Loyalty programs have become a pillar of the airline industry, as both a marketing tool and a revenue generator in their own right. When managed well, they’re a net benefit in both of those roles; helping fill seats and providing a revenue center that’s insulated from factors that can affect operational profit.
While loyalty program revenues aren’t susceptible to threats like fuel costs or regulatory issues, they are highly vulnerable to fraud. Because most airlines’ loyalty plans aren’t protected against theft and fraud as aggressively as their financial operations are, they represent a substantial pool of value for criminals.
Here, we explore why airlines are uniquely vulnerable to loyalty fraud, how loyalty fraud most commonly occurs, and what carriers can do to protect themselves—and their customers.
Why Airlines Are Uniquely Vulnerable to Loyalty Fraud
Every industry that uses loyalty programs can be targeted for fraud, but airlines are more exposed than most. There are a number of reasons for that, but a few of the most important include:
- The intrinsic value and desirability of travel miles, which translates to high resale value for criminals.
- Unlike rewards from many other industries, travel miles are not geographically restricted, which means the market for resale is effectively global.
- Air carriers have integrations with multiple third parties throughout the travel and financial industries, each of which represents a potential attack vector that lies outside of the carrier’s direct control.
- For major airlines, the sheer size of the loyalty program’s account base dwarfs loyalty programs in most other industries.
Criminals target loyalty programs in general because they represent low-hanging fruit—they tend to be defended less assiduously than payment operations as an artifact of their origins in marketing. Plus, consumers are quick to notice anything untoward affecting their bank or credit card accounts, but may go months without checking their loyalty points, so complaints are relatively slow.
While those factors can impact any loyalty program, airlines are especially vulnerable due to their reliance on loyalty programs to generate stable, high-margin revenues. In fact, some analysts describe the airlines themselves as loss leaders for their loyalty programs — making them uniquely exposed to the loss of revenues caused by fraud.
With that in mind, let’s review a few specific forms of fraud that airlines can expect to encounter frequently, and how to defend against them.
Bot Farming
Modern crime rings operate as very sophisticated, high-tech businesses. That includes a “fraud as a service” model in which the tools to carry out large-scale attacks are simply available as an off-the-shelf product. These automated tools are used by criminals to empower bot farming attacks, allowing for high-volume assaults on poorly defended loyalty programs. With them, they can create fraudulent accounts at scale, capture promotional codes and distribute them widely, create rings of accounts that refer each other to the program for bonuses, and much more.
Defending Against Bot Attacks
A handful of representative defensive measures against bot attacks include:
- Device and browser fingerprinting to help identify devices that initiate unrealistically high volumes of contacts with your loyalty program.
- Rate limiting, which doesn’t allow single devices to carry out rapid-fire transactions or interactions with the loyalty app or site.
- Account behavior monitoring, which detects activities associated with bots and fraudulent activity (such as changes to a user profile, unusually large redemptions or transfers of points, redemptions that occur with inhuman speed after a login) and flags them for scrutiny.
Account Takeovers
Criminals don’t rely solely on falsified accounts. They also carry out takeovers of existing accounts, locking out the legitimate account-holder and looting the account of its accumulated value. Account takeovers (ATOs) can result from SIM swapping or porting-out scams, bulk or targeted phishing attacks, or credential stuffing, in which automated tools try multiple sets of stolen login credentials until they find one that works for a given account.
The use of automated tools in some account takeovers makes them a subset of bot attacks, but here we’ve broken it out separately because there are numerous other ways to take over an account that do not rely on bots. Common signs of an ATO include changes in the account-holder’s contact information and sudden, uncharacteristic redemptions or transfers.
Defending Against Account Takeovers
Aside from the measures described in the section on bot attacks, account takeovers can be mitigated by measures including:
- Multifactor authentication (MFA). This ideally would not take the form (or only the form) of a text or email to the user’s phone, since takeovers often mean those verification messages would go to the criminal, rather than the legitimate owner. Biometrics (device-based fingerprint or facial recognition) are much stronger and add minimal friction to the user experience.
- Prompting users to observe good password hygiene, ideally by searching a database of known-compromised passwords and informing the user if their password shows up on the list.
It’s worth noting that a rule implemented by the FCC in 2023 requires phone carriers to protect against SIM swaps and porting-out fraud, largely to thwart ATOs, but this initiative has had only middling success.
API Abuse
The travel industry’s many third-party integrations take place through APIs, which give those parties — or the carrier’s own consumer-facing app — access to selected portions of an airline’s software stack. Criminals are adept at identifying structural vulnerabilities and misconfigurations of API systems and exploiting them to their own benefit.
Once they gain access to a carrier’s loyalty program through API abuse, they’re free to drain legitimate accounts at scale, remove limits on redemptions, eliminate records of redemptions (so they can be repeated indefinitely), and much more.
Defending Against API Abuse
Because APIs are so central to daily operations, and because mitigations against API abuse are relatively technical in nature, implementing fixes is non-trivial and requires careful planning. A few representative measures include:
- Input validation to detect malicious code.
- Regular penetration testing and security audits, the first to identify weaknesses and architectural errors in your APIs and software stack, and the second to identify when, whether, and how your system has been exploited.
- Implementing OAuth 2.0, if you haven’t yet, to securely manage third parties’ access to your system.
Fraudulent Redemptions
If the previous attacks represent the “acquisition” stage of fraud, redemptions are one of the avenues criminals use to turn travel points’ latent value into real value. While the points can be (and are) sold on the internet’s black markets on an as-is basis, they’re deeply discounted. By redeeming points for travel, lodgings, or tangible goods, criminals capture more of the points’ nominal value. They may potentially even benefit twice, first by using the points, and then by challenging the transaction as fraudulent and receiving the points back.
Defending Against Fraudulent Redemptions
Here again, the use of MFA and account behavior monitoring can help mitigate the likelihood of fraudulent redemptions. Other effective techniques include:
- Limiting redemptions in the form of gift cards (the most fungible of rewards), either by dollar amount or by the number of redemptions possible within a given timeframe.
- Identifying accounts with little to no activity, other than receiving points transfers from established accounts. These are very often “mule” accounts, which launder the stolen points and make it more difficult to trace them back to the criminal.
Enhanced Data Is a Crucial Tool in Fighting Loyalty Fraud
While it may seem that the deck is stacked in favor of criminals, there is one commonality between the accounts they use: Every account holder (or user, in the case of corporate or organizational loyalty accounts) is, at least nominally, a person.
With a suitably robust data enrichment tool, airlines can improve the likelihood of detecting fabricated accounts and identifying anomalies that could point to an ATO.
Such a tool, like Spokeo for Business, would be able to:
- Integrate with an airline’s software stack across multiple departments (marketing, loyalty, booking, refunds, and disputes) to assist in highlighting problematic accounts that might elude a narrower scrutiny.
- Provide additional contextual data signals when accounts are flagged by the carrier’s existing fraud-prevention tools, helping reduce false positives and the corresponding friction for users.
- Identify inconsistencies in the data associated with an account, which increases the likelihood that the account holder may be fabricated.
- Uncover connections between the initiator of a points transfer and its recipient, helping establish its legitimacy. (Note that an absence of such connections is not in itself evidence of fraud, but an indication that further scrutiny is required.)
In short, Spokeo’s expanded contextual data, drawn from public, open-source, and commercially available data sources, provides access to more data signals than the airlines currently have access to through their in-house records. Access to this improved level of data can result in faster and better decisions from investigations teams, reduced fraud, and minimal additional friction for legitimate users and account holders.
Accessing Better Data
Any anti-fraud tool or initiative is limited by the quality of the data available to it. Spokeo for Business is designed to fill this niche, complementing in-house data and legacy third-party data providers. Spokeo’s unusual breadth of data sources, most notably open-source and social media intelligence, can fill in the gaps in those traditional data sources, providing additional contextual data signals when your investigations teams need them most to prevent loyalty fraud attacks.
Reach out to our team today to learn more about how Spokeo can empower your fraud-prevention team to support your fraud investigation teams as they review suspicious loyalty activity.
Spokeo for Business provides access to public-record and commercially sourced data that may support fraud investigation and account review workflows. It is not a consumer reporting agency as defined by the Fair Credit Reporting Act (FCRA) and does not provide consumer reports. Customers are responsible for ensuring their use of the data complies with all applicable laws and regulations.
Sources
Visual Approach Analytics: Airlines as Loss-Leaders
Forbes: Fraud-As-A-Service: The Productization Of Online Scams
US Federal Trade Commission: SIM Swap Scams: How to Protect Yourself
US Federal Communications Commission: Port-Out Fraud Targets Your Private Accounts
US National Security Agency: Cybersecurity: What is Credential Stuffing
US Federal Register: Protecting Consumers From SIM-Swap and Port-Out Fraud
Auth0: What is OAuth 2.0?