Topic starter
07/06/2026 11:28 am
TL;DR: Loyalty reward fraud is rising through fake sign-ups, account takeovers, and abusive redemptions, with Strivacity citing The Loyalty Security Association’s estimate of $3.1 billion in fraudulent points redeemed and about $1 billion in annual losses. The weak point is customer identity flow design, where sign-up, sign-in, and redemption controls still let synthetic accounts and compromised credentials move too far.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “How to spot and stop loyalty reward fraud”.
Key questions
Q: What breaks when loyalty programmes rely on sign-up checks alone?
A: Sign-up checks only protect the first gate.
Q: Why do compromised customer credentials create so much loyalty fraud risk?
A: Because customer accounts often need only a valid login to expose rewards value.
Q: What are the signs that loyalty fraud controls are not working?
A: Watch for rapid sign-up spikes, repeated use of disposable phone numbers, unusual login locations, proxy traffic, failed breached-password attempts, and redemption requests that do not match normal customer behaviour.
Practitioner guidance
- Harden loyalty sign-up assurance Add identity proofing, breached-password screening, phone risk checks, and bot detection before welcome rewards are issued.
- Apply contextual controls at login Use device history, proxy detection, geolocation checks, and behaviour analytics to challenge suspicious customer sessions without adding friction to routine logins.
- Gate high-value redemptions Require re-authentication or step-up approval when redemption value, location, or device signals diverge from normal customer behaviour.
Bottom line: Loyalty reward fraud is primarily a CIAM governance problem because attackers exploit the handoff between registration, login, and redemption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/06/2026 11:30 am
Loyalty fraud is a CIAM failure before it is a rewards problem. Loyalty programmes lose money when registration, authentication, and redemption are treated as separate controls instead of one customer trust chain. The article shows that attackers exploit whichever stage has the weakest assurance, then convert that gap into financial loss. Practitioners should read loyalty fraud as a customer identity governance issue, not just a commercial abuse problem.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: Should teams treat loyalty redemption as an authentication event?
A: Yes. High-value redemption is where identity assurance becomes financial control. If a points transaction can trigger real loss, it deserves its own trust check, whether that is re-authentication, step-up challenge, or a temporary hold for review. The control should follow the value being released, not just the user logging in.
👉 Read our full editorial: Loyalty reward fraud exposes customer identity controls at sign-up