Loyalty Points Fraud Is Escalating. Here Is What Travel Merchants Need to Know.
Travel merchants have long treated loyalty programs as a value-add for customers, a way to build repeat business and deepen brand affinity. But as loyalty points and miles become increasingly liquid, convertible into gift cards, upgrades, and experiences, they have also become a preferred target for fraudsters. A spate of recent incidents involving major airline programs is drawing fresh regulatory attention to a corner of the travel industry that many merchants have not fully secured.
When Miles Become Cash
The story of Linda Roth, a frequent traveler who discovered that nearly 200,000 American Airlines AAdvantage miles had been drained from her account over a single weekend, illustrates how quickly loyalty fraud can unfold. The stolen miles were converted to gift cards by the hacker. Roth described the experience as a violation, noting that she was unable to report the breach until Monday when American’s fraud department reopened. She spent days unable to reach anyone who could help, a delay that allowed the damage to compound.
Clint Henderson, a representative from The Points Guy, experienced a similar scenario two years ago when scammers emptied his American Airlines account and used the miles to book rental cars in New York City. His case involved 449,500 stolen miles, a quantity that American Airlines itself valued at $13,260. “These things do have value,” Henderson said. “And the thieves know it.”
The pattern in both cases points to a common exploit: fraud departments that operate on standard business hours, leaving accounts unattended over weekends when thieves can move quickly.
The Regulatory Response
The problem extends well beyond a single airline. The Federal Reserve, the Federal Communications Commission, and the United States Treasury Department announced in early May a coordinated public-private roundtable aimed at combating payment fraud across the financial system. The effort explicitly identifies travel and ticketing among the merchant categories most vulnerable to high-volume remote transaction fraud.
The roundtable will gather input from banks, regulators, law enforcement, and consumer advocates on topics including fraud prevention program effectiveness, cross-institutional data sharing, and coordinated solutions that span both private industry and government. A key diagnostic finding from the agencies noted that one fundamental obstacle to better fraud prevention is the lack of a shared vocabulary across institutions for classifying and reporting scam activity.
Why Travel Merchants Are in the Crosshairs
The travel industry’s exposure to loyalty and payment fraud is structurally high. Merchants in this space handle a broad mix of transaction types: airline tickets, hotel bookings, cruise reservations, package tours, and ancillary services like seat upgrades and lounge access. Each touchpoint creates a potential entry point for account takeover or credential-based fraud.
Compounding the risk, travel merchants often rely on third-party loyalty platforms and hosted booking flows that sit outside their direct security perimeter. When a customer’s loyalty account is compromised, the ripple effects can land on the merchant as chargebacks, disputes, or customer service escalations that are difficult to unwind after the fact.
Businesses with high-volume remote transactions, rapid fulfillment windows, and significant cross-border activity face the steepest risk, according to the agencies’ joint assessment. Travel merchants check all three boxes by default.
What Operators Can Do Now
The recent regulatory movement and the headline cases involving airline loyalty programs offer a concrete prompt for travel merchants to audit their own fraud exposure. Several practical steps stand out as immediately relevant.
- Strengthen authentication on loyalty and booking accounts. Multi-factor authentication remains the single most effective barrier against the credential-stuffing attacks that power most loyalty fraud. Merchants should require MFA for account logins and ensure that recovery paths do not bypass it.
- Extend fraud monitoring to cover loyalty redemptions, not just payments. Many operators monitor transaction patterns on the payment side but overlook the redemption side where miles or points are converted to gift cards or experiential rewards.
- Establish clear escalation paths for customers reporting account compromise. The American Airlines cases showed that delayed response is itself a vulnerability. Merchants who can offer 24/7 account lockdown capabilities, even if full resolution takes longer, can limit the window of exposure.
- Monitor regulatory developments from the Fed-FCC-Treasury roundtable. The working groups are expected to produce guidance on data sharing standards and fraud classification, which will likely affect how payment and loyalty fraud must be reported and remediated across the industry.
The Bottom Line
Loyalty points have crossed the threshold from loyalty currency to financial asset. That is a commercial opportunity for travel merchants who manage loyalty programs or partner with airlines and hotel chains. It is also a risk surface that deserves the same rigorous attention that operators already apply to payment card fraud. The regulatory momentum building in Washington is a signal that the industry should not wait for mandates to act.
Sources:
