Reward program fraud has been rising in recent years across the aviation industry as well as the entire transportation sector. Some experts theorize that because Europay, Mastercard and Visa (EMV) chip technology has made physical credit card fraud more difficult, it has instead led to the global rise of reward point theft.
A major airline recently needed further expertise in identifying which cyber threats to prioritize, where to monitor for leaked intellectual property, and how to access hard-to-reach areas like the dark web without adding staff to their IT and security team. What they found was more than 300 compromised reward accounts posted for sale online.
Why Reward Fraud is on the Rise with Cybercriminals
Loyalty points are almost like cash, used not only for airline travel and rental cars but also for merchandise, gift cards, and live entertainment. Although reward accounts contain sensitive data like name, address, credit card, and even password numbers, they can be overlooked and even forgotten by customers over time. Account owners may not always be vigilant in monitoring accounts for suspicious activity – an easy win in cybercriminals’ minds.
Figure 1: Wall Street marketplace – user offering flight discounts
Password hygiene can also be lax, with reward account passwords shared across family members or reused by customers across several accounts. The many data breaches that have previously occurred likely mean that customer email addresses and passwords are already posted for sale online. Reward program thefts and prosecutions have rarely been publicized by airlines, although that is changing as seen by the notable prosecution of a college student recently for award point theft as a more public deterrent.
How Reward Fraud Occurs
Cybercriminals use a variety of techniques to compromise and monetize stolen reward accounts. They can resell the account owner’s fully-vetted identity, or sell the reward points themselves. There are hundreds of criminal locations across the open, deep, and dark web that offer user account credentials for hotel and airline points.
Figure 2: Screenshot from Digital Shadows SearchLight (now ReliaQuest GreyMatter DRP)™ – Forum post offering airline loyalty points and accounts
Here are some ways reward fraud occurs:
- Phishing Emails: Cybercriminals will often use phishing emails to harvest credentials by duping account holders to upload sensitive information or to click on a link purporting to be a password reset.
- Account Takeover: By using credential stuffing tools which are readily available online and traded on criminal forums, fraudsters can automatically inject username and password pairs from public lists to gain access to reward/award accounts.
- Insiders: Fraudsters can enlist insiders to provide access to compromised airline ticket and loyalty systems
- Re-selling Points: Legitimate reward account owners can attempt to resell their very own points, but that is generally against airline terms of service and an excellent way to get caught and face confiscation of reward points.
Want to see how this airline found the 300+ compromised reward accounts posted for sale online? See how Digital Shadows SearchLight (now ReliaQuest GreyMatter DRP)™ enables organizations to mitigate this type of risk: Test Drive SearchLight™ Free Here.
To learn more about identifying which cyber threats to prioritize, where to monitor for leaked intellectual property, and how to access hard-to-reach areas like the dark web, subscribe to our newsletter here.