Loyalty Fraud: How Stolen Points Become a Chargeback
I've worked chargeback support tickets where the merchant swore the order was legitimate right up until the real cardholder called their bank. Loyalty fraud is any scheme that steals or misuses a customer's points, miles, or rewards balance. It only becomes your chargeback when a stolen card funded or accrued that balance, and the merchant who took the payment eats the loss.
Those disputes kept starting the same way. By the end you'll know which loyalty-fraud patterns put you on the hook, and which three signals catch them first.
Key takeaways
What is loyalty fraud?
Loyalty fraud is any scheme that steals or misuses a customer's points, miles, or rewards balance. It turns into a merchant chargeback only when a stolen card touches the payment.
That's the part most coverage skips.
Most loyalty fraud never reaches your payment processor. Someone drains a points balance and redeems it, and no card gets charged anywhere in the chain. There's nothing for a cardholder to dispute with a bank.
A balance that gets drained, moved to another account, or cashed out for a gift card is still a real loss. It costs the program and the customer money. It just never lands in front of your acquirer, so the liability argument below doesn't cover it.
Types of loyalty fraud
Loyalty fraud splits into six patterns, sorted by whether a payment card ever gets charged. Here they are in order:
- Account takeover: A fraudster signs in as your customer.
- Fake account signups: Bulk accounts farmed for signup bonuses.
- First-party misuse: Your real customer disputes their own redemption.
- Insider abuse: An employee or partner issues points to themselves.
- Promo and points-farming abuse: Stacking offers past their terms.
- Stolen-card purchases for points: Fraud that earns rather than spends.
Each one below says whether it can reach your dispute file.
1. Account takeover
Account takeover is a fraudster getting into your customer's rewards account and using it as their own. Of the six, it reaches your dispute file most often, because the account usually has a card saved on it. Our guide to account takeover covers the controls that stop it.
2. Fake account signups
Fake signups farm the welcome bonus by creating accounts nobody intends to use. Throwaway emails and virtual phone numbers make each new account cheap, so the joining points pile up across hundreds of them.
No card is charged here, so nothing reaches your dispute file. You pay for it in points you owe and in signup numbers that overstate your real customers.
3. First-party misuse
First-party misuse is a cardholder disputing a charge they approved themselves, including a reward they redeemed. It reaches your dispute file like any fraud claim, and your own customer is the one who filed it.
Our breakdown of first-party misuse covers how to tell the accidental version from the deliberate one.
4. Insider abuse
Insider abuse is an employee, franchisee, or partner issuing points to an account they control. Anyone with authority to credit goodwill points or submit bulk earning files can aim that authority at themselves.
It shows up as an odd earning pattern, and no card is charged, so nothing reaches your dispute file.
Your checkout fraud tooling will never see it.
5. Promo and points-farming abuse
Promo abuse is stretching a real offer past its intended terms, and nobody has to break in to do it. Someone chains a referral bonus through accounts they own, or cancels bookings that already posted their points. The points are real and the path is allowed, so no card is charged and nothing reaches your dispute file.
6. Stolen-card purchases for points
Some fraudsters buy from you with a stolen card just to earn points into an account they control. The sale looks normal and the points post right away. The card fraud shows up days or weeks later, which puts it straight into your dispute file.
This is the pattern that hits you twice. You lose the goods to the chargeback, and the points get cashed out before the dispute even arrives.
How loyalty fraud creates dispute liability
A stolen card used to buy points-earning goods, and a hijacked redemption on the account's saved card, are the two patterns that hand you a fraud chargeback. Fake signups, insider abuse, and promo farming never touch a card, so they never reach your dispute file. First-party misuse is the odd one out, since it does produce a dispute, though your own customer files it rather than a fraudster.
Both of those land on you because of what the network can see. The real cardholder spots the activity on a statement or an account-change email, and calls their card-issuing bank. The bank then files against the merchant that took the payment. Networks can name that merchant from the transaction record, and they cannot name whoever cashed out the points.
Take a fraudster who gets into a hotel-rewards account. They change the linked email so the owner stops getting notices, then book rooms on the saved card. The card's real owner spots the bookings and disputes them. The hotel that honored them absorbs the chargeback.
Marriott's breaches show how many rewards accounts are already exposed. Three incidents between 2014 and 2020 hit roughly 344 million guest records, and the FTC's 2024 order makes Marriott restore stolen points on request. That remedy is separate from the chargeback the merchant still pays.
If nothing was charged, there's nothing to charge back.
Which reason code applies to loyalty fraud
A loyalty dispute from a stolen card or a hijacked redemption arrives under Mastercard 4837, the no-cardholder-authorization fraud code. Banks use that same family for any unauthorized online purchase. There's no separate loyalty code.
The family exists so a cardholder can contest a purchase they say they never made. Winning means proving they approved it, and a loyalty redemption gives you very little to prove it with.
A digital reward has no delivery address. A service redemption has no signature. A points-funded booking often has no shipping trail, which is exactly the evidence a goods merchant would send. Our explainer on true fraud covers what that code family requires in detail.
The same code also covers genuine first-party misuse and merchant authorization errors.
Seeing it tells you which rulebook governs your response, and it proves nothing about whether the redemption was criminal. The fraud reports behind it move separately, through the TC40 data your issuer files.
Scale of the problem
Business-side loyalty fraud losses, plus the money spent containing them, run an estimated $1 billion to $3 billion a year, per Thomson Reuters. Consumers separately lose more than $1 billion a year in stolen points.
The gap between those numbers is about whose loss got counted, and neither one is wrong. The business-side range counts what the fraudster takes, and adds what the business spends guarding accounts and refunding customers. The consumer figure counts what cardholders lost.
The two figures count some of the same dollars without measuring the same thing. Card issuers and loyalty programs pay back a share of consumer losses directly. A customer who gets paid back never files the dispute that would have become your chargeback.
Two individual cases show the same range at human scale. AARP reported a Hilton Honors member who lost 356,000 points, worth roughly $2,000. A representative added them back, and they vanished again almost at once.
Another Chase cardholder watched a balance drop to zero from 100,000 points after repeated hacks. Chase paid all of it back.
Neither aggregate isolates the slice this article is about.
Read them as the scale of loyalty fraud broadly. They say nothing about how many of those dollars end up as chargebacks.
How to detect loyalty fraud before a chargeback
Dormant accounts waking up, fast repeat redemption attempts, and a missing check at redemption are the three signals that catch a hijacked account before the purchase completes. Run them as the 3-Signal Loyalty Fraud Detection Check:
- Dormant-account reactivation. A quiet account suddenly active again.
- Redemption velocity. Several redemption attempts in a short window.
- Step-up authentication. A second check at the redemption itself.
Each one below gives you the threshold to set.
1. Dormant-account reactivation
Flag any account that logs in after 90 or more days of silence and tries to redeem in the same session. Fraudsters target dormant accounts on purpose. The balance has been building, and nobody has been reading the notification emails.
A customer returning after three months rarely redeems within minutes of signing in. Either event alone is normal, so it's the pair that earns a hold.
Seasonal programs are the catch, since a yearly-travel account really does wake up once a year. Set the rule to challenge, so a real customer gets one extra step and still gets through.
2. Velocity on redemption attempts
Cap redemption attempts at three per account in an hour, and freeze the account on the fourth. Velocity limits like this one exist to catch exactly this pattern. Someone cashing out a hijacked balance works fast. They try several redemption sizes to find one that clears, then move on when it stalls.
Your own customer redeems once, checks out, and leaves.
Count failed attempts alongside completed ones. A fraudster testing for the limit throws off a run of rejections, and a rule that watches only successful redemptions never sees it.
3. Step-up authentication at redemption
Require a one-time code or password re-entry at the moment of redemption itself. Login checks cover only the sign-in, so an attacker inside a stolen session walks straight past them. A check at the redemption step makes that attacker beat a second factor they usually don't have, on the one action that costs you money.
Apply it above a value threshold, so only high-value redemptions get challenged. Start where a single reward costs you more than a support contact, then check the first month's challenge rate against how many real customers it stopped.
Detection still misses some.
A pre-dispute alert is the backstop. It gives you a window to refund before the dispute becomes a chargeback.
What to do when a redemption becomes a dispute
Void the transaction now if you haven't fulfilled the reward, or prepare to lose the dispute if you have. Those are the two real options once you've confirmed a redemption was fraudulent.
Timing decides which one you get.
Acting before fulfillment keeps you off the chargeback path, because a reversed transaction leaves nothing to dispute. After fulfillment the odds turn against you, since the thin authentication trail described above means you're fighting a case you'll probably lose.
Spend that hour on the three signals above instead. Work out which one would have caught this redemption, and turn that one on.
Our reason code lookup tells you what the code on your notice needs before you decide whether to fight.
One exception is worth building for. A merchant with pre-dispute alerts hears about it before the chargeback is filed, and can still refund then. That avoids the fee and the ratio damage even after the reward shipped.
FAQ
Is loyalty fraud the same as promo abuse?
No, promo abuse is one pattern inside loyalty fraud, where your own customer stretches a real offer instead of breaking into anything. Loyalty fraud is the umbrella term, and it also covers outside fraudsters who steal accounts and balances outright.
Can a card network flag you for loyalty-fraud chargebacks?
Yes, because networks count every fraud-coded chargeback toward your dispute ratio whatever caused it. A cluster of loyalty disputes pushes that ratio like any other, and monitoring thresholds don't care about the cause.
Must a loyalty program be card-linked to be at risk?
No, and points-only programs get hit hard because balances build up with little oversight. Those programs still face account takeover, insider abuse, and promo farming, but no card charge means no chargeback.
How does the 10/80/10 rule apply to loyalty fraud?
The rule holds that most people are honest, a small minority always cheat, and the rest go along with it only when the opportunity is easy. For a loyalty program, most losses come from ordinary customers taking an easy opening, so tighter redemption rules beat chasing career fraudsters.
