Your Loyalty Points Are Easier to Steal Than Your Card

You would notice within minutes if your credit card was used somewhere strange. Your bank would too. Now ask yourself the same question about the loyalty account attached to a retailer you last shopped with eight months ago. You probably would not notice for weeks, if at all. That gap, not the card, is where a fast-growing share of retail fraud now lives.

The trend is real and it is accelerating: 60% of merchants said account takeover fraud increased over the past year, according to a Merchant Risk Council survey of 1,100 merchants cited by Signifyd. Loyalty and rewards accounts sit at the softer end of that trend, precisely because almost nobody is watching them the way they watch a card.

Why Are Loyalty Accounts Such an Easy Target?

Because they are invisible in a way payment cards are not. Shoppers belong to an average of 16.6 loyalty programmes, but actively use fewer than half of them. That means the majority of a typical customer's loyalty accounts sit dormant, unmonitored, often forgotten, for months at a time, all while quietly accumulating points that carry real value.

A payment card has an entire industry built around watching it: fraud alerts, spending pattern analysis, instant dispute processes. A loyalty account, more often than not, has none of that. It is protected by a password the customer set years ago and has not thought about since, guarding a balance the customer has not checked either. That asymmetry is the whole opportunity.

What Does Loyalty Fraud Actually Look Like?

Someone takes over a dormant account and quietly drains the value before the real owner notices. Loyalty and rewards programmes are increasingly targeted through account takeover, redemption abuse and other tactics that exploit exactly the gap described above: real value, sitting behind weak or forgotten protection, unlikely to be checked any time soon.

The mechanics do not need to be sophisticated. Credentials leaked from an unrelated breach, reused across a dozen sites the way passwords so often are, are enough to unlock a loyalty account nobody has logged into since Christmas. From there, points get redeemed for gift cards, merchandise, or converted into something liquid, and the transaction looks, to the retailer, like a normal member cashing in rewards. There is no stolen card number to flag, no bank fraud alert to trip.

Why Don't Retailers Treat This Like Card Fraud?

Because loyalty programmes were built to drive spending, not to be defended like a payment rail. They were designed around a straightforward idea: give customers a reason to come back, and make redeeming rewards as frictionless as possible. That design goal, frictionless redemption, is precisely what a fraudster needs once they are inside a hijacked account.

The two priorities pull in opposite directions. Every bit of scrutiny added to protect an account is friction the loyalty programme was explicitly built to remove. So most retailers have quietly under-invested in loyalty security relative to payment security, not through negligence exactly, but because the entire point of the programme worked against building a fraud defence into it from the start.

Payment Fraud vs Loyalty Fraud, Side by Side

The asymmetry becomes obvious once you compare how each is actually watched:

Every row favours the fraudster in the loyalty column. It is not that loyalty fraud is technically harder to commit than card fraud. It is that almost nothing is watching for it, which makes it considerably easier to get away with.

Can One Retailer Actually Catch a Loyalty Fraudster?

Only partially, and that is the deeper problem. A retailer can spot unusual activity inside its own programme: a login from an unfamiliar location, a sudden redemption on a long-dormant account. What it cannot see is whether the same credentials, the same pattern of behaviour, are being used to take over loyalty accounts at several other retailers at the same time.

That is the same structural blind spot behind every form of first-party fraud we have covered, just wearing a different uniform. A serial account-taker working ten loyalty programmes looks, to each retailer, like one odd login on one dormant account, exactly as a serial returner looks like one unlucky claim at each retailer in The Serial Returner No Single Shop Can See. The pattern that would expose them exists only across the retailers they have hit, and no single loyalty team can see that far on its own.

What Would Actually Close the Gap?

Visibility that follows the behaviour, not just the account. A retailer that can see whether a login or redemption pattern matches known account-takeover activity elsewhere in the network does not need to slow down every genuine member to catch the rare hijacked account. It can leave loyalty programmes frictionless for the customers they were built for, and apply scrutiny only where a cross-network pattern actually points.

That is the same principle behind every outcome we build for: catch the behaviour that repeats across retailers, leave everyone else alone. We describe what that looks like in practice in Fewer False Positives, Faster Claims.

The Card Was Never the Weak Point

Retailers spent two decades hardening the moment of payment, and it worked well enough that fraud went looking for a softer target. It found one sitting quietly in sixteen forgotten apps and inboxes, worth real money, watched by almost no one.

Loyalty points feel like a reward, not an asset worth guarding, which is exactly why they have become one of the easiest things in retail to steal. The card was never the weak point. The account nobody thought to watch was.