Spread the love

Forget the days when frequent flyer points were dismissed as “funny money” for bored business travellers. In today’s connected world, those points and the shopping vouchers, hotel nights, and concert tickets they unlock are worth their weight in digital gold. Unfortunately, it’s not just you and me who’ve noticed. Cybercriminals are now circling loyalty programs like magpies eyeing a glittering trinket.

Adrianus Warmenhoven, cybersecurity advisor at NordVPN, explains plainly: “Thinking that we are getting something for free weakens our efforts to protect accounts of loyalty programs we participate in. These programs provide tangible benefits, like gift cards, products, cheaper flight tickets, or tickets to theme parks or concerts. These are assets that have concrete financial value, and they are targeted by cybercriminals.”

In other words, that “free” flat-white from your local café could cost you far more if criminals manage to hijack your loyalty account.

Fraud in Disguise

Loyalty program fraud wears many masks. At the amateur end of the spectrum sits new account fraud. Companies woo fresh customers with tempting sign-up bonuses—only for fraudsters to swoop in, creating bogus accounts (sometimes with stolen personal data) to hoover up rewards.

But the more chilling trick is account takeover. Here, hackers slip into legitimate accounts, filch points and miles, and swiftly cash them out for flights, electronics, or even cold hard cash. The favoured weapons? Old-fashioned social engineering: phishing emails urging you to “redeem before points expire”, suspicious phone calls pretending to be customer service, and texts designed to panic you into handing over details.

Warmenhoven cites one particularly brazen heist: in 2018, a cybercriminal siphoned millions of frequent flyer miles from global loyalty programs—including Delta, British Airways, and Virgin Atlantic, before bundling them on the dark web. The going price? Batches of points flogged for over US$1,000. It’s enough to make you eye your mileage statement with the suspicion usually reserved for dodgy tax returns.

Why Loyalty Accounts Are Juicy Targets

Unlike bank accounts, loyalty programs don’t always trigger alarm bells when accessed from unusual locations. After all, how many of us expect a “suspicious activity” alert from our favourite airline when logging in from Bali? Yet the benefits are every bit as real as cash. Free flights. Event tickets. Shopping vouchers. A weekend at a luxury hotel.

Cybercriminals adore them because they offer value without the usual safeguards, and consumers often underestimate the risk. Many travellers guard their bank PIN with religious fervour but use the word holiday123 as their frequent flyer password.

How to Protect Your Rewards

If you value your points stash—and who doesn’t?—Cybersecurity experts recommend treating your loyalty logins with the same seriousness as your bank account. Warmenhoven advises:

Craft strong passwords. They should be at least 12 characters long and include numbers, letters, and symbols. If your imagination fails, let a password manager do the hard work.
Avoid public Wi-Fi. Cafés and airports may offer free Wi-Fi, but hackers are lurking. If you must connect, use a VPN to shield your data.
Check your balances. Don’t wait for points to vanish mysteriously. Log in regularly and keep tabs.
Beware of phishing. Ignore those urgent emails shouting about “expiring rewards.” Always double-check the sender.
Steer clear of scam websites. Fraudsters set up look-alike sites to lure unsuspecting travellers. Tools like NordVPN’s Threat Protection Pro can flag suspicious sites before you click.

The Bottom Line

In an age when loyalty points can buy flights, gadgets, and experiences, they’ve become just as alluring to cybercriminals as credit cards. Protect them with the same vigilance, and don’t be fooled into thinking they’re “just rewards.”

After all, you’ve earned them. Don’t let someone else cash them in.