Loyalty Program Fraud: Stopping Points Abuse and Multi-Accounting
Loyalty program fraud drains points balances through farmed accounts and multi-accounting. Learn how to detect it at enrollment, not redemption.
Loyalty program fraud rarely announces itself. The account draining your points balance usually looks like an engaged member: it enrolls normally, earns steadily, and redeems within policy. A stolen discount code costs you once. A farmed loyalty account is a liability that grows on your balance sheet every month it goes undetected, and it looks healthy the entire time.
Balances leak two ways. Points get taken from real members' accounts, and points get earned by members who were never real people. The first is the one every fraud team already watches. The second is the one their existing controls miss.
What Is Loyalty Program Fraud?
Loyalty program fraud is any scheme that extracts value from a rewards program without the earning activity that value is supposed to represent. It covers points stolen from legitimate members and points generated by accounts that do not correspond to real, distinct people. Both end in a redemption you fund.
That earning-versus-extraction framing is what joins two problems most programs treat separately. Theft and farming look nothing alike operationally: one involves a compromised credential and an angry member, the other no victim at all, no complaint, and no anomaly in any single account. They are the same problem seen from opposite ends, with value leaving the program without the activity that was supposed to create it.
Why Rewards Fraud Is Different From Other Fraud You Already Handle
Points are a currency you issue yourself, and that changes the economics compared to every other abuse type in your portfolio.
The liability is real and it sits on your books. American Airlines carried $11.6 billion in loyalty program liability at 31 March 2026 (SEC Form 10-Q). Most programs are smaller by orders of magnitude, but the accounting is identical: every point issued is deferred revenue you owe until it is redeemed or expires, and fraudulent points are indistinguishable from legitimate ones on that line.
Detection windows are also far longer. A farmed account accrues quietly for months before anyone has reason to look at it, and members rarely notice small thefts from balances they check a few times a year. Redemption often converts into goods, gift cards, or transferable value, which makes the proceeds liquid in a way a discount rarely is.
Compare that to promo code abuse, where the same multi-accounting mechanism is at work but the asset is different. A promo exploit is a one-shot loss capped at the value of the discount. A loyalty balance compounds for as long as the account stays open, which changes both how long you have to catch it and what it costs you when you do not.
The Main Types of Loyalty and Rewards Fraud
Most rewards fraud falls into five patterns. Four are versions of problems you likely already have controls for, so this section covers them briefly and points to fuller treatments.
Loyalty account takeover. Credentials from a breach or phishing campaign are used to access existing accounts and drain their balances. This is the most-discussed category and the one most authentication spend already targets. See our guide to loyalty account takeover.
Fake enrollments at signup. Accounts created solely to collect an enrollment bonus, with no intent to become a customer. The generic version of this problem is covered under fake signups at registration.
Referral and signup-bonus exploitation. One person plays both sides of a referral, or cycles through bonus offers designed to be claimed once. This sits close to promo abuse and shares its detection logic.
Disputed or reversed redemptions. A member redeems, receives the goods, then disputes the underlying transaction, leaving you out both the reward and the recovery. This is the loyalty expression of disputed redemptions.
Insider adjustment fraud. Staff who can issue goodwill points, adjust balances, or process manual redemptions use that access on accounts they control. It is the least discussed and hardest to size, because the activity is authorised by definition. Access controls and audit logs on manual adjustments are the only real defence.
Points Farming and Multi-Accounting: The Loyalty Fraud Nobody Defends Against
The fifth pattern is the one almost nobody writes about, and it is usually the most expensive. In multi-accounting fraud, one person enrolls in your program repeatedly, building a stable of accounts they control.
Why one person opens fifty accounts
The incentives are structural, and each one follows directly from how programs are designed:
Enrollment bonuses pay out once per member, so fifty members pay fifty times.
Earning caps are set per account, so a farmer who hits the cap moves to the next one.
Tier thresholds are per member, so several mid-tier accounts can be cheaper to reach than one top-tier account while carrying comparable benefits in aggregate.
Transfers and pooling, where allowed, let balances be consolidated into one account for redemption, and the trail ends there.
Why standard controls never flag it
What makes loyalty points fraud of this kind so hard to see is that nothing in it looks wrong. Every individual account is behaviourally normal. It passes two-factor authentication, because a real person is behind it. It never triggers an account takeover rule, because nothing has been stolen.
It generates no member complaint, because there is no victim to complain. Run any per-account anomaly detection you like and each account comes back clean, because the fraud is not inside any account. It is in the relationship between them: the accounts are not distinct people.
Why the cost compounds
Loyalty programs are modelled on assumptions about how much a member earns, how many members reach each tier, and what share of issued points is eventually redeemed. Those assumptions are per member.
A member who is actually fifty members breaks the model quietly, and it surfaces as a liability that ran ahead of forecast rather than as a fraud incident anyone investigates. By the time the variance is large enough to question, the accounts have been earning for months and the points are already owed.
Where farming concentrates
Multi-accounting bites hardest where rewards are liquid and enrollment is cheap. Retail programs with generous signup offers, gaming and digital goods platforms where rewards convert to in-game value, iGaming operators with per-account bonuses, and ticketing platforms with presale access tied to membership all share one shape: the reward is worth real money, and repeating the signup costs the fraudster nothing.
Farming can also be scripted. At that point it becomes automated enrollment at scale, and volume moves from dozens of accounts to thousands. Manual farming is slower but harder to spot, because the pacing looks human.
How Loyalty Fraud Detection Works at Enrollment
Almost every control in the standard playbook defends the redemption moment. Redemption limits, step-up authentication on high-value redemptions, holds on suspicious transactions: all act at the point where points leave the program. By then the balance has existed for months and has been on your books the whole time.
Enrollment asks a different question. Not "should this redemption go through?" but "is this a new person, or a person we have already enrolled?" Answering it needs something that persists across signups by the same party, and email addresses, names, and phone numbers do not, because a farmer controls all three.
A browser fingerprint is one signal that does. It is a stable identifier derived from the configuration of a browser: rendering behaviour, fonts, screen characteristics, language settings, and network details combined into a single value. The same browser produces the same identifier on a later visit even after cookies are cleared or a private window is used, so fifty enrollments from one browser environment are visible as one environment rather than fifty strangers. Our guide to how a browser fingerprint is built covers the signals in detail.
ThumbmarkJS is one such service, running on 60,000+ websites. Its free open-source library produces a browser identifier at around 80% uniqueness, enough to size the problem before committing to anything; the hosted API raises that to roughly 99% on every tier, including the free one, by adding server-side signals. Treat the output as one input to a risk score alongside enrollment velocity, email patterns, and later earning behaviour. It identifies a browser environment rather than a person, and the decision about what to do with a match stays yours.
Building a Loyalty Fraud Prevention Program
Effective loyalty program fraud prevention works across the full lifecycle rather than at a single checkpoint. The table below sets out the four stages and what each one catches that the others structurally cannot.
Stage | Control | What it catches that the others miss |
|---|---|---|
Enrollment | Duplicate-environment checks, velocity limits per identifier | Farmed accounts, before any balance accrues |
Accrual | Earning patterns that do not match redemption behaviour; clusters of accounts sharing an identifier | Accounts that enrolled cleanly but behave as a set |
Redemption | Holds on newly accrued points, step-up on high-value or transfer redemptions | Account takeover and the cash-out step of any scheme |
Internal | Access controls and audit logs on manual point adjustments | Insider fraud, which no external signal sees |
The ordering matters more than the individual controls. Enrollment is the only stage where you can act before a liability exists, which makes it the cheapest place to intervene and the one most programs skip. Accrual monitoring is the safety net for accounts that got through. Redemption controls are the last line, and they carry most programs' entire weight today.
A sensible first step is to measure rather than enforce: record an identifier against each enrollment for a few weeks, then look at the distribution before writing a single rule.
What Browser-Based Detection Doesn't Catch
No browser signal is a complete answer, and a fraud team that has been pitched by four vendors deserves the limits stated plainly.
Someone who uses a different browser, a different physical device, or a fresh browser combined with a new IP address will produce a different identifier. Recognition is scoped to a browser environment on a device and does not follow a person across browsers or onto another machine. It identifies environments rather than people, so a shared family computer and an internet café both produce legitimate matches that are not fraud. What you get is a list of candidates for review, not a verdict.
It also does nothing about insider adjustment fraud, where the activity is authorised, or about an account takeover using valid credentials from the victim's own browser.
The honest claim is narrower than prevention: it raises the cost and effort of farming at scale. That is usually what moves the number.
Where This Leaves You
Loyalty fraud is treated industry-wide as a theft problem, which is why the standard control set watches redemption. The farming half goes largely undefended, not because it is hard to detect, but because nobody is looking at the moment when it would be visible.
Getting started takes less effort than it sounds. The engineer who owns your signup flow adds a client-side script and records an identifier against each enrollment, roughly an afternoon of work.
The first useful output is not a blocking rule but a retrospective query: how many of your existing members share a browser environment? That number is usually what gets the project funded. Enforcement comes afterwards, once you have seen your own baseline rather than an industry average.
See how other teams use browser identification, or review the pricing tiers to size the API against your enrollment volume.
Frequently Asked Questions
What is the difference between loyalty fraud and loyalty abuse?
Abuse exploits the rules as written, such as stacking offers never meant to combine. Fraud breaks them, through stolen credentials or fabricated identities. Both cost you money, and multi-accounting often sits in the grey area between: each account is real, but the person behind them is one.
How much does loyalty program fraud cost businesses?
The widely quoted figure is the Loyalty Security Association's estimate of roughly $3.1 billion in fraudulent redemptions and about $1 billion in annual losses. That number circulates without a retrievable primary report, so treat it as an industry estimate rather than a measured fact. Your own program liability, which is auditable, is the more useful number.
Can you detect duplicate loyalty accounts without asking members for more personal data?
Yes. Browser-environment signals describe the configuration of the browser making the request, not the identity of the person using it, so duplicate detection needs no additional personal details at signup. Consent and disclosure obligations still apply and vary by jurisdiction, so confirm your approach with privacy counsel.
Does two-factor authentication stop loyalty fraud?
It stops account takeover, the theft half of the problem, and is worth having for that reason. It does nothing about farmed accounts. Those members pass two-factor authentication legitimately every time, because a real person controls each enrollment's phone or inbox.