How do criminals drain loyalty points from retail accounts?

Points are money with weaker guards

A loyalty balance can buy real goods, yet many programs guard it with only a password, no step up check for redemption, and no alert when the balance changes. Criminals price that gap precisely: an account with a large balance and a weak login is a gift card waiting to be printed.

Balances also grow quietly. Customers who earn for years without redeeming hold the largest targets, and they are the least likely to notice a drain quickly because they rarely check the account between purchases.

The drain follows a repeatable script

Access comes first, usually from credential stuffing with breached passwords. Then the attacker changes nothing obvious, checks the balance, and converts points in the way that is fastest to resell: digital gift cards, popular electronics, or goods with strong resale demand in the right sizes and colors.

Speed matters because the window closes when the customer notices. Drains happen in a handful of transactions in one session, often at odd hours for the account owner, shipping to addresses the account has never used or delivering codes straight to an inbox the attacker controls.

Why brands end up paying twice

When a loyal customer reports a drain, the brand faces a bad choice. Restore the points and absorb the loss, or refuse and tell a long standing customer that their account security is their problem. Most brands restore, which means the program pays for the stolen goods and the replacement points.

There is a second cost in trust. Loyalty programs ask customers to concentrate their spending and data with one brand. A drain that is handled coldly undoes years of that bargain in one support call, and the story travels further than the points were worth.

Signals a drain is not the customer

Redemption from a new device and network, a delivery address or email change shortly before redemption, conversion of the full balance in one session, and gift card denominations chosen like a payout rather than a purchase all differ from normal member behavior, which is gradual and tied to shopping the customer actually does.

Customer service teams need those signals in the claim screen, not buried in security logs. The agent deciding whether to restore points should see device, address, and session history beside the claim, because that context separates fraud from a forgetful customer in seconds.

Protecting points without punishing members

Require step up verification for the actions that matter: changing contact details, adding an address, and redeeming above a threshold. Alert members immediately on redemption, in a channel they actually read, while the goods can still be stopped.

Cap how much of a balance can convert to gift cards in a day, and hold large first time redemptions for a short review. Honest members barely notice sensible friction at the payout edge. Attackers, whose whole model is speed, notice it immediately.

Keep reading: How do bots harvest and resell limited discount codes at scale?, How does automated refund fraud turn store policies into a payout pipeline?, and How do fake coupon browser extensions steal affiliate commissions and shopper data? cover the nearby cases in this series.

Frequently asked questions