In 2022, the cases of loyalty program fraud increased by over 30%, affecting over 75 airlines. Airline miles have become a full-fledged digital currency, and loyalty accounts are treated as seriously as bank accounts. To understand why these programs have become such attractive targets, we must first look at how they work.
How do airline loyalty programs work?
Airline loyalty programs reward regular customers.
With each flight taken, the passenger accumulates points called "miles," automatically credited to a personal account. The longer the flight or the higher the class, the greater the number of miles awarded.
These miles can then be exchanged for flight tickets, upgrades, hotel nights with a partner, or certain additional services.
Many programs also allow them to be used with commercial partners such as car rental companies or e-commerce platforms.
Why have airline loyalty programs become targets for fraud?
Benefits, unfortunately, often come with attempts at fraud!
What is the real financial value of miles?
Depending on the loyalty program and the number of miles accumulated in the account, members can access various benefits and fund part of their purchases.
The miles earned can, for example, cover a long-haul business class round-trip ticket, several hotel nights with a partner, or an upgrade on an already purchased flight.
The value of a significant balance can thus easily exceed several thousand euros.
This conversion system, designed to reward frequent travelers, creates a direct vulnerability: the higher the balance, the more attractive the account becomes.
According to the Loyalty Fraud Prevention Association, approximately $3.1 billion is diverted annually through these programs.
Why are loyalty accounts vulnerable to fraud?
According to the International Air Transport Association (IATA), 46% of fraudulent online transactions target airlines. Why?
From the members' perspective, loyalty accounts still primarily rely on a simple username/password combination, often without two-factor authentication.
Furthermore, few programs notify their members of logins from a new device, changes to account information, or points redemption.
Moreover, members rarely check their loyalty accounts daily. Most only verify their balance when booking a trip or using their rewards. Consequently, fraud can go undetected for months.
On the companies' side, loyalty teams and fraud teams often work in parallel, without real communication.
Alerts are not automatically escalated from one department to another. Detection tools rely on outdated rules that no longer match current methods.
What are the 4 main types of miles fraud?
Account takeover
Account takeover is the most common form of fraud in loyalty programs. It relies on “credential stuffing”. These are automated scripts that test thousands of username and password pairs recovered from the dark web following data breaches on other platforms.
The success rate is high because most internet users use the same password across multiple services. A breach on an e-commerce site, a forum, or a mobile application can then be enough to compromise a loyalty account.
Once access is gained, the fraudster changes the associated email address to block any recovery attempts. They can then use the miles to book tickets, redeem points, or make transfers. All of this can happen in minutes, even before the account owner receives any notification.
Phishing and fake customer support
Beyond direct hacking, fraudsters also rely on manipulation. Phishing and fake customer support aim to trick members into voluntarily giving up their access credentials by exploiting the trust they place in their airline.
Pages visually identical to official airline websites are shared via messages, emails, or social media advertisements.
Messages often mention miles to be redeemed before expiration, a necessary account update, or a limited-time offer. The victim then enters their credentials on the fraudulent page, which is almost impossible to distinguish from the original.
Some networks go further by setting up fake call centers.
Agents follow precise scripts, pose as airline customer service, and directly collect login credentials or banking details over the phone. These operations are organized and rely on a more advanced level of preparation than traditional phishing.
Good to know:
A few simple habits can significantly reduce the risk of fraud related to loyalty programs:
- Never click on a link received via SMS or email claiming to be from an airline
- Access the official website directly if in doubt
- Report any suspicious message to the airline's customer service
Internal fraud or employee fraud
Fraud can also be committed directly by internal actors within the company.
Employees with access to member account management systems, such as ground agents, administrators, or back-office staff, can modify balances, initiate unauthorized transfers, or validate operations without leaving obvious traces.
According to IATA, approximately 10% of loyalty program fraud involves industry employees. The actions appear legitimate from the outside, making detection difficult even with tools in place.
Members as perpetrators of fraud
Fraud can also originate directly from members.
For example, some members create multiple accounts to repeatedly benefit from welcome bonuses or try to circumvent loyalty program accumulation rules.
These practices can sometimes be difficult to legally classify. The line between misuse and actual fraud is not always clearly defined, which can complicate potential legal action for airlines.
To learn more about current fraud schemes, continue reading: the most common fraud schemes in 2026
How do fraudsters use stolen miles?
Obtaining miles from an account is only the first step. They then need to be converted into usable value. Three main methods are used.
Ticket resale
The fraudster books tickets with the stolen miles and then offers them at a reduced price on specialized forums or via private networks.
Some buyers are aware of the fraudulent origin, while others simply think they are getting a good deal.
Use with partners
Miles can be used to purchase products or services from program partners such as hotels, car rentals, or online purchases.
The goods obtained are then resold physically, which makes traceability more difficult.
Transfers to third-party accounts
To cover their tracks, some fraudsters directly exploit loyalty program mechanisms. They transfer points between relatives or use exchange gateways between partner programs.
Legally speaking, these situations are difficult to classify because they rely on legitimate mechanisms, which complicates their detection and potential prosecution.
Miles fraud: what are the risks for travelers and airlines?
What are the consequences for airlines?
Europol estimates the annual losses of the airline sector at over a billion dollars. However, beyond direct losses, reputational damage is often more significant.
According to the consulting firm Oliver Wyman, specializing in management and risk, reputational damage represents on average 140% of the reported financial loss after an incident.
The members most affected by these frauds are often those with the highest balances, particularly frequent travelers who have accumulated miles over several years.
When their account is compromised and resolution takes several weeks, the relationship with this customer segment is directly affected.
What are the consequences for travelers?
For victims, the consequences are immediate.
The account can become inaccessible, and planned tickets can no longer be booked. Proving ownership of miles, demonstrating the fraudulent nature of transactions, or obtaining a refund often takes time.
The case of Matt Rice, documented by LexisNexis Risk Solutions, clearly illustrates this situation.
One morning, Matt Rice received a transaction confirmation he hadn't initiated and discovered that 240,000 miles had been used. Upon checking, he learned that two separate operations had drained nearly 300,000 miles accumulated over several years. His account was eventually recovered and his points restored, but the resolution took two months.
The tickets he wanted to book for the school holidays were no longer available.
Beyond the restored points, the real damage, missed holidays and two months of effort, cannot be compensated.
How to prevent airline miles fraud?
For airlines, prevention starts with structural measures: implementing two-factor authentication on member accounts, sending automatic alerts for logins from new devices or points redemption, and ensuring fraud and loyalty teams communicate rather than operating in silos.
Detection tools also play a central role. Static rule-based systems show their limitations against rapidly evolving fraud methods. Behavioral analytics and document verification solutions can identify anomalies that manual checks miss.
Some airline miles fraud schemes rely specifically on the submission of fake documents: forged tickets to retroactively claim miles, fraudulent medical certificates to have points refunded after a cancellation. This type of document fraud in the travel sector often goes unnoticed during manual checks.
Finovox detects these forgeries by analyzing anomalies undetectable by the human eye: metadata, content inconsistencies, and software modification traces. A fraudulent document identified at one company can be immediately recognized if it reappears with another industry player.
Do you want to strengthen your anti-fraud measures in the travel sector? Discover how Finovox detects fake documents.
Sommaire
