Read this article with AI
Copy the article text into your chosen tool to inspect its sources and trade-offs.
Identify where value enters and leaves the program
List the events that earn points: purchases, referrals, promotions, manual credits or partner activity. Then list the ways value is used, including discounts, transfers and redemptions. Each event should have a clear business reference.
Separate earned points, pending rewards and adjustments. A displayed balance alone cannot explain whether a grant is final or whether a return should affect it. Your support and review teams need a trace from the balance movement to its qualifying event.
If points can become stored gift-card value, keep that conversion linked to both ledgers. The gift card controls guide follows issuance, balance access and redemption after that boundary.
The referral-fraud guide owns rewards earned through another participant. The promotion-code guide covers discounts tied to campaign eligibility.
Make balance movements traceable
| Movement | Supporting record | Question for review |
|---|---|---|
| Earn | Purchase or qualifying activity | Did the event satisfy the program rule? |
| Pending grant | Incomplete qualification | What condition remains unresolved? |
| Redemption | Authorized request and benefit issued | Was the current account permitted to use it? |
| Transfer | Source, destination and authorization | Does the program allow this relationship? |
| Adjustment | Reason, actor and original reference | Is this a correction or another grant? |
Use a stable action reference so that retries do not issue another credit. Reconcile delayed events against the existing movement. Stripe’s idempotency documentation is one example of a service-specific retry contract; the loyalty ledger still needs its own business guarantees.
Distinguish earning abuse from account compromise
Several accounts farming introductory points present an eligibility problem. A changed session redeeming an established customer’s balance may present an account-security problem. Those investigations require different histories and responses.
For a hypothetical loyalty program, repeated promotional claims might justify holding new points for review. A questionable redemption from an existing balance might require supported reauthentication or account recovery. Closing every related account would collapse those separate decisions into an overly broad action.
Use the account takeover signals article when a sensitive redemption follows unusual account changes. Normal authentication and authorization remain part of the protection boundary.
Review relationships against the program terms
Device or network links can help find repeated activity, but the program must define whether points belong to a person, household or business. A household program may intentionally link several users. A corporate account may allow an administrator to manage benefits for a team.
Ask what a detector actually establishes and how a reviewer can inspect the relationship. The multi-accounting guide describes tests involving shared devices and legitimate teams.
Record exceptions narrowly. An adjustment for one disputed purchase should not permanently exempt an account from every qualification rule. Preserve who authorized it and which movement it affects.
Protect the redemption action
The server should verify current account authority and the available entitlement before issuing value. Include mobile clients, partner routes and manual support tools. A browser-only restriction does not establish that an alternative redemption endpoint applies the same checks.
The OWASP transaction-authorization guidance is a useful reference for the surrounding sensitive operation. Keep the authorized action and the result connected so that a later change cannot silently redirect the benefit.
Test duplicate submissions, a delayed response, canceled purchases and partial returns. Decide whether each releases, reduces or preserves the relevant points under the program’s actual rules.
Monitor value and correction work together
Track qualifying activity, value granted, value redeemed, reversals and legitimate customers held incorrectly. Separate pending review from confirmed program violations. A reduction in points issued is not necessarily a better outcome if valid purchases are being missed.
Reconcile the ledger with the systems that record purchases and benefits. Investigate integration changes before assuming a spike in adjustments is caused by abuse. Provide support with the movement reference and a safe explanation rather than raw customer-risk records.
Use the fraud dashboard guide to keep grant, redemption, review and recovery states distinct in the operating view.
FAQ
Can a loyalty account be legitimate but still involved in abuse?
Yes. The issue may concern an ineligible grant, an unauthorized redemption or a mistaken balance adjustment rather than account creation.
Do several related accounts prove loyalty fraud?
No. Interpret the relationship against the program’s eligible entity and transfer rules.
What should be checked before a points redemption?
Current account authority, permitted action, available entitlement and the applicable policy. Preserve the business-action reference for retry and review.
Sources
Editorial basis: primary-source documentation and a practical evaluation framework. Examples are hypothetical unless explicitly identified otherwise. This article does not report an independent vendor benchmark.
For evaluation standards and corrections, see our methodology and contact page.