# Loyalty point fraud: how accounts get drained and what stops it | BondProof

Source: https://bondproof.com/blog/2026-10-21-loyalty-point-fraud-retail.html

[Home](../index.md) / [Blog](index.md)


October 21, 2026 - BondProof

**Short answer:** Loyalty accounts are soft targets. They hold stored value, they are protected by reused passwords, and most customers check them rarely, which gives thieves time. Stolen points are usually converted within hours into gift cards, electronics, or travel that can be resold, so by the time the real owner opens the app, the value is gone and the trail is cold.

## Why loyalty accounts are worth attacking

A mature loyalty account can hold hundreds of pounds or dollars of value, built up over years of ordinary spending. Unlike a bank account, it rarely triggers the customer's daily attention, and unlike a card payment, a points redemption often skips the verification steps that would slow a thief down.

The accounts are also easy to test at scale. Credential stuffing tools try breached email and password pairs against loyalty logins by the thousand, and the small share that works is enough. Customers reuse passwords on loyalty accounts precisely because they think of them as low stakes, which is what makes them high value.

## How the drain usually happens

The thief logs in, changes the account email or phone number so alerts stop reaching the owner, and redeems points in a pattern designed to look ordinary. Gift cards are the favourite exit because they convert points into anonymous, resalable value in one step. Smaller redemptions spread over days attract less attention than one large one.

Some fraud is internal to the programme rather than a takeover. Fake accounts earn referral or signup bonuses at scale, and return fraud can credit points for purchases that were never really kept. Programmes that only watch the redemption side miss the earning side entirely.

## Controls that close the easy routes

Two factor authentication on loyalty accounts stops most takeovers, but uptake is low when it is optional and hidden. Programmes get better results by requiring a second step only at risky moments: login from a new device, contact detail changes, and redemptions above a threshold. That keeps everyday use smooth while guarding the exact steps a thief needs.

Redemption design matters as much as login design. Cooling off periods after a password or email change, during which gift card redemptions are blocked, remove the thief's speed advantage. So does alerting the old email address as well as the new one when contact details change.

## Helping customers without blaming them

When points are stolen, the customer experience decides whether the programme keeps them. Restoring points while an investigation runs, for accounts with a clean history, costs little because most drained value can be traced through redemption records. Treating the victim as a suspect guarantees they take their spending elsewhere.

Programmes should also tell customers plainly that points are worth protecting. Most people have never thought of a loyalty balance as money, and a short message at the moment they cross a meaningful balance threshold changes password and alert behaviour more than any policy page.

Keep reading: [Wardrobing and rental fraud: the returns problem retailers undercount](https://bondproof.com/blog/2026-10-21-wardrobing-rental-fraud-retail.md), [How do QR code phishing scams trick people in public places?](https://bondproof.com/blog/2026-10-21-qr-code-phishing-scam-bots.md), and [How does empty box return fraud work in retail?](https://bondproof.com/blog/2026-10-21-empty-box-return-fraud-retail.md) cover the nearby cases in this series.

## Frequently asked questions

### Why do thieves convert points to gift cards first?

Gift cards turn programme specific points into flexible, anonymous value that can be spent or resold anywhere. They are the fastest way to move stolen points out of an account before the owner or the programme notices the drain.

### Are loyalty points insured like bank deposits?

No. Whether stolen points are restored depends on the programme's own policy and goodwill. Many programmes do restore them when fraud is reported promptly, which is one reason checking balances and keeping alerts on matters.

### What is the single best protection for a loyalty account?

A unique password plus a second verification step at login or redemption. Credential stuffing only works when the same password protects many accounts, and step up checks block the redemption even if a login succeeds.

### How can a programme spot fake earning accounts?

Look for clusters: many accounts created from the same devices or addresses, earning referral bonuses in chains, with no normal purchase pattern. Bonus abuse usually shows up as earning behaviour that no genuine customer group would produce.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)