Loyalty Points and Gift Card Fraud Guide

Loyalty points and gift card balances are stored value that behaves like cash, yet they are usually protected like a marketing database. Attackers take over rewards accounts with reused passwords and drain points before the member notices, enumerate gift card and voucher numbers by bot, tamper with cards on the shelf, and use gift cards as the payment method of choice for scams and for cashing out stolen cards. This guide covers the main attack patterns, the controls that work on accounts, redemption, card issuance and the point of sale, how to detect abuse, a rollout plan, metrics and common mistakes. It goes deeper on stored value than the Account Takeover Prevention Guide. It is written for retail, hospitality, travel and loyalty programme fraud and security teams, and for gift card programme managers.

Key takeaways

Treat points as money. Any balance that can be redeemed for goods, transferred or converted is a cash-out route, and needs the same step-up and monitoring as a payment.
Protect the redemption, not just the login. Attackers who take over an account act at the point of redemption, transfer or address change; step up authentication there.
The card number and PIN are the gift card. As the US Federal Trade Commission explains, whoever holds them can drain the funds even while the victim holds the physical card, so protect them from enumeration, tampering and disclosure.
Gift cards are the scammer's payment rail. The FTC states that no real business or government agency will ever ask to be paid by gift card; checkout prompts and staff training at sale can interrupt scams in progress.
Loyalty databases hold identity data. The Caesars Entertainment breach showed a loyalty database can hold driver's licence and Social Security numbers; protect it as sensitive personal data.

Attack patterns

Pattern	OWASP automated threat	How it works	Where to stop it
Loyalty account takeover	OAT-008 Credential Stuffing, OAT-007 Credential Cracking	Reused passwords from other breaches are tried at scale against rewards logins; points are redeemed, transferred or sold	Login defence, step-up at redemption and transfer
Gift card and voucher enumeration	OAT-002 Token Cracking	Bots mass-enumerate card numbers, voucher codes or discount tokens through balance check or checkout endpoints	Balance check endpoint, checkout, card number design
Cashing out stolen cards	OAT-012 Cashing Out	Validated stolen payment cards or accounts are used to buy gift cards, which are easier to resell or launder than goods	Gift card checkout velocity and risk rules
Scam payments	Not applicable	Victims are told by impostors to buy gift cards and read out the number and PIN	Point of sale prompts, staff training, issuer freeze
Physical tampering	Not applicable	Card numbers and PINs are recorded or packaging altered before sale, then drained after activation	Packaging, shelf checks, activation controls
Fake accounts and promotion abuse	OAT-019 Account Creation	Mass sign-ups to harvest sign-up bonuses, referral rewards or first-order vouchers	Sign-up defence, reward release rules
Insider abuse	Not applicable	Staff add points, activate cards without payment, or use customer balances	Separation of duties, audit of manual adjustments

The OWASP IDs come from the OWASP Automated Threats to Web Applications project, which also defines carding (OAT-001). For bot-driven card validation see the Card Testing and Carding Attacks Defence Guide, and for mass sign-ups the Fake Account Creation and Sign-up Fraud Guide.

Why loyalty accounts are soft targets

Low engagement: many members log in rarely, so a takeover and redemption can go unnoticed for weeks.
Weak authentication: programmes often sit outside the main customer identity platform, with password-only login and email-based reset.
Easy liquidity: points can often be redeemed for gift cards, transferred to another member or partner programme, or used for travel and hotel bookings in someone else's name.
Customer service as a bypass: support agents who can change the email address or add points on request become the route around online controls.
Members do not watch balances: unlike a bank account, few members check their points regularly or receive alerts when points leave, so the victim is often the last to know.
Partner sprawl: coalition and partner programmes expose balances through APIs and partner portals with their own credentials.

Controls for loyalty programmes

Moment	Control	Notes
Login	Bot defence and credential stuffing protection; breached password checks; passkeys or MFA offered to members	See the Password Spraying and Credential Stuffing Defence Guide
Profile change	Step-up on email, phone, password and address changes; notify the old contact details; cool-off period before redemption	Stops the common sequence of take over, change email, redeem
Redemption	Step-up for high-value redemptions, gift card redemptions and first redemption after a profile change	Use one-time codes to the original contact or a passkey
Transfer	Limits on points transfers per day and to new recipients; hold periods for large transfers	Transfers are the fastest cash-out route
Earning	Rules for sign-up and referral bonuses, released only after a qualifying purchase clears	Reduces fake account farming
Support	Verify identity through the app or a one-time code before account changes; cap manual point adjustments by role	Log every adjustment to a named agent
Partners	Scoped API credentials per partner, rate limits and anomaly alerts on partner redemptions	Partner keys are non-human identities with financial reach

Controls for gift card programmes

Card design and online endpoints

Unpredictable numbers and a separate PIN: card numbers should not be sequential, and the balance should only be accessible with a PIN or security code that is not derivable from the number.
Protect the balance check: the balance check page or API is the enumeration oracle. Apply bot defence, rate limits by IP, device and card number range, and generic responses that do not distinguish an invalid number from an empty card.
Checkout velocity: limit gift card purchases per account, payment card, device and day; Stripe's Radar guidance gives per-card velocity rules as an example control against card cashing.
Delayed delivery for risky e-gift orders: hold digital gift card delivery for new accounts or high-risk orders until the payment risk is clearer, since delivery is instant cash-out.
Anti-automation: OWASP ASVS 5.0 requirement V2.4.1 calls for anti-automation controls against excessive calls to application functions, which applies directly to balance check and redemption functions.

Physical cards and point of sale

Tamper-evident packaging: the FTC advises buyers to check that protective stickers are intact and the PIN is not exposed; staff should check returned or shelf stock for the same signs.
Activation controls: activate only at the till against payment, record the activating terminal and staff member, and alert on activations without matching sales.
Scam interruption at sale: prompt staff or self-checkout screens when a customer buys high-value gift cards, especially several cards or several stores' cards, while on the phone. The FTC lists a caller staying on the line while the victim loads the card as a warning sign.
Purchase limits: caps on gift card value per transaction and per day reduce both scam losses and cash-out of stolen cards.

Response for victims

The FTC tells scam victims to contact the gift card company straight away, ask whether funds remain and whether the card can be frozen, and ask for a refund. Issuers should run a fast freeze process, keep balances on suspected scam cards frozen while they investigate, and share scam card numbers with the redeeming merchants. For consumer-facing guidance see the What to Do If You Have Been Scammed Guide and the Impersonation Scams Guide.

Gift card requests inside organisations

Gift card scams also target employees. A message that appears to come from a manager or executive asks a staff member to buy gift cards urgently for a client or team reward and send the numbers by email or chat, often with a request to keep it quiet. The pattern matches the FTC's warning signs: urgency, secrecy and instructions on which cards to buy. Organisations should state in policy that gift cards are never bought on a verbal or messaged instruction alone, require a purchase order or a call-back to a known number, and include the scenario in awareness training. See the Executive Deepfake and CEO Fraud Guide.

Issuer and retailer cooperation

Gift card fraud crosses organisational lines: a card sold by one retailer, issued by a processor and redeemed at a third merchant. Agree in contracts how quickly the issuer will freeze a card reported in a scam, how redeeming merchants are told, and what data is shared about drained cards, activation terminals and redemption locations. Shared data helps identify tampering at particular stores and mule networks redeeming at scale. See the Fraud Data Sharing and Consortium Intelligence Guide.

Where identity fits

Loyalty fraud is identity fraud with a points balance attached. Bring the loyalty programme into the main customer identity platform so the same bot defence, breached password checks, passkeys and step-up policies apply. Treat partner and coalition API keys, gift card processor credentials and point-of-sale service accounts as non-human identities: scope each one, store it in a vault, rotate it and alert on unusual redemption volumes. Protect the loyalty database itself: in the Caesars Entertainment breach, attackers who social-engineered an outsourced IT support vendor took a copy of the loyalty programme database, which held driver's licence and Social Security numbers for a significant number of members. See the Retail and E-Commerce Identity Security Guide.

Decision guidance

Friction or freedom: loyalty programmes exist to build engagement, so apply friction at the moments that move value (redemption, transfer, profile change), not at every login.
Passkeys or one-time codes: passkeys resist phishing and reduce credential stuffing; one-time codes by SMS or email are easier to roll out but weaker. Offer passkeys and use one-time codes as step-up where passkeys are not set up.
Hold or deliver instantly: instant e-gift delivery helps conversion but turns stolen cards into cash in seconds. Hold only the risky segment.
Small versus large programmes: a small retailer with a card scheme run by a processor should use the processor's rate limits, set purchase caps and train staff. A large programme needs its own risk engine across earn, burn and transfer, partner API monitoring and a dedicated fraud team.

How to implement

Map value flows: list every way points or balances can be earned, redeemed, transferred, converted or refunded, including partner and support channels.
Baseline: measure redemptions per account, redemptions after profile changes, balance checks per card range and gift card sales per payment card.
Quick wins: add step-up after profile changes, notifications to old contact details, balance check rate limits and gift card purchase caps.
Pilot risk rules: run redemption and gift card risk rules in monitor mode for several weeks, then enforce for the highest-risk segment first.
Harden support and partners: enforce identity checks before account changes, cap manual adjustments, and issue scoped credentials per partner.
Train front-line staff: teach scam interruption at the till and tampering checks on stock.
Roll back where needed: monitor member complaints and redemption drop-off; loosen rules in segments where friction outweighs fraud.

Detection and measurement

Signal or metric	What it indicates
Redemptions within 24 hours of an email or phone change	Account takeover in progress
Balance checks per IP, device or card number range	Gift card or voucher enumeration
Gift card purchases per payment card and device	Cashing out stolen cards
Points transfers to new recipients, and recipient fan-in	Mule accounts collecting points
Manual point adjustments per agent	Insider abuse or social engineering of support
Fraud loss per million points redeemed, and member complaint rate	Overall effectiveness and friction cost

Framework mapping

Control	NIST CSF 2.0	NIST SP 800-53 Rev. 5	OWASP
Login and step-up authentication	PR.AA	AC-7 Unsuccessful Logon Attempts	OAT-007, OAT-008
Anti-automation on balance check and redemption	PR.PS	SC-5 Denial-of-service Protection	OAT-002; ASVS V2.4.1
Redemption and transfer anomaly detection	DE.AE-02, DE.CM-09	SI-4 System Monitoring	OAT-012
Manual adjustment limits	PR.AA	AC-5 Separation of Duties; AC-6 Least Privilege	Not applicable
Partner API credentials	PR.AA	IA-5 Authenticator Management	Not applicable

In the United States, Regulation E section 1005.20 sets expiry, fee and disclosure rules for gift certificates, store gift cards and general-use prepaid cards, and applies certain disclosure rules to loyalty, award and promotional cards. These are consumer protection rules, not fraud controls, but they shape how long balances stay exposed and what freeze and replacement processes can charge.

Common failure patterns

Password-only rewards logins: a loyalty programme outside the main identity platform keeps password-only access long after the main site has moved on.
Open balance check: an unthrottled balance check that tells an attacker whether a number is valid turns the programme into an enumeration service.
Instant redemption after change: no cool-off between an email change and a high-value redemption is the most common takeover cash-out path.
Sequential or guessable card numbers: cards issued in sequence with no PIN, or a PIN derived from the number, make enumeration trivial.
Staff not trained on scams: tills selling large gift card bundles to distressed customers on the phone, with no prompt to pause.
Unscoped partner keys: one shared credential for all partners, with no rate limit, lets one compromised partner drain balances across the programme.

Lessons from incidents

The Caesars Entertainment breach is a reminder that loyalty data is valuable beyond its points: the attackers took the member database, not the balances, and that database held government identity numbers. Store only the identity data the programme needs, separate it from the points ledger, and protect help desk and vendor access paths to it with phishing-resistant MFA.

Practitioner checklist

Map every earn, burn, transfer, conversion and refund path, including support and partners.
Put loyalty login behind the same bot and credential stuffing defences as the main site.
Step up authentication for redemption, transfer and profile changes, with a cool-off after changes.
Rate limit and harden gift card balance checks, with generic responses.
Issue gift cards with non-sequential numbers and separate PINs.
Cap gift card purchases per transaction, payment card, account and day.
Train till staff to pause high-value gift card sales that look like scams, and check stock for tampering.
Scope, vault and monitor partner and processor credentials.
Run a fast freeze and investigation process for reported scam cards.

Loyalty Points and Gift Card Fraud Guide: Protect Rewards Accounts and Stop Gift Card Cash-Out