Credential Stuffing Against Loyalty Point Accounts

Loyalty points are stored money, and breached password pairs are the keys. How credential stuffing drains point balances, the signals in login traffic, and defences that do not punish members.

Credential stuffing is a type of cyberattack where attackers take username and password pairs leaked from other breaches and replay them, in bulk, against a login page, counting on reuse. Against a shop account that is an annoyance. Against a loyalty account it is theft with a gift card attached, because points are stored value: transferable in some programmes, redeemable for product in most, and monitored by members far less closely than a bank balance. A drained points account is often discovered at the till, weeks after the login that did it.

The economics favour the attacker in a specific way defenders should understand. Breach pair lists are cheap, the tooling is mature, residential proxy networks make the logins look like ordinary home connections, and the success rate does not need to be high. A tiny fraction of a large pair list, replayed against a large membership, yields accounts whose points convert to resalable goods. Every defence discussion that starts with our members should use unique passwords has mistaken a hope for a control.

Signals hiding in ordinary login traffic

Stuffing traffic has a shape. Login attempts rise without a matching rise in store visits, failure rates climb, and successes arrive from unfamiliar devices and locations for accounts that have been quiet for months. The most valuable signal is sequence: an account's first successful login in a year, from a new device, followed within minutes by a points balance check, a password or email change attempt, or a redemption. Legitimate members returning after a year browse. They do not sprint to the points.

Instrument the account events, not just the login. Log balance checks, transfers, redemptions, and contact detail changes as first class security events with device and network context, so the sprint is visible as a pattern rather than three unrelated rows in three different systems. Programmes that treat points movement as a marketing metric notice fraud in the complaints queue. Programmes that treat it as money movement notice it in the telemetry.

Defences that respect the member

Bot management and rate limiting at login are the floor, tuned to catch bulk replay and proxy rotation without challenging every returning member. Breached password screening at login and at password set, checking against known compromised pairs and forcing a reset only when a pair matches, is one of the highest value controls available, because it removes exactly the keys the attack uses while leaving unique password members untouched. Multi factor authentication helps where members will accept it; offered as an option with a small points incentive, enrolment climbs faster than any mandate achieves in retail.

On the redemption side, add friction proportional to risk. A points transfer or a large redemption from a new device, shortly after a long dormant account wakes up, should step up verification or wait for a confirmation the account email actually receives. Members redeeming normally should feel nothing. That asymmetry, invisible to the ordinary, obstructive to the sprint, is the design goal for every control in this area, and it is achievable with signals most programmes already collect.

When balances are drained anyway

Assume some attempts will land and rehearse the response before it is needed. Freeze further transfers on a reported account quickly, preserve the login and points movement logs, restore the member's balance on reasonable evidence rather than after a forensic saga, and notify other members only on facts you can support: which accounts, which window, what was taken. Members forgive a fast, plain response and a restored balance. They do not forgive learning about it from a forum.

Report stuffing in the same units as the business: attempts, confirmed takeovers, points value redeemed fraudulently, points restored. Those figures, tracked over quarters, show whether controls are working in the only terms that fund them. A security report that counts blocked requests in the millions and losses not at all has the story exactly backwards.

Related reading: Glossary, About, Credential Stuffing Patterns on Store Accounts and What They Look Like.

Frequently asked questions

What is credential stuffing in one sentence?

Attackers replay username and password pairs stolen from other breaches against your login page at scale, betting that many people reuse passwords. The pairs that match open accounts, and loyalty accounts are prized because points are redeemable value that owners monitor loosely.

Why are loyalty points targeted instead of payment cards?

Points convert to goods without touching payment systems, transfers and redemptions are often less protected than checkout, and members check balances rarely. A stored card at least sits behind the payment provider's controls. A points balance often sits behind nothing but the reused password.

What single control helps most?

Screening passwords against known breached pairs, at account creation, password change, and login, with a forced reset on a match. It directly destroys the attack's raw material for your members. Combined with login rate limiting and risk based friction on transfers and large redemptions, it changes the economics of the attack.

How should a member be treated after a takeover?

Quickly and generously on reasonable evidence: secure the account, restore the points, and explain plainly what happened and what has changed. Slow, suspicious handling of a member whose balance was stolen through a reused password teaches every witness to keep quiet next time, and quiet victims hide the scale of the next attack.