Topic starter
09/07/2026 3:32 pm
TL;DR: Loyalty accounts are being hacked, traded, and exploited because points now behave like transferable digital currency, while weak passwords, low customer vigilance, and delayed detection let fraud persist for weeks, according to Comarch. The real governance issue is that loyalty programmes were built for engagement, not identity assurance, so fraud controls now have to operate without destroying the user experience.
Editorial analysis by NHI Mgmt Group, based on content published by Comarch: “How AI Strengthens Fraud Detection in Loyalty Programs”.
Key questions
Q: What breaks when loyalty programmes rely on low-friction customer journeys for security?
A: They create a control model that assumes members will notice compromise and act quickly, which is rarely true.
Q: Why do loyalty fraud losses grow when detection is delayed?
A: Because points behave like cash once they can be transferred or redeemed quickly.
Q: What are the signs that loyalty fraud controls are not working?
A: Watch for rapid sign-up spikes, repeated use of disposable phone numbers, unusual login locations, proxy traffic, failed breached-password attempts, and redemption requests that do not match normal customer behaviour.
Practitioner guidance
- Implement risk-based authentication for high-value actions Apply stronger verification only when members redeem, transfer, or change account recovery details, so everyday engagement stays usable while high-risk actions get more scrutiny.
- Monitor redemption and access anomalies together Correlate unusual point redemptions, rapid transaction spikes, and suspicious login behaviour in one case view so fraud analysts can see takeover patterns early.
- Review partner and administrator privileges Audit staff, administrator, and partner access to loyalty operations so internal misuse, excessive access, and dormant accounts do not create hidden fraud paths.
Bottom line: Loyalty fraud succeeds when reward systems are treated as engagement tools instead of high-value identity surfaces.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:54 pm
Loyalty fraud is an identity problem disguised as a rewards problem. When points can be transferred, traded, or monetised, the account becomes a high-value asset that needs stronger assurance than many loyalty programmes were built to provide. The issue is not just fraud volume. It is the mismatch between reward-system design and the authentication, monitoring, and lifecycle controls required to protect real economic value. Practitioners should treat loyalty accounts as part of the wider identity and access surface.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Should loyalty programmes use the same access controls for customers, staff, and partners?
A: No, but they should use one governance model to decide who can act on balances and under what conditions. Customers need friction balanced with usability, while staff and partners need stronger privilege oversight, separation of duties, and tighter lifecycle control. The access paths differ, but the fraud exposure is connected.
👉 Read our full editorial: AI-driven loyalty fraud exposes identity and access gaps