Loyalty program fraud can cost travelers and providers a fortune. Here’s how to protect yourself.
It’s difficult to get your head around the numbers in the dark market of loyalty fraud.
But, when more than 70% of a $14 trillion market is at risk of being robbed overnight with just a quick phone call or a few clicks of the keyboard, it’s time to pay attention.
Points aren’t just scores, and miles are more than distance traveled. Loyalty program credits are currency, every bit as good as cash. This high-value, unregulated currency is under attack from fraudsters, who exploit the loopholes and security gaps of the banks where points and miles accounts are stored.
“These crimes are valued less by the authorities because there’s no real money,” CellPoint Mobile CEO Kristian Gjerding explains. “It’s a legal gray zone, because you can’t call the police or prosecute as you would with other crimes.” Gjerding cites figures from Consumer Reports: “Worldwide, more than 70 frequent flyer programs have about 300 million members.” There’s a lot to steal and a lot of potential victims of fraud. Learn to crack one system, and it’s easy to crack others. All of them have common vulnerabilities. And in each one, there are millions of accounts to steal from.
Michael Smith of Airline Information, a group that organizes air travel industry conferences and events, says that 72% of airline loyalty programs have been prey to fraudsters. (Just this week, the popular Hilton HHonors program was hacked, with one customer losing 250,000 points.) He agrees with Gjerding about the difficulties of getting the authorities to respond, and understands that it’s hard for many to think of points and miles as currency. “Miles were already the fourth-biggest currency in the world years ago,” he tells us. Smith points out that not only can points and miles be exchanged for goods and services, but, in some programs, they can even be redeemed as cash.
The worst part of this criminal activity is that it often goes undetected. “Surveys suggest that 80% of fraud is discovered by accident,” Smith says. An airline or hotel may not be aware of any issue with an account until a customer complains. While the formal response could be that the member is responsible for the security of his account, Smith points out that this puts the company operating the loyalty program in the awkward position of telling a prized customer that they are out of luck.