Loyalty and Rewards Redemption Fraud
Theft and laundering of points, miles and cashback balances via account takeover, farmed balances, insider adjustments and redemption or transfer paths that turn rewards into cash-like value.
What it is
Loyalty balances are stored value with weaker protection than cash. Customers watch them less closely, programs often authenticate redemption less strictly than payment, and redemption options (gift cards, partner transfers, shipped merchandise, cash-out) convert points into cash-like value fast. EY's 2025 report cites a Forter estimate that point-holding accounts are 4–5 times more likely to be attacked, and notes typical detection times of 150–180 days because owners rarely check balances.
The balances at stake are large. EY cites an estimated $200 billion+ in unredeemed points globally (2025) with 30–50% never redeemed. Individual program liabilities run to billions (The Paypers cites a $13.7B Membership Rewards liability at end-2023). Published loss estimates vary widely and are often old. EY cites estimates from about $1 billion a year in fraudulent U.S. redemptions (Forter) to $3.1 billion (Loyalty Security Association, 2020). Treat them as order-of-magnitude.
This note focuses on the redemption and cash-out end. Fraudulent earning is covered under Receipt Fraud (Cashback), Card-Linked Offer Abuse, Referral Abuse and Sign-Up Bonus Abuse.
How it works
Sources of illegitimate balance (conceptual):
- ATO. EY lists credential stuffing, password spraying, phishing and SIM swapping. Programs where accounts are long-lived and logins rare are especially exposed (Credential Stuffing, Phishing and Credential Harvesting).
- Farmed balances. Accounts built up through promo, referral or receipt abuse, then consolidated or sold (Account Farming and Resale).
- Insider adjustments. Staff applying manual credits, approving improper redemptions, or creating accounts for outsiders (EY) (Insider Fraud).
- Retro-claim and missing-points abuse. Claiming credit for activity that wasn't the claimant's. The Paypers describes employees crediting their own loyalty cards on customers' purchases.
- Logic and API flaws. Earning on abandoned carts, double redemptions, parameter tampering (EY). See Business Logic Exploitation.
Monetization paths (EY): direct redemption for goods, travel and gift cards; resale of points or account access, often at 10–20% of face value; laundering through gift cards and vouchers; and insider kickbacks.
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Access | Login from new device or network after long dormancy; stuffing-wave context | Step up before showing balance or redemption options? |
| Account changes | Email, phone, address or payout destination changed; new partner account linked | Contact Change Cooling-Off Periods before redemption |
| Redemption | High-value or all-balance redemption; gift card or cash-like choices; ship-to differs from history | Approve, hold, or require step-up |
| Transfer | Points transferred to another member or partner program | Transfer limits, recipient risk (Payee and Counterparty Risk) |
| Fulfillment | Gift card codes delivered digitally; goods shipped to new address | Delay digital delivery for risky redemptions |
| Post-event | Owner complaint, often months later | Restore balance; trace recipient accounts and destinations |
The most effective single control is a redemption-time risk decision that treats redemption the way you'd treat a withdrawal. A balance being fully drained right after a contact change on a dormant account is the classic ATO pattern in every industry. It looks the same in brokerage cash-out (Payout Redirection) as in airline miles redemption.
Common variants
| Variant | Industry | What's different |
|---|---|---|
| Miles and points ATO | Airlines, hotels | High-value redemptions (award travel booked for third parties); long dormancy |
| Retail loyalty ATO | Grocery, drugstore, retail | Points redeemed at POS or for gift cards; lower values, higher volume |
| Cashback balance ATO | Cashback, Coupons and Rewards | Payout destination change followed by cash-out (see Payout Redirection) |
| Card-issuer rewards ATO | Banks | Points redeemed as statement credits, gift cards or partner transfers |
| Fintech "rewards" balances | Neobanks and Consumer Fintech, Brokerage and Investing | Crypto, stock or cash rewards with withdrawal paths |
| Balance resale and pooling | All | Balances consolidated from many accounts into one, or accounts sold whole |
| Insider credit and redemption | All | Manual adjustments with no matching earning event |
Where it shows up
- Cashback, Coupons and Rewards: balances are literally cash. Payout destination changes are the critical event.
- Retail and Ecommerce: loyalty points at POS and online; returns that refund to points or store credit.
- Payments and P2P and Neobanks and Consumer Fintech: rewards balances that convert to spendable cash.
- Brokerage and Investing: stock or crypto rewards accounts that, once taken over, can be liquidated and withdrawn.
Impact
- Direct loss when stolen balances are restored to the real owner. Most programs restore, so the program eats it.
- Delayed detection. Months-long gaps between theft and complaint, which complicates recovery and labeling (Fraud Labeling and Feedback Loops).
- Brand trust. Members who lose balances often leave the program.
- Support load. Restoration, investigation and recovery workflows; support channels become a social-engineering target themselves.
- Prevalence signal. The only "hard" consumer figure The Paypers found: 3% of Australian loyalty members reported a loyalty ATO (2019 research).
Red flags
- Login after long dormancy from new device, network or geography → Login Anomalies
- Contact, address or payout changes followed by redemption → Account Change Events
- Whole-balance redemptions; preference for gift cards and digital delivery → Promo and Reward Redemption Patterns, Fast In Fast Out Patterns
- Ship-to addresses shared across many redeeming accounts; reshippers → Address Risk Signals
- One device or network accessing many point-holding accounts; redemption bursts across accounts → Device Reputation and Linkage, Velocity Signals
- Transfers to recipients linked to other suspicious accounts → Payee and Counterparty Risk
- Support contacts requesting contact changes or "missing points" credits → Customer Contact Signals
- Manual adjustments without matching activity → Insider Access Controls logs
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Multi-Factor Authentication (MFA), Passkeys and Phishing-Resistant Authentication | Hardens access to point-holding accounts |
| Prevent | Rate Limiting and Throttling, Bot Management and CAPTCHA | Blunts stuffing waves against loyalty logins |
| Prevent | Contact Change Cooling-Off Periods | Delays redemption after sensitive changes |
| Detect | Risk-Based Authentication and Step-Up | Step-up at redemption and transfer as well as login |
| Detect | Transaction Monitoring | Balance-drain and redemption-pattern monitoring |
| Respond | Withdrawal and Payout Controls | Holds on cash-like redemptions and new destinations |
| Respond | Reward Vesting and Clawback | Pending periods on newly earned points; reversal of points credited without a valid earning event |
| Respond | Insider Access Controls, Customer Support Verification Protocols | Dual control on adjustments; verified support-assisted changes |
Emerging variants and adversary adaptation
- Stuffing aimed at dormant value. Because loyalty logins are rare and balances rarely checked, stuffing campaigns increasingly target loyalty endpoints. Redemption step-up compensates for weak login hygiene.
- API and mobile surface. EY highlights API abuse (weak auth, replay, insecure object references) and mobile app reverse engineering as growing vectors. Redemption APIs that were built for trusted partners often have no defenses against adversarial traffic.
- Support-channel social engineering with AI. EY flags AI-generated voice impersonation aimed at support staff. Redemption and contact-change requests through support need the same verification as self-service (Generative AI and Deepfake Fraud).
- Pooling and resale industrialization. Balances are traded as a commodity at deep discounts. Watch for many small accounts feeding one redemption point (Fraud-as-a-Service Ecosystem).
- Adaptation to step-up. When redemption step-up goes live, adversaries shift to support-assisted paths and partner transfers that skip it. Apply the same risk decision across every path that moves value out.
Related mechanisms
- Account Takeover (ATO) and Credential Stuffing: the main access path
- Payout Redirection: the cashback-balance version
- Gift Card Fraud: the laundering endpoint
- Account Farming and Resale: balances as inventory
- Insider Fraud: manual adjustments
- Business Logic Exploitation: double redemptions and earning flaws
- Money Mules: accounts that receive transferred points or resold balances
Real-world examples
- An airline-program case where a member's points were used to buy goods delivered elsewhere, cited in industry commentary as typical ATO monetization (The Paypers, 2024).
- EY's 2025 loyalty fraud report summarizes monetization paths and cites resale of points at 10–20% of face value.
Sources and further reading
- Loyalty system fraud report (EY, Jul 2025): fraud types, unredeemed-points value, loss estimates, attack likelihood, detection time, monetization, controls
- Loyalty fraud in the airline industry (The Paypers, Mar 2024): ATO, traditional loyalty fraud, program liabilities, 3% ATO victimization figure
- Fighting loyalty fraud is essential (Mastercard, 2024): loyalty fraud typology incl. ATO, fake accounts, pooling and resale