We completely understand wanting to act fast when fraud shows up in your numbers with real impact. But before jumping to solutions, it’s worth making sure you’re solving the right problem in the right way, because some of the controls that instinctively feel right may create more friction for your loyal members than for the bad actors you’re actually trying to stop.
What the Data Is Actually Telling Us
Fraud redemption rates between 2-6% are considered within range industry wide across loyalty programs. That fraud rate represents a total number of fraudulent redemptions and a dollar amount in total fraud value lost.
Something stands out immediately:
A 2.4% fraud rate is consistent with what the industry sees more broadly. Industry-wide loyalty fraud is estimated at $1 – $3.1B annually, with travel, QSR, and retail among the most targeted verticals. Travel and hospitality programs lose an estimated $1 billion annually to loyalty fraud, making the sector one of the most targeted. Research from Sift found a 6.7% fraud rate across the loyalty programs they track. Loyalty fraud is the fourth fastest-growing fraud type globally, up roughly 89% year-over-year, so the problem is real, it’s growing, and it’s happening everywhere – not because programs and providers aren’t paying attention, but because fraudsters have become sophisticated, and loyalty accounts are valuable targets.
This isn’t a sign that something with the program is broken. It’s the landscape every loyalty program operates in. The goal is to implement smarter controls that keep fraud in check without making the program harder to use for members who are doing everything right.
Where the Fraud Is Actually Coming From
What it comes down to is account takeover – getting into an account using a username and a password. That’s it. Credential stuffing bots use leaked password lists to test thousands of accounts at scale, daily, and they continue to get more sophisticated. Once they’re in, they go straight to gift card redemption. Why? It’s fast, digital, and nearly impossible to recover once issued.
Modern fraud flagging tools are doing exactly what they’re designed to do and catching the roughly 2% – 6% of redemptions that are fraudulent and flagging them as such. The gap isn’t the absence of controls. It’s the lack of authentication at login preventing a fraudster from getting in at all.
One additional consideration worth flagging: a meaningful portion of current fraud often originates at the point of purchase rather than redemption. Compromised credentials are used to buy points through third-party resellers, which are then quickly converted to gift cards. Strengthening redemption controls helps, but evaluating purchase-side controls earlier in the process can reduce exposure, and ongoing chargeback volume, even further.
Why the Instinctive Fixes Miss the Mark
Capping redemptions to one per day or holding e-certificates for manual review understandably feels like the right move. But the member behavior data tells a different story about who actually gets impacted.
On daily limits: in a well-established loyalty program, it’s common to find that roughly 1 in 4 members already makes multiple redemptions on the same day, and a similar share of completed transactions already contain two or more gift cards in a single session. A hard daily cap doesn’t disrupt a fraudster willing to come back tomorrow or compromise another account. It disrupts the legitimate members who are doing exactly what the program has encouraged them to do.
On delivery holds: according to Fiserv research, 70% of consumers who choose e-certificates cite instant delivery as the #1 driver. Real-time delivery is the expectation. Holding e-certs for manual review creates unsustainable operational burden, spikes support volume, and produces false positives at scale – the majority of flags will be legitimate members.
Here’s how the approaches compare:
| Approach | Fraud Reduction | Member Impact |
| 24-hour redemption limit | Low — bad actors return tomorrow | Medium — blocks ~26% of members |
| Hold all e-certs 24 hours | Low — delays, doesn’t prevent | High — 100% of members affected |
| Layered behavioral controls | High — catches fraud at every level | None — limits only trigger on patterns no real member exhibits |
| Multi-Factor Authentication (MFA) at login | Highest — stops account takeover at the source | None — fixes the root cause before redemption starts |
What to Do Instead
This approach is simpler, more effective, and better for the member experience than what’s typically proposed, and it doesn’t touch the member experience at all.
Immediate:
Lower the per-session cap. Dropping the high-quantity redemption threshold means a fraudster who gets into an account can redeem one gift card, maybe two, before the flag fires and the redemption fails. This is a configuration change executable in days, with near-zero member impact — very few legitimate members redeem more than one or two gift cards in a single session.
Take the 24-hour delivery hold off the table. The operational burden, member experience cost, and the fact that it delays rather than prevents fraud make it a costly choice for limited benefit.
Fast follow (some development required):
Cap total redemptions over any 72-hour window. If a bad actor tries to work around the per-session cap by spreading activity across a few days, this layer catches them. Six redemptions in 72 hours is a volume no legitimate member reaches in normal use — but it’s exactly the pattern a bot or persistent fraudster would exhibit.
Cap total redemption value over any 7-day window. Even if a fraudster manages to stay under the session and 72-hour limits, a value cap puts a hard ceiling on how much they can extract. For context, the average fraudulent transaction in the scenario above was approximately $48. A reasonable weekly cap limits worst-case exposure to a manageable number while the overwhelming majority of members never get close to it.
Longer term:
Implement MFA at login. This is the only control that closes the authentication gap at its source. Risk-based triggers (flagging on new device, new geography, or first gift card redemption) keep friction low for recognized logins while blocking credential-stuffed accounts. It could realistically be implemented in 60-90 days and is the investment that pays off long-term for both members and the business. We’ve seen a client’s fraudulent redemptions drop by ~90% post implemented MFA at login.
Enable real-time redemption event streaming. Rather than relying on a single line of defense, piping redemption activity into your fraud monitoring tools in real time gives your fraud team live visibility into every transaction — the member, the amount, the brand, the timestamp — so they can apply their own detection rules and cross-reference against signals they hold. It’s the difference between one team watching and two teams working from the same data simultaneously.
Protect the Program, Don’t Punish the Member
The proposed controls will be felt by every member who tries to redeem, not only the bad actors you’re trying to stop. Loyal members who already redeem multiple times a day will wonder why the program suddenly feels harder to use, and they will make that frustration known.
Tighter behavioral controls and MFA protect the program without penalizing authentic redeemers. The immediate and fast-follow recommendations above can be implemented quickly, with lower risk, and will drive better outcomes than blunt instrument approaches – for the program, and for the members who make it worth protecting.
Written by: Kelli Graf, Director of Strategic Consulting
Kelli brings a unique perspective on this topic: she’s sat on the Product side of Kobie, and has a deep understanding of how fraud controls are actually built and she now works in Strategic Consulting, where she sees firsthand how those same controls have the potential to erode the member experience.
