According to LoyaltyOne, a loyalty advisory company, in the US, there are at least 3.8 billion rewards memberships, which equates to about 10 per consumer. Companies create loyalty programs for their customers because it decreases customer attrition while also giving the company more information on each customer for data mining and partnerships. One key challenge for companies is protecting those rewards and loyalty accounts from increasing account takeover attacks.
The industries that offer loyalty or rewards programs is growing. Retail is catching on fast. At Nordstrom, 10 million members of the loyalty program’s outspent non-members 4 to 1. The rewards program at Starbucks accounts for 40% of US purchases and membership has surged more than 25 percent in the past two years. From gas stations to cigarette manufacturing, most consumer-facing industries either have or are considering starting a loyalty program. Even gaming, hospitals, wineries, utilities, automobile companies, and pizza chains have rewards or loyalty programs.
With the proliferation of loyalty programs being set up, there is also a significant increase in account takeover of those loyalty program accounts.
When people think of loyalty programs, they frequently think of their hotel programs or airline rewards programs. Individual loyalty accounts associated with travel rewards programs are regularly taken over by criminals and there have also been some significant travel-related data breaches like the Marriott breach in 2018. Compromised airline accounts are frequently found on the dark web. But other loyalty rewards programs that you would not think would be a target are also repeatedly attacked.
The conventional method of the attack is through a user’s own credentials that have been exposed and are for sale on the dark web. And loyalty programs are a rich target. They all have some form of value that sells on the dark web. According to the New York Times, are a “Honey Pot for Hackers,” and TotalRetail states that loyalty programs are a gold mine for hackers.
There is no single solution that can entirely protect a retailer from the threat of attack. However, it is critical that retailers take loyalty fraud seriously because it can cause them financial loss, customer attrition, and damage to their reputation. Credential screening is an affordable way for companies to take a proactive approach to their program’s security.