Loyalty fraud is underreported because disclosing it is embarrassing

The argument

Loyalty fraud is underreported because disclosure is optional and costly. In payment cards, chargeback rules force issuers and merchants to report fraud as part of normal settlement. Loyalty programmes have no equivalent clearing obligation. When a programme finds that points were stolen, it can reverse the redemption, reissue the balance, and close the case without telling any external party. The fraud never enters a public record. This is not a technical failure; it is a rational choice by an operator that controls both the ledger and the narrative.

The embarrassment mechanism is stronger than the financial incentive. A disclosed loyalty fraud incident admits that the programme's login security was weak, that its fraud monitoring missed the pattern, or that an insider abused access. In payment fraud, the bank can blame the criminal and keep the customer's trust. In loyalty, the member's only asset is the points balance, and the programme is the sole custodian. Admitting theft says the custodian failed. Brands therefore treat a small fraud write-off as cheaper than the reputational cost of a breach notice. This is why airlines and hotels with large fraud teams rarely publish fraud cases: the teams exist to contain losses, not to disclose them.

Even without a regulator, embarrassment acts through partners. A coalition programme that discloses account takeover must tell its retail partners that shared member data was exposed. Those partners may demand security audits, compensation, or reduced liability. The same fraud in a single-operator programme can be absorbed quietly. The result is that fraud persists across sectors, but public reporting is almost nonexistent. The silence is a feature of the loyalty model, not an accident of missing data.

The strongest counter-argument

The strongest counter-argument is that loyalty fraud is not hidden because it is embarrassing, but because it is rarely detected in the first place. Many programmes assign low priority to points fraud because points are not legal tender, balances are often small per member, and write-offs may not be material to the profit and loss statement. Without specialised monitoring, account takeovers and insider abuse go unnoticed until a customer complains. What looks like underreporting may simply be underdetection. If programmes do not know their own fraud losses, they cannot be said to be suppressing disclosure out of embarrassment. This explanation is plausible because it requires no concealment motive.

What would change our mind

If a major programme were required by a regulator to publish quarterly fraud losses and did so without any measurable increase in member complaints or partner withdrawal, then the embarrassment mechanism would be disproved. The key test is whether disclosure itself causes harm. A single public report showing that a programme disclosed a material account takeover loss and retained its active member base would force us to revise the claim. Alternatively, if a programme published fraud losses voluntarily for multiple consecutive years and saw no brand penalty, that would show the silence is due to lack of obligation, not fear of embarrassment.

What follows if we are right

If the claim is right, a programme operator should treat fraud disclosure as a strategic choice, not a mere compliance question. The practical consequence is that current fraud reporting is self-serving and will remain silent unless an outside force changes the cost of silence. Running a programme therefore requires independent fraud benchmarks. Operators should demand that vendors publish fraud detection rates and breach histories as a condition of contract. They should also create an internal rule that any account takeover affecting a small number of members is reported to members, regardless of embarrassment. The alternative is to accept that loyalty fraud will continue to be underreported, and that members will remain the last to know.