Our modern identity services are exposed through developer-friendly APIs, SDKs and Low-Code services to deliver the scale and performance required for any and all customer use cases.
Featured Blog Post:
It’s notoriously difficult to implement an account recovery process that prevents fraud without creating more friction for customers who are already locked out and frustrated. In a US consumer...
It’s 2023. Do you know where your loyalty membership points are? If you’re one of the 45% of consumers with an inactive loyalty program, the answer is likely no — and it’s opening the door to the growing threat of hospitality fraud.
Although fraud is often considered a banking problem, the reward and loyalty membership points offered by hospitality and travel businesses provide equally lucrative opportunities for fraudsters. But unlike banking and other financial accounts, loyalty programs are often not closely monitored and protected, with inactive and insecure reward accounts providing an easy and increasingly popular target for cybercriminals.
So how can hospitality companies prevent this growing threat? This blog will provide background on what’s driving hospitality fraud, the tactics fraudsters use to steal reward points and what businesses can do to protect their customers.
The rewards points and loyalty program perks associated with hospitality and travel accounts can be redeemed for free hotel stays, discounted flights, upgrades or other valuable services. Additionally, fraudsters can use stolen credit card information linked to these accounts to make fraudulent purchases, often for expensive travel bookings or luxury accommodations.
But although the value of these ill-gotten gains can be substantial, customers may be less likely to tolerate security measures that add friction when accessing hospitality and travel accounts than banking accounts. This in turn causes businesses to prioritize user experience and view security as a compromise.
In addition, studies of loyalty programs show that 72% of consumers use 50% or less of their traditional memberships, and 31% of consumers use only 25%. Because consumers return infrequently to their sites, they may not notice and report instances of fraud promptly — or ever. For airlines, hotels and other businesses in the hospitality industry, this means fewer confirmed fraud cases, lowering the bar for fraudsters to wage successful attacks and enabling multiple attempts or even large-scale campaigns to go unnoticed.
This was especially the case during the pandemic, when hospitality and airline fraud grew exponentially due to a higher rate of inactive accounts and businesses lifting expiration dates for using reward points.
As early as 2017, 60% of airlines reported instances of loyalty program fraud, and the trend has only grown since then. The success of these schemes has caused hospitality fraud to persist even after pandemic-related travel restrictions have lifted, with organized fraud rings and online marketplaces providing easy opportunities for fraudsters to buy and sell reward points online. Recent statistics on airline fraud show it accounts for 46% of fraudulent transactions.
Our Security Research Team found numerous examples of loyalty points fraud on the Internet where miles and points can be sold, as shown below.
And obtaining these loyalty points may be easier for hackers than you might think. In 2023, hacker Sam Curry discovered massive security flaws in Points.com, a platform that handles points transactions for many major airlines. Among other risks, these vulnerabilities allowed access to 22 million orders containing frequent flyer numbers, credit cards and other customer data, the ability to add, remove or transfer points and permissions to modify customer accounts.
Armed with a wealth of customer data and access to customer accounts, fraudsters can exploit a range of tactics that allow them to not only launch attacks, but scale them to large numbers. At this scale, fraudsters can profit even when selling the points at a substantial discount of their monetary value, making them even more attractive to the criminals who purchase them.
Since airlines and hospitality businesses provide not only a lucrative target for fraud but less opportunity to be detected, fraudsters can employ a range of tactics to steal customers’ reward points and payment credentials.
Some of the tactics used for hospitality fraud include:
To solve the problem of reward program fraud, hospitality and travel companies need to invest in solutions that leverage fraud detection to deliver better user experiences, rather than viewing UX and security as a necessary tradeoff.
Some of the services that can be used to optimize both UX and security include:
Transmit Security provides a natively integrated platform purpose built for customer identity security, enabling businesses to not only protect their reward programs and member points from fraud, but simplify fraud analysis, consolidate vendors and strengthen the implementation of passkeys and other security measures. To find out more about how Transmit Security can help hospitality and travel companies from the growing threat of rewards program fraud, contact a sales representative or read our case study about the fraud detection with Transmit Security.
