How do bots drain loyalty points and rewards balances?

Takeover of member accounts

The most direct attack is account takeover. Loyalty accounts hold stored value in the form of points, and credential stuffing against the store login yields working accounts the same way it yields any other login. Once inside, the bot drains the point balance: converting points to gift cards, applying them to orders shipped to reshippers, or transferring them where the program allows transfers. The member finds out at checkout, weeks later, when the balance reads zero.

Loyalty logins are softer targets than payment logins. Members reuse passwords, rarely enable two-factor authentication on a shopping account, and do not monitor the balance the way they monitor a bank account. Attackers know this. Credential lists get tested against loyalty portals specifically because the hit rate is higher and the detection is slower.

Farmed accounts that harvest signup bonuses

Where takeover steals existing points, farming creates them. Bot operators mass-create accounts to collect signup and welcome bonuses: 500 points per new member, a 10-dollar reward after the first purchase, referral bonuses for accounts that refer each other in a loop. Each account is cheap to make and the bonuses add up across thousands of them. The points get consolidated through referrals or spent on resalable goods.

The signature is in the account graph. Farmed accounts share devices, IP ranges, and email patterns, and they interact almost exclusively with the loyalty program: signup, bonus claim, redemption, abandonment. Real members browse, buy across categories, and return. A cohort of accounts that does nothing but farm bonuses is visible in the data if anyone looks at the program as a whole instead of one account at a time.

Gaming earn-and-burn mechanics

Loyalty mechanics designed for humans get exploited by machines. Points for reviews become bot-written reviews at scale. Points for daily logins become scheduled scripts. Tier thresholds that unlock perks become coordinated spending across farmed accounts to push one account over the line. Any rule that can be expressed as "do X, get Y" can be automated, and the operator will find the cheapest X that the system accepts.

The fix is not to remove the mechanics but to price them for adversaries. Review rewards need review-quality checks. Login streaks need device diversity signals. Tier qualification should weigh real purchase behavior, not just transaction count. Programs that were designed assuming good faith need a second pass that assumes a bot farm is reading the terms and conditions looking for the arbitrage.

Redemption fraud and reseller pipelines

Stolen and farmed points exit through redemption. The common paths: conversion to gift cards that are resold on secondary markets, application to orders of high-resale goods shipped to mule addresses, and in programs with transfer features, direct point transfers to buyer accounts. Gift card conversion is the favorite because it is instant, irreversible, and hard to trace once the card changes hands.

Rate-limiting redemptions and requiring step-up verification for high-value point spending cuts the damage sharply. A member converting a year of earned points to gift cards at 3 AM from a new device is an anomaly worth a challenge, not a transaction worth processing silently. The program should treat point balances with the same care as stored payment methods, because to the attacker they are the same thing.

What actually protects a loyalty program

The working stack is layered: breach-credential screening and anomaly detection on loyalty logins, account-creation controls that make farming expensive, earn-mechanics designed against automation, and step-up verification on redemptions scaled to value. Loyalty fraud is payment fraud wearing a marketing costume. The programs that stay healthy are the ones that defend the point balance like money, because it is.