ST. PETERSBURG, Fla.—Crooks are cashing in on credit card rewards programs.
Stealing cardholders’ loyalty points has quickly become a popular practice among thieves, who see it as as one of the easiest ways to commit what can be considered a type of card not present fraud, explained PSCU.
Crooks need only limited information on a cardholder to quickly empty a points bank, and then either sell the points on the dark web or purchase merchandise and resell the goods.
“This has become a rich target for crooks. On the dark web the fraudsters are saying this this is one of the easiest points of entry for card not present crime. They have really gravitated to this,” said Jack Lynch, PSCU SVP and chief risk officer. “It’s absolutely a lower-risk crime for the thieves, and a very lucrative multi-million-dollar opportunity.”
Many Factors
A combination of factors has led to thieves’ growing interest in rewards points, not the least of which is loyalty programs expanding redemption options, making points more usable for crooks. But Lynch emphasized the ease at which fraudsters can hack into points banks, and the fact that not many are minding the store, not even cardholders.
“With rewards sites the only thing for the crooks to really crack is the login and password, once they get the account number—and people don’t make it tougher for them with all the simple passwords in place,” said Lynch. “Fraudsters see this as one of the weakest links in payments right now.”
What crooks like about this crime, as well, is that until recently not many loyalty programs or cardholders have been paying attention to what criminals are doing here. PSCU recently implemented new technology to protect its owner credit unions that use the CUSO’s CURewards loyalty programs.
“People are not looking every day at their loyalty points,” said Lynch. “About 80% of the loyalty fraud is found accidentally, often months after the crime was first committed. People finally go to their rewards bank, maybe they were thinking they had enough points to buy that big TV they were saving for, and they find that their points balance is zero.”
That delay in detecting the crime makes it easier for crooks to not only steal the points, but order the merchandise and have it shipped.
Lynch noted that law enforcement has not been giving the same attention to points theft as they do money stolen from people’s accounts—another reason crooks like this crime, he said.
Until companies such PSCU began using sophisticated fraud-detection solutions to monitor rewards programs, Lynch said thieves viewed points theft as being a “wide open” channel for fraud, when compared to issuers’ strong fraud analytics tools—which now include machine learning—that watch over the payments channels.
Advanced Authentication
PSCU said its new platform uses an advanced authentication process to validate all entities in the points redemption loop–the device, the member and the redemption transaction. The tool detects suspicious activity through digital risk-engine rules that block and eliminate: blacklisted devices, inconsistent location indicators, suspect form-filling behaviors, and multiple redemptions under different identities from a single device.
In preventing rewards point fraud, focusing on detection within the loyalty program is not enough, insists Lynch.
“This fraud starts with ID theft, thieves often phoning the call center to gather information on members to create complete profiles,” said Lynch, adding that PSCU has adopted the Pindrop platform to mitigate caller authentication fraud. “You have to fight this holistically, using multiple fraud prevention tools across all channels, or you will simply be running back and forth.”