Loyalty reward schemes are a regular feature of the eCommerce, travel and leisure landscape, with points accumulated based on repeated custom. Loyalty programs are as attractive to cybercriminals as they are to customers. Adversaries exploit loyalty schemes to purchase products or services to use or resell for profit.

Adversaries will typically use easily accessible data leaks in credential stuffing attacks, targeting businesses with loyalty point schemes and stealing rewards points. When they get a hit, they can takeover exposed accounts and steal any points accumulated by the customer.

Frequently targeted industries include:

• Online retail
• SaaS companies
• Gaming brands
• Fintech and other financial services
• Ride-sharing platforms
• Airlines and travel agencies

Whilst credit carding fraud garners lots of mainstream attention, gift card fraud is a less well-known financial attack with a low-risk, high-reward profile for criminals.

With the format of gift card codes known, automated bots can be programmed to brute force existing codes saved in the system, leading to loyalty program abuse. This can either run at high volumes or hide within typical traffic patterns to avoid detection in the long term.

If gift card codes are generated by a web-facing API, attackers can also exploit this to generate new codes automatically, often without the knowledge of the target business.

Although logging in and spending loyalty points or inputting a gift card code are expected behaviors on web systems, there are tell-tale signs when these actions are undertaken by a loyalty bot.

Sophisticated attackers will attempt to disguise their nature through means such as CAPTCHA bypass, device fingerprint emulation or rate limiting. However, Netacea uses advanced machine learning models to analyze every single request across websites, mobile apps and APIs, comparing intent to expected behaviors and patterns to flag and block the fraudsters.