Loyalty Program Fraud: How to Stop Points Abuse at the Counter

By Alva Chew · Updated 2026-11-06

In short Loyalty program fraud at a small shop usually comes from three places: staff adding or redeeming points they should not, one person holding several accounts to farm a sign-up bonus, and someone else's account being used by a stranger. Cap what one transaction can award, make staff rules visible, review redemptions weekly and keep sign-up bonuses small. A points-only programme helps because there is one rule to audit, and points are earned in proportion to a sale.

What does loyalty program fraud look like in a small shop?

Big programmes worry about organised rings and bulk account takeovers. At a café, restaurant or shop with a few staff, the realistic cases are smaller and closer to the till.

Staff awarding points without a sale. A cashier credits a friend or a spare account. Or a cashier redeems points for someone and pockets the difference.
Duplicate accounts. One person signs up several times to collect a sign-up bonus again and again.
Borrowed or taken-over accounts. A stranger uses a member’s account, usually because the login was reused somewhere else.
Over-generous rules. Not fraud, but a points rate set too high, or an uncapped manual adjustment, gets exploited in the same way.

No public study measures how often these happen at independent shops. We found no government or academic figure for loyalty fraud specifically, and we did not use vendor surveys. What follows is the nearest independent evidence on staff fraud, on account takeover and on login limits, with the scope of each stated.

What does the data say about staff fraud?

The Association of Certified Fraud Examiners (ACFE) publishes the largest regular study of fraud by employees and owners, called occupational fraud. Its 2024 report is the most recent edition we opened. It covers fraud of all kinds, so treat it as a guide to patterns rather than a loyalty statistic.

Finding	Figure
Cases analysed	1,921 from 138 countries
Median loss per case, all organisations	US$145,000
Median loss, organisations with fewer than 100 employees	US$141,000
Cases detected by a tip	43%, more than three times the next method
Median time before the scheme was detected	12 months
Median loss when caught within six months	US$30,000
Median loss when it lasted two to three years	US$250,000
Skimming schemes: share of cases and median duration	10% of cases, 18 months

Source: ACFE, Occupational Fraud 2024: A Report to the Nations, cases investigated by Certified Fraud Examiners, opened 6 November 2026.

Three points matter for a counter. First, the longer a scheme runs, the more it costs, so quick detection beats harsh penalties. Second, tips found fraud far more often than audits did. The same report says small organisations are less likely to have anti-fraud controls and have fewer checks and less separation of duties. Third, skimming, which is taking money before it is recorded, typically ran for 18 months. A points award without a matching sale is a close cousin of that pattern, though the ACFE does not study points.

How do customer accounts get taken over?

When a member’s account is used by someone else, the cause is usually a password the member reused. Verizon’s 2025 Data Breach Investigations Report analysed over 22,000 security incidents, including 12,195 confirmed data breaches. It names credential abuse (22%) and exploitation of vulnerabilities (20%) as the leading initial attack vectors.

Source	Figure	Scope
Verizon 2025 DBIR	Credential abuse was the initial access vector in 22% of breaches	All breaches analysed, not loyalty accounts alone
NIST SP 800-63B, section 3.2.2	Verifier must limit consecutive failed attempts to no more than 100	Digital identity guidance for US federal systems
OWASP Credential Stuffing Prevention Cheat Sheet	Multi-factor authentication is “by far the best defense” against most password-related attacks	Web application guidance

Sources: Verizon, 2025 DBIR news release. NIST SP 800-63B. OWASP. All opened 6 November 2026.

OWASP also lists unpredictable usernames, alerts to members about unusual events and limits on repeated login attempts. As a shop owner you will not build these yourself. You can ask your loyalty provider how sign-in works and what limits are in place before you sign up.

How do you stop staff abusing points at the counter?

The ACFE data points to controls rather than trust. For a small team these are practical.

Tie every award to a sale. Points go on only after the sale is rung up, never as a favour. A written rule helps staff say no to friends.
Cap points per transaction. Set a ceiling a little above your largest normal order. A manual award above it needs a manager.
Split roles where you can. The person who awards points should not be the only person who reviews the redemption list. Even a weekly look by the owner counts.
Review redemptions weekly. Look for one staff member handling most redemptions, repeated small redemptions on one account, or awards at odd hours. Our guide to measuring programme success lists the numbers worth tracking.
Make reporting easy. Tips found 43% of frauds in the ACFE data. The report says online forms and emails are the top reporting channels, and suggests small organisations consider them as a low-cost option. A shared email address that only you read is enough.
Rotate who handles redemptions. It stops one person owning the whole route.

How do you stop duplicate sign-ups and bonus farming?

A sign-up bonus pays for an account, so it attracts accounts. Keep it small and release it after the first real purchase. A bonus worth more than a typical order invites people to open several accounts, so size it against the average sale. Our page on sign-up bonuses covers sizing.

Ask for an email address at sign-up and check for obvious repeats during your weekly review, such as many accounts that differ by one character. This will not catch everyone. It does not need to, because a small bonus caps what a duplicate account is worth.

Does a points-only design reduce abuse?

Fewer rules mean fewer places to exploit. A programme with stamps, vouchers, tiers and games has several balances, thresholds and exceptions to audit. A points-only programme has one balance and one earn rule. Review is simple: points issued should track sales. The case for this is in the case for points-only loyalty.

Your earn rate matters too. If you set it too high, even honest use costs you more than planned. See how to set your points earn rate, and the glossary entry on points liability for what unspent points mean on your books.

What should you do if you suspect fraud?

Do not confront anyone first. Pull the transaction records for the account or staff member over a longer period, such as three months, to see if there is a pattern.
Compare points issued to sales for the same dates.
Freeze or correct the affected balances and tell the member in plain words what you changed.
Fix the rule that allowed it, for example by adding a cap or a manager check.
If the amounts are large, take advice on your local employment and criminal law before acting.

Gimify and fraud at the counter

Gimify is a points-only programme in which points are earned in proportion to the purchase amount, and members sign in with a one-tap email link, so there is no password. Staff add or redeem points on any phone, and one balance covers every outlet, which keeps a single record for review. The free plan covers one outlet with unlimited members.

Questions owners ask

What is loyalty program fraud?

It is any way of getting points or rewards you did not earn. At a small shop the common forms are staff awarding points without a sale, one customer opening several accounts for a sign-up bonus, and a stranger using another member's account.

How common is employee fraud in small businesses?

The ACFE's 2024 Report to the Nations analysed 1,921 cases from 138 countries. Organisations with fewer than 100 employees had a median loss of US$141,000 per case. Those figures cover all occupational fraud, not loyalty schemes specifically.

How do I stop staff abusing a points programme?

Separate the people who can award points from the people who review them. Cap points per transaction, require a sale to be rung up first, and review redemptions and manual adjustments each week. ACFE data shows tips are the most common way fraud is found, so give staff an easy way to report concerns.

Can customers hack loyalty accounts?

Yes, through reused passwords. Verizon's 2025 Data Breach Investigations Report found credential abuse was the initial access vector in 22% of breaches it analysed. That figure covers all breaches, not loyalty accounts alone. NIST sets a ceiling of 100 consecutive failed login attempts.

Should I stop giving sign-up bonuses to prevent fake accounts?

You do not have to stop. Keep the bonus small relative to a typical purchase and release it after the first real purchase rather than at sign-up. That removes most of the reason to open duplicate accounts.

Do points expire to reduce fraud?

Expiry limits how long stolen or inflated points stay usable, but research on expiry is mixed and it annoys honest members. Weekly review of redemptions catches more than a clock does.