According to LoyaltyOne, a loyalty advisory company, in the US, there are at least 3.8 billion rewards memberships, which equates to about 10 per consumer. Companies create loyalty programs for their customers because it decreases customer attrition while also giving the company more information on each customer for data mining and partnerships. One key challenge for companies is protecting those rewards and loyalty accounts from increasing account takeover attacks.

Not just the typical rewards programs

The industries that offer loyalty or rewards programs is growing.   Retail is catching on fast. At Nordstrom, 10 million members of the loyalty program’s outspent non-members 4 to 1. The rewards program at Starbucks accounts for 40% of US purchases and membership has surged more than 25 percent in the past two years. From gas stations to cigarette manufacturing, most consumer-facing industries either have or are considering starting a loyalty program. Even gaming, hospitals, wineries, utilities, automobile companies, and pizza chains have rewards or loyalty programs.

With the proliferation of loyalty programs being set up, there is also a significant increase in account takeover of those loyalty program accounts.  

When people think of loyalty programs, they frequently think of their hotel programs or airline rewards programs. Individual loyalty accounts associated with travel rewards programs are regularly taken over by criminals and there have also been some significant travel-related data breaches like the Marriott breach in 2018. Compromised airline accounts are frequently found on the dark web. But other loyalty rewards programs that you would not think would be a target are also repeatedly attacked.  

How are loyalty programs attacked?

The conventional method of the attack is through a user’s own credentials that have been exposed and are for sale on the dark web. And loyalty programs are a rich target.  They all have some form of value that sells on the dark web.  According to the New York Times, are a “Honey Pot for Hackers,” and TotalRetail states that loyalty programs are a gold mine for hackers. 

There are two important factors here:

1. Most people use more secure passwords for their financial and banking accounts because the perceived risk is high if someone is able to access their account. Conversely, they tend to insecure credentials for their loyalty program accounts because there is less value associated with these accounts.  But because they use less secure passwords, their accounts are more vulnerable to attack.
2. Loyalty program accounts are frequently penetrated by hackers using compromised credentials (username and password combinations).  Because most people reuse passwords across most of their online accounts, criminals can gain credentials from another site and use them on the loyalty program site. 

What can a consumer do to protect their loyalty accounts? 

1. Stop reusing passwords across multiple sites. Use a password manager, like LastPass, if you have too many passwords to remember.
2. Monitor your username and password for each online account you have to make sure they are not for sale on the dark web. An identity theft protection product like IDShield allows you to enter your username and password for all of your loyalty program accounts and your other online accounts.  You get an alert when your username and password are found on the dark web so that you can change your password on that account to a safer one.  

What can a company do to protect its loyalty accounts? 

1. Encourage customers to be more security conscious as part of joining the loyalty program. Educate them on loyalty fraud and the importance of frequently tracking their points.
2. Add credential screening to your loyalty program, so your customers can be notified if their loyalty account credentials have been compromised.  This informs your customers and enables them to take action before their points are fraudulently redeemed.

There is no single solution that can entirely protect a retailer from the threat of attack. However, it is critical that retailers take loyalty fraud seriously because it can cause them financial loss, customer attrition, and damage to their reputation. Credential screening is an affordable way for companies to take a proactive approach to their program’s security. 

Learn more: https://www.enzoic.com/account-takeover-prevention/