According to LoyaltyOne, a loyalty advisory company, in the US, there are at least 3.8 billion rewards memberships, which equates to about 10 per consumer. Companies create loyalty programs for their customers because it decreases customer attrition while also giving the company more information on each customer for data mining and partnerships. One key challenge for companies is protecting those rewards and loyalty accounts from increasing account takeover attacks.

Not just the typical rewards programs

The industries that offer loyalty or rewards programs is growing.   Retail is catching on fast. At Nordstrom, 10 million members of the loyalty program’s outspent non-members 4 to 1. The rewards program at Starbucks accounts for 40% of US purchases and membership has surged more than 25 percent in the past two years. From gas stations to cigarette manufacturing, most consumer-facing industries either have or are considering starting a loyalty program. Even gaming, hospitals, wineries, utilities, automobile companies, and pizza chains have rewards or loyalty programs.

With the proliferation of loyalty
programs being set up, there is also a significant increase in account takeover of those loyalty program accounts.  

When people think of loyalty programs, they frequently think of their hotel programs or airline rewards programs. Individual loyalty accounts associated with travel rewards programs are regularly taken over by criminals and there have also been some significant travel-related data breaches like the Marriott breach in 2018. Compromised airline accounts are frequently found on the dark web. But other loyalty rewards programs that you would not think would be a target are also repeatedly attacked.  

How are loyalty programs attacked?

The conventional method of the attack
is through a user’s own credentials that have been exposed and are for sale on
the dark web. And loyalty programs are a rich target.  They all have
some form of value that sells on the dark web.  According to the New York
Times, are a “Honey Pot for Hackers,” and TotalRetail states that
loyalty programs are a gold mine for hackers. 

There are two important factors here:

1. Most people use more secure passwords for their financial and
   banking accounts because the perceived risk is high if someone is able to
   access their account. Conversely, they tend to insecure credentials for their
   loyalty program accounts because there is less value associated with these
   accounts.  But because they use less secure passwords, their accounts are
   more vulnerable to attack.
2. Loyalty program accounts are frequently penetrated by hackers
   using compromised credentials (username and password combinations). 
   Because most people reuse passwords across most of their online accounts,
   criminals can gain
   credentials from another site and use them on the loyalty
   program site. 

What can a consumer do to protect
their loyalty accounts? 

1. Stop reusing passwords across multiple sites. Use a password manager, like LastPass, if you have too many passwords to remember.
2. Monitor your username and password for each online account you have to make sure they are not for sale on the dark web. An identity theft protection product like IDShield allows you to enter your username and password for all of your loyalty program accounts and your other online accounts.  You get an alert when your username and password are found on the dark web so that you can change your password on that account to a safer one.  

What can a company do to protect its loyalty accounts? 

1. Encourage customers to be more security conscious as part of joining the loyalty program. Educate them on loyalty fraud and the importance of frequently tracking their points.
2. Add credential screening to your loyalty program, so your customers can be notified if their loyalty account credentials have been compromised.  This informs your customers and enables them to take action before their points are fraudulently redeemed.

There is no single solution that can
entirely protect a retailer from the threat of attack. However, it is critical
that retailers take loyalty fraud seriously because it can cause them financial
loss, customer attrition, and damage to their reputation. Credential screening
is an affordable way for companies to take a proactive approach to their
program’s security. 

Learn more: https://www.enzoic.com/account-takeover-prevention/

The post Protecting Loyalty Accounts and Rewards Programs appeared first on Enzoic.

Recent Articles By Author

• The Login Was the Breach
• Summer Is Prime Time for Account Takeover
• The 2026 Verizon DBIR

More from Enzoic

*** This is a Security Bloggers Network syndicated blog from Enzoic authored by Enzoic. Read the original post at: https://www.enzoic.com/protect-loyalty-programs-rewards-accounts/