Reinforce loyalty program safeguards

Reinforce loyalty program safeguards, stay ahead of cyber threats

Contributors: 

Anastasia Lou Regen, CISSP - Partner, Technology Consulting, Cybersecurity, EY Canada
Umang Handa - Partner at EY, Cybersecurity, EY Canada
Nick Galletto - National Cybersecurity, Strategy, Risk, Compliance and Resilience Leader, EY Canada

Cyber criminals are targeting loyalty programs. Retailers must act now to close security gaps.


Loyalty programs have quietly become one of the most valuable — and vulnerable — assets in the digital economy. Once simple marketing tools, they now operate as sprawling digital ecosystems, holding more than $200 billion in unredeemed value globally with 30-50% of these points going unused, effectively creating a vast pool of value that is minimally protected and highly attractive to fraudsters.

Airlines, retailers, grocers and ecommerce giants rely on these platforms to drive customer retention, personalize experiences and fuel data-driven growth. Yet, as loyalty programs have grown in complexity and financial significance, their security has not kept pace. The result? Loyalty systems are now a prime target for cybercriminals — and the risks are escalating fast.

Over the last decade, loyalty programs have emerged as core business drivers — powering targeted promotions, repeat purchases and data-driven consumer insights in a digital world. In turn, attackers took note that loyalty points are as good as cash — sometimes better. 

Unlike traditional payment systems, loyalty platforms are often seen as a marketing concern and tend to lack robust security controls such as multifactor authentication (MFA), advanced fraud analytics or real-time monitoring. Attackers exploit this gap using techniques ranging from credential stuffing to API exploitation, automated bots, business logic abuse and insider threats.

Loyalty program fraud has jumped up

Loyalty points are redeemed fraudulently each year

The result?

During this window, attackers can repeatedly drain accounts, launder points, and sell them on the dark web — often at 10% to 20% of their retail value. 

The scale is staggering: In the US alone, $1 billion in loyalty points are redeemed fraudulently each year, with 72% of merchants report some form of loyalty program abuse.

Loyalty points are redeemed fraudulently each year

These risks don’t only hurt customers. They expose the brands behind the programs to customer churn and potential financial loss, reputational damage, operational disruptions and a range of legal and regulatory challenges. 

On the flip side: retailers and brands that proactively strengthen cybersecurity around loyalty programs can cultivate greater consumer trust and retention.  


These risks don’t only hurt customers. They expose the brands behind the programs to customer churn and potential financial loss, reputational damage, operational disruptions and a range of legal and regulatory challenges. 

 

On the flip side: retailers and brands that proactively strengthen cybersecurity around loyalty programs can cultivate greater consumer trust and retention.  At EY Canada, we recommend strengthening loyalty program security by integrating short-, medium- and long-term tactics into a three-staged plan that:

  1. Close immediate security gaps that can be easily exploited.
  2. Build internal capabilities and proactive detection mechanisms while reinforcing external interfaces and educating users.
  3. Embed loyalty programs within enterprise security frameworks to foster sustainable trust and transparency and evolve as new technologies — and threats — emerge.

Ready to take action? Let’s treat loyalty security as the strategic priority it deserves to be — before the next breach makes headlines. We’ve outlined eight key tactics to embrace at each strategic phase to help you prevent attacks, reassure customers and reinforce trust overall.

Download this report

Summary

Cyber criminals are sneaking through the cracks of consumer loyalty programs. To continue capitalizing on the upsides these programs represent, retailers and brands must close security gaps now by building a short-, medium- and long-term plan — and acting now. 

About this article

Contributors