Fraudsters who attack e-commerce merchants aren't always focusing their nefarious efforts where you might think. Instead of trying to steal products or services, sometimes they're seeking access to retailers' online rewards programs, either to use the points in hijacked customer accounts or to steal personal data. The lengths criminals have gone to for loyalty program information may surprise you.
\r\nWhen you review the facts about rewards programs, it’s a little surprising it’s taken so long for fraudsters to target them on a large scale. About 87% of U.S. consumers are members of at least one loyalty program, with the average consumer belonging to six, according to a 2019 report by Blackhawk Network Research. Nearly half of U.S. business surveyed by Blackhawk offer loyalty programs because they encourage repeat business, increase revenue and raise the lifetime value of customers who are members.
\r\nHere's more about why loyalty programs are such a tempting target, what the risks are for merchants and consumers and how to protect your rewards program.
\r\nRewards programs are popular with businesses and consumers, but there's not a lot of discussion about the fact that these programs are a repository of two things criminals want: points that can be used to make purchases or converted to cash and data that can be sold and exploited for account takeover attacks. In the U.S., the total value of rewards accounts is $60 billion, according to Loyalty Fraud Prevention Association co-founder Peter R. Maeder. Maeder told PYMNTS that the global value in these accounts is $250 billion.
\r\nDespite all that value, security around rewards programs is often less than robust. And as point-of-sale and card-not-present fraud become harder to commit, fraudsters are turning to rewards accounts as a new revenue stream. One security expert described rewards program security to the New York Times as \"the path of least resistance,\" due to simple signup procedures and lax password requirements. Simple passwords are easy for bot-assisted fraudsters to crack, and the four-digit PINs that protect many loyalty accounts are even easier.
\r\nThe cost of rewards program fraud is high, and it's rising. PYMNTS reported that attacks on loyalty accounts rose nearly threefold from 2016 to 2017, at a global cost of $2.3 billion. Remediation often includes the cost of replacing stolen rewards. One case, reported by the New York Times, involved a Hilton Honors member who lost 80,000 program points (worth an estimated $400) to hackers. Hilton replaced the points after the man reported the theft. Those reimbursements add up, and there are more costs to consider.
\r\nLoyalty program breaches generate bad publicity that can contribute to customer churn. Marriott has been in the headlines periodically since November 2018 because of a huge breach in Starwood's loyalty program, which wasn't discovered before Marriott acquired Starwood. Around the same time, Radisson Hotel Group reported a breach in its Radisson Rewards program that affected an undisclosed number of accounts.
\r\nSince the initial report, Marriott has rebranded its rewards program. That's a wise move, because research shows that consumers are wary of brands that have been breached. A 2018 Ping Identity study found that more than three-quarters of consumers stop engaging with brands that have been breached, and 49% won't join or use online services that have been breached.
\r\nThere are also regulatory penalties. Marriott faces $123 million in GDPR fines, based on the loss of personal data for an estimated 37 million customers in the U.K. and European Economic Area. As more states and nations enact data protection laws, like the California Consumer Privacy Act that takes effect in 2020, companies may face a growing list of penalties and fines for loss of their loyalty program data.
\r\nIt's clear that, although rewards programs can be good for businesses and consumers, the consequences of breaches can be severe. What's recently become obvious is just how big a target loyalty programs are for organized criminal hackers. Even when the accounts aren't easy to crack, fraudsters may be willing to work hard to breach accounts at scale.
\r\nIn April of this year, a breach was reported at Wipro, one of India's largest IT service companies. Wipro has major retail, government, and industry clients around the world, and, at first, it appeared that the goal of the breach was to gain access to Wipro customers' systems. Investigators found that hackers had been in Wipro's systems for about three years. The sophistication of the attack raised the possibility that it was state-sponsored, perhaps an espionage campaign.
\r\nThat idea was largely discarded when investigators found that the intruders were after loyalty and gift card programs run by Wipro's clients. Recently, cybersecurity firm RiskIQ published a report of its investigation of the Wipro breach. It says the breach was part of a much larger campaign against dozens of firms in different industries. The \"gift card shark\" group's motive was to phish their targets' employees, access the targets' networks, and steal data from customer loyalty, employee rewards and gift card programs.
\r\nIn all, RiskIQ uncovered five separate attack campaigns by the gift card shark group since 2016. Four of them targeted loyalty and rewards programs. RiskIQ found evidence that Best Buy, Staples, GameStop, Darden Restaurants and Expedia were among the dozens of companies targeted by the group. The group also went after money transfer, prepaid services and payment services providers, along with a large group of targets that couldn’t be identified.
\r\nWhy did this group target loyalty and gift card programs so extensively? The investigators think the goal was to convert rewards points to gift cards and gift cards to currency, then find a way to \"transfer funds to more traditional institutions.\" What was the plan for that money? How much was stolen? Who’s behind the crimes? Security professionals still don’t know.
\r\nThe lesson of the Wipro breach is that every merchant with a loyalty program needs to take steps now to make the program more secure. As with online card fraud prevention, layers of security are the best defense against rewards program hackers.
\r\nOne step is to tighten the password or PIN complexity requirements for your reward program accounts. A four-digit PIN is not complex enough. Although it takes as long 111 hours to brute force a random four-digit PIN, 20% of PINS are 1234, 0000 or 1111, which can be tested manually in seconds. Rewards program members should also be encouraged to create a unique password for their account that they don't reuse anywhere else.
\r\nEncrypting rewards' program member data can reduce the damage done if there is a breach. Although more than 9 million of the payment card numbers exposed in the Marriott-Starwood loyalty program breach were encrypted, more than 5 million customers' passport numbers were not encrypted, leaving them vulnerable to identity theft.
\r\nIt's also worth considering just how much data your rewards program needs to collect. That's because you must protect it whether you're using it or not. And in the wake of so many breaches, consumers are more wary about sharing information for rewards. A recent Harris Poll found that 76% of US consumers are more likely to join a loyalty program that only requires their name and phone number. Approximately 71% said they'd be less likely to participate if they had to share account information or \"other sensitive data.\"
\r\nFinally, it's a good idea to monitor rewards account activity the same way payment card activity is monitored for suspicious activity like purchases close together in time but in different states, or a series of unusual redemptions that don't match past accountholder behavior. When you can identify hacked accounts quickly and alert the customer, you limit the damage to their account, protect your relationship and safeguard your bottom line.
\n","docType":"article","guid":"articles_32acc6f2f78cf3742070454e66b4d136","lastModified":"2019-08-15T13:00:00.000Z","published":"2019-08-15T13:00:00.000Z","structuredData":null,"subtitle":"Keeping your rewards program should be a top priority for your business","template":"v1","title":"How to Keep Your Online Store's Rewards Program Secure","type":"article","author":{"avatar":null,"bio":"Rafael Lourenco is Executive Vice President at ClearSale, a Card-Not-Present fraud prevention operation that protects e-commerce merchants against chargebacks. The company’s flagship product, Total Guaranteed Protection, is an end-to-end outsourced fraud detection solution for online retailers. Follow on twitter at @ClearSaleUS or visit http://clear.sale/.","name":"Rafael Lourenco","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/rafael-lourenco-5a71b823/","twitter":"https://twitter.com/clearsaleus","website":"https://www.clear.sale/"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/9dac2af9242e2349bf049cf1bf75c63ae00f1.jpg","profile":{"company":"ClearSale","jobTitle":"EVP","website":"https://www.clear.sale/"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Security","slug":"security"}},"meta":{"robots":"index, follow","description":"Hackers are going to great lengths to steal loyalty rewards' program data. It is critical businesses know this is happening and take steps to prevent it.","title":"How Secure is Your Online Store’s Rewards Program? - business.com"},"parsedContent":{"toc":[{"id":"valuable-accounts,-weak-security","title":"Valuable accounts, weak security"},{"id":"loyalty-program-fraud-is-expensive","title":"Loyalty program fraud is expensive"},{"id":"criminals-are-willing-to-work-for-rewards-program-data","title":"Criminals are willing to work for rewards program data"},{"id":"the-time-for-better-rewards-program-security-is-now","title":"The time for better rewards program security is now"}],"json":[{"component":"p","children":["Fraudsters who attack e-commerce merchants aren't always focusing their nefarious efforts where you might think. Instead of trying to steal products or services, sometimes they're seeking access to retailers' online rewards programs, either to use the points in hijacked customer accounts or to steal personal data. The lengths criminals have gone to for loyalty program information may surprise you."]},{"component":"p","children":["When you review the facts about rewards programs, it’s a little surprising it’s taken so long for fraudsters to target them on a large scale. About 87% of U.S. consumers are ",{"component":"a","props":{"href":"https://blackhawknetwork.com/loyalty-members-want-more-redemption-opportunities/","target":"_blank","rel":"nofollow noopener external"},"children":["members of at least one loyalty program"]},", with the average consumer belonging to six, according to a 2019 report by Blackhawk Network Research. Nearly half of U.S. business surveyed by Blackhawk offer loyalty programs because they encourage repeat business, increase revenue and raise the lifetime value of customers who are members. "]},{"component":"p","children":["Here's more about why loyalty programs are such a tempting target, what the risks are for merchants and consumers and how to protect your rewards program."]},{"component":"h2","props":{"id":"valuable-accounts,-weak-security"},"children":["Valuable accounts, weak security"]},{"component":"p","children":["Rewards programs are popular with businesses and consumers, but there's not a lot of discussion about the fact that these programs are a repository of two things criminals want: points that can be used to make purchases or converted to cash and data that can be sold and exploited for account takeover attacks. In the U.S., the ",{"component":"a","props":{"href":"https://www.pymnts.com/news/security-and-risk/2018/loyalty-rewards-programs-digital-fraud-prevention/","target":"_blank","rel":"nofollow"},"children":["total value of rewards accounts is $60 billion"]},", according to Loyalty Fraud Prevention Association co-founder Peter R. Maeder. Maeder told PYMNTS that the global value in these accounts is $250 billion."]},{"component":"p","children":["Despite all that value, security around rewards programs is often less than robust. And as point-of-sale and card-not-present fraud become harder to commit, fraudsters are turning to rewards accounts as a new revenue stream. One security expert described rewards program security to ",{"component":"a","props":{"href":"https://www.nytimes.com/2019/05/11/business/rewards-loyalty-program-fraud-security.html","target":"_blank","rel":"nofollow noopener external"},"children":["the New York Times"]}," as \"the path of least resistance,\" due to simple signup procedures and lax password requirements. Simple passwords are easy for bot-assisted fraudsters to crack, and the four-digit PINs that protect many loyalty accounts are even easier. "]},{"component":"h2","props":{"id":"loyalty-program-fraud-is-expensive"},"children":["Loyalty program fraud is expensive"]},{"component":"p","children":["The cost of rewards program fraud is high, and it's rising. PYMNTS reported that attacks on loyalty accounts rose nearly threefold from 2016 to 2017, at a global cost of $2.3 billion. Remediation often includes the cost of replacing stolen rewards. One case, reported by the New York Times, involved a Hilton Honors member who lost 80,000 program points (worth an estimated $400) to hackers. Hilton replaced the points after the man reported the theft. Those reimbursements add up, and there are more costs to consider."]},{"component":"p","children":["Loyalty program breaches generate bad publicity that can contribute to customer churn. Marriott has been in the headlines periodically since November 2018 because of a huge breach in Starwood's loyalty program, which wasn't discovered before Marriott acquired Starwood. Around the same time, Radisson Hotel Group reported a breach in its Radisson Rewards program that affected an undisclosed number of accounts. "]},{"component":"p","children":["Since the initial report, Marriott has rebranded its rewards program. That's a wise move, because research shows that consumers are wary of brands that have been breached. A 2018 Ping Identity study found that more than ",{"component":"a","props":{"href":"https://www.eweek.com/security/users-stop-engaging-with-brands-after-data-breaches-report-finds","target":"_blank","rel":"nofollow noopener external"},"children":["three-quarters of consumers stop engaging with brands"]}," that have been breached, and 49% won't join or use online services that have been breached. "]},{"component":"p","children":["There are also regulatory penalties. Marriott faces $123 million in GDPR fines, based on the loss of personal data for an estimated 37 million customers in the U.K. and European Economic Area. As more states and nations enact data protection laws, like the California Consumer Privacy Act that takes effect in 2020, companies may face a growing list of penalties and fines for loss of their loyalty program data. "]},{"component":"h2","props":{"id":"criminals-are-willing-to-work-for-rewards-program-data"},"children":["Criminals are willing to work for rewards program data"]},{"component":"p","children":["It's clear that, although rewards programs can be good for businesses and consumers, the consequences of breaches can be severe. What's recently become obvious is just how big a target loyalty programs are for organized criminal hackers. Even when the accounts aren't easy to crack, fraudsters may be willing to work hard to breach accounts at scale."]},{"component":"p","children":["In April of this year, a breach was reported at Wipro, one of India's largest IT service companies. Wipro has major retail, government, and industry clients around the world, and, at first, it appeared that the goal of the breach was to gain access to Wipro customers' systems. Investigators found that hackers had been in Wipro's systems for about three years. The sophistication of the attack raised the possibility that it was state-sponsored, perhaps an espionage campaign. "]},{"component":"p","children":["That idea was largely discarded when investigators found that the intruders were after loyalty and gift card programs run by Wipro's clients. Recently, cybersecurity firm RiskIQ published a ",{"component":"a","props":{"href":"https://www.riskiq.com/research/gift-cardsharks/","target":"_blank","rel":"nofollow noopener external"},"children":["report of its investigation of the Wipro breach"]},". It says the breach was part of a much larger campaign against dozens of firms in different industries. The \"gift card shark\" group's motive was to phish their targets' employees, access the targets' networks, and steal data from customer loyalty, employee rewards and gift card programs. "]},{"component":"p","children":["In all, RiskIQ uncovered five separate attack campaigns by the gift card shark group since 2016. Four of them targeted loyalty and rewards programs. RiskIQ found evidence that Best Buy, Staples, GameStop, Darden Restaurants and Expedia were among the dozens of companies targeted by the group. The group also went after money transfer, prepaid services and payment services providers, along with a large group of targets that couldn’t be identified."]},{"component":"p","children":["Why did this group target loyalty and gift card programs so extensively? The investigators think the goal was to convert rewards points to gift cards and gift cards to currency, then find a way to \"transfer funds to more traditional institutions.\" What was the plan for that money? How much was stolen? Who’s behind the crimes? Security professionals still don’t know. "]},{"component":"h2","props":{"id":"the-time-for-better-rewards-program-security-is-now"},"children":["The time for better rewards program security is now"]},{"component":"p","children":["The lesson of the Wipro breach is that every merchant with a loyalty program needs to take steps now to make the program more secure. As with online card fraud prevention, layers of security are the best defense against rewards program hackers. "]},{"component":"p","children":["One step is to tighten the password or PIN complexity requirements for your reward program accounts. A four-digit PIN is not complex enough. Although it takes as long 111 hours to brute force a random four-digit PIN, ",{"component":"a","props":{"href":"https://www.popsci.com/technology/article/2012-09/infographic-day-fastest-way-crack-4-digit-pin-number/","target":"_blank","rel":"nofollow noopener external"},"children":["20% of PINS are 1234, 0000 or 1111"]},", which can be tested manually in seconds. Rewards program members should also be encouraged to create a unique password for their account that they don't reuse anywhere else."]},{"component":"p","children":["Encrypting rewards' program member data can reduce the damage done if there is a breach. Although more than 9 million of the payment card numbers exposed in the Marriott-Starwood loyalty program breach were encrypted, more than 5 million customers' passport numbers were not encrypted, leaving them vulnerable to identity theft. "]},{"component":"p","children":["It's also worth considering just how much data your rewards program needs to collect. That's because you must protect it whether you're using it or not. And in the wake of so many breaches, consumers are more wary about sharing information for rewards. A recent Harris Poll found that 76% of US consumers are ",{"component":"a","props":{"href":"https://smallbiztrends.com/2019/04/customer-loyalty-programs-and-privacy.html","target":"_blank","rel":"nofollow noopener external"},"children":["more likely to join a loyalty program"]}," that only requires their name and phone number. Approximately 71% said they'd be less likely to participate if they had to share account information or \"other sensitive data.\" "]},{"component":"p","children":["Finally, it's a good idea to monitor rewards account activity the same way payment card activity is monitored for suspicious activity like purchases close together in time but in different states, or a series of unusual redemptions that don't match past accountholder behavior. When you can identify hacked accounts quickly and alert the customer, you limit the damage to their account, protect your relationship and safeguard your bottom line."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5d5/1d5857b4374707b8b4582/1500-0-","caption":"Daniel Krason/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"How to Assess the Cybersecurity Risk of Your Small Business","canonical":"https://www.business.com/articles/assess-small-business-cybersecurity/","slug":"assess-small-business-cybersecurity","thumbnail":"https://www.business.com/images/content/5ed/118db7b437422298b4576/1500-0-","dek":"Security risk profiles can help quantify cybersecurity risk.","lastModified":"2020-06-03T13:41:00Z","published":"2018-06-15T13:30:00Z","sponsored":false},{"title":"Cloud Encryption: Using Data Encryption in The Cloud","canonical":"https://www.business.com/articles/cloud-data-encryption/","slug":"cloud-data-encryption","thumbnail":"https://www.business.com/images/content/5d0/8eac17b437482458b4578/1500-0-","dek":"Data security remains a top concern in cloud adoption.","lastModified":"2018-07-03T12:10:00Z","published":"2018-07-03T12:10:00Z","sponsored":false},{"title":"5 Tips for Developing a More Secure IoT Policy for Your Organization","canonical":"https://www.business.com/articles/developing-a-more-secure-iot-policy/","slug":"developing-a-more-secure-iot-policy","thumbnail":"https://www.business.com/images/content/5a8/320ed51ee478b128b4568/1500-0-","dek":"Eliminate vulnerabilities, strengthen your data and protect your business.","lastModified":"2018-02-13T08:00:00Z","published":"2018-02-13T08:00:00Z","sponsored":false},{"title":"Has Your Company Secured These Overlooked Attack Vectors?","canonical":"https://www.business.com/articles/3-overlooked-attack-vectors/","slug":"3-overlooked-attack-vectors","thumbnail":"https://www.business.com/images/content/5ac/649ee92a3a4d15e8b4582/1500-0-","dek":"Many don't consider these three common security weaknesses.","lastModified":"2018-04-05T07:00:00Z","published":"2018-04-05T07:00:00Z","sponsored":false},{"title":"How to Protect Your Web Application – Even If You Don't Own Sensitive Data","canonical":"https://www.business.com/articles/protecting-web-applications/","slug":"protecting-web-applications","thumbnail":"https://www.business.com/images/content/5b5/204c251ee47ed578b4568/1500-0-","dek":"Keep you web application and customer data secure by following these 4 steps.","lastModified":"2018-07-20T07:00:00Z","published":"2018-07-20T07:00:00Z","sponsored":false},{"title":"Decoding the Hierarchy of Data Protection","canonical":"https://www.business.com/articles/data-protection-hierarchy/","slug":"data-protection-hierarchy","thumbnail":"https://www.business.com/images/content/5ad/e2b331039eba5148b456a/1500-0-","dek":"What are your options for protecting your data and how do you decide on a strategy?","lastModified":"2018-04-23T19:00:00Z","published":"2018-04-23T19:00:00Z","sponsored":false},{"title":"5 Preventable Human Errors That Leave Your Company Vulnerable to a Cyberattack","canonical":"https://www.business.com/articles/preventable-human-errors/","slug":"preventable-human-errors","thumbnail":"https://www.business.com/images/content/5b0/306f192a3a4090f8b4577/1500-0-","dek":"Most cyberattacks stem from internal human error, but companies can protect themselves.","lastModified":"2018-05-21T07:00:00Z","published":"2018-05-21T07:00:00Z","sponsored":false},{"title":"How to Select the Right Encryption Key Management Solution","canonical":"https://www.business.com/articles/encryption-key-management-considerations/","slug":"encryption-key-management-considerations","thumbnail":"https://www.business.com/images/content/5b3/b6aae92a3a480118b457d/1500-0-","dek":"Encryption key management is a necessary component of effective data protection.","lastModified":"2018-07-03T12:06:00Z","published":"2018-07-03T12:06:00Z","sponsored":false},{"title":"Your E-Commerce Data Security Checklist for 2020","canonical":"https://www.business.com/articles/ecommerce-data-security-checklist/","slug":"ecommerce-data-security-checklist","thumbnail":"https://www.business.com/images/content/5e8/22b9f7b4374651e8b456e/1500-0-","dek":"To protect your business from hackers and data theft – and to keep the customer trust you've worked hard to earn – make sure your company follows these 10 data security best practices.","lastModified":"2020-03-30T17:20:00Z","published":"2020-03-30T17:20:00Z","sponsored":false},{"title":"Biometrics and the Future: What It Means for Small Businesses","canonical":"https://www.business.com/articles/biometrics-facial-recognition-small-business/","slug":"biometrics-facial-recognition-small-business","thumbnail":"https://www.business.com/images/content/5ad/744c11039eb027a8b4599/1500-0-","dek":"Biometrics are popping up everywhere. Find out why it's good for business.","lastModified":"2018-04-19T12:40:00Z","published":"2018-04-19T12:40:00Z","sponsored":false},{"title":"M-Commerce Is Booming. So Is M-Commerce Fraud","canonical":"https://www.business.com/articles/m-commerce-fraud/","slug":"m-commerce-fraud","thumbnail":"https://www.business.com/images/content/5ef/1e6987b437406198b456a/1500-0-","dek":"As mobile commerce continues to boom, so, too, does m-commerce fraud. For businesses, the solution is to create a multilayered defense.","lastModified":"2020-06-23T19:03:00Z","published":"2020-06-23T19:03:00Z","sponsored":false},{"title":"Bolster Your Data Security Strategy with Intelligent Data Loss Prevention Software","canonical":"https://www.business.com/articles/dlp-software-data-security/","slug":"dlp-software-data-security","thumbnail":"https://www.business.com/images/content/5b8/035861039eba87e8b4569/1500-0-","dek":"Data is your business's most valuable asset.","lastModified":"2018-08-24T07:00:00Z","published":"2018-08-24T07:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df905909c658a7e538b4567/Faxing_junce_Getty.jpg","canonical":"https://staging.business.com/categories/online-fax-services/","title":"The Best Online Fax Services of 2021","dek":"Online fax services are growing as more companies divest from conventional fax machines in favor of an automated, scalable and cost-effective option. Here's a look at some of the best online fax services on the market. ","slug":"online-fax-services","lastModified":"2021-03-02T16:07:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-08-15T13:00:00.000Z","template":"v1","title":"How to Keep Your Online Store's Rewards Program Secure","meta":{"robots":"index, follow"},"docType":"articles","slug":"rewards-program-security","canonical":"https://staging.business.com/articles/rewards-program-security/","skipTOC":false}},"staticQueryHashes":[]}