
- Preserve. Export the audit log for each account before anyone adjusts a balance, so the record of what happened stays intact.
- Trace. Follow the value back to where it entered: a card purchase, a takeover, a promotion. That tells you which control failed.
- Recover. Reverse points and cancel unfulfilled rewards where your terms allow it, and tell any genuine members whose balances were taken.
- Close the route. Change the feature the chain used, such as a transfer limit or a hold period, and add the pattern to your monitoring.
Record the loss and the cause of each case. A short log of cases per quarter shows which exit routes need the next round of controls.
More answers
Frequently asked questions
What is points laundering?
Using a loyalty program to turn illicit value into clean value. A typical chain buys points with a stolen card, moves them through several accounts, redeems them for gift cards or electronics, and sells those for cash.
Which loyalty programs are most exposed to laundering?
Programs where points can be bought with a payment card, transferred between members, or redeemed for rewards with a ready resale market, such as gift cards, electronics or travel in another person's name. Each of these is an exit route.
How do you detect points laundering?
Look for patterns: points bought and moved within hours, several new accounts sending points to one account, transfers into dormant accounts, and full balances redeemed for resellable items soon after a transfer.
Should resellers earn loyalty points?
Not on stock they buy for resale. A reseller already gets a trade price, and consumer rewards on top give away margin twice. Purchases a reseller makes for its own use, at retail price, can earn like any other member's.
How do you stop resellers earning on trade purchases?
Mark eligibility on each transaction, not just on the customer. Trade invoices earn nothing; retail invoices for own use earn normally. Run a regular check for accounts with a trade flag that earned points on trade terms.
What should you do when you find a laundering chain?
Freeze every account in the chain, not just the one that redeemed, hold any pending redemptions, and preserve the audit log. Then trace where the value came from and reverse what your terms allow, and fix the feature the chain used so it cannot be repeated.