Enzoic Navigation
  • Solutions
    • Enzoic Account Takeover Protection
    • Enzoic for Active Directory
    • Enzoic for Active Directory Lite
    • Enzoic Exposure Alerts
    • NIST Password Standards
    • Hospitals & Healthcare Password Policy
  • Tech Docs
    • API – Dev Doc
    • Active Directory – Tech Docs
    • Security Overview
  • FAQ
    • FAQ Overview
    • Active Directory FAQ
  • Resources
    • Get Support
    • What Is Credential Stuffing
    • What Is Account Takeover
    • What is a Cracking Dictionary
    • Intuitive ATO Protection
    • About Strong Passwords
    • Resource Hub
  • Company
    • About
    • Enzoic Blog
    • Threat Intel
    • Contact Us
    • In the News
    • Careers
  • Sign In
  • Get Started
  • Solutions
    • Enzoic Account Takeover Protection
    • Enzoic for Active Directory
    • Enzoic for Active Directory Lite
    • Enzoic Exposure Alerts
    • NIST Password Standards
    • Hospitals & Healthcare Password Policy
  • Tech Docs
    • API – Dev Doc
    • Active Directory – Tech Docs
    • Security Overview
  • FAQ
    • FAQ Overview
    • Active Directory FAQ
  • Resources
    • Get Support
    • What Is Credential Stuffing
    • What Is Account Takeover
    • What is a Cracking Dictionary
    • Intuitive ATO Protection
    • About Strong Passwords
    • Resource Hub
  • Company
    • About
    • Enzoic Blog
    • Threat Intel
    • Contact Us
    • In the News
    • Careers
  • Sign In
  • Get Started
Protecting Your Loyalty Programs and Rewards Accounts

Protecting Loyalty Accounts and Rewards Programs

According to LoyaltyOne, a loyalty advisory company, in the US, there are at least 3.8 billion rewards memberships, which equates to about 10 per consumer. Companies create loyalty programs for their customers because it decreases customer attrition while also giving the company more information on each customer for data mining and partnerships. One key challenge for companies is protecting those rewards and loyalty accounts from increasing account takeover attacks.

Not just the typical rewards programs

The industries that offer loyalty or rewards programs is growing.   Retail is catching on fast. At Nordstrom, 10 million members of the loyalty program’s outspent non-members 4 to 1. The rewards program at Starbucks accounts for 40% of US purchases and membership has surged more than 25 percent in the past two years. From gas stations to cigarette manufacturing, most consumer-facing industries either have or are considering starting a loyalty program. Even gaming, hospitals, wineries, utilities, automobile companies, and pizza chains have rewards or loyalty programs.

With the proliferation of loyalty programs being set up, there is also a significant increase in account takeover of those loyalty program accounts.  

When people think of loyalty programs, they frequently think of their hotel programs or airline rewards programs. Individual loyalty accounts associated with travel rewards programs are regularly taken over by criminals and there have also been some significant travel-related data breaches like the Marriott breach in 2018. Compromised airline accounts are frequently found on the dark web. But other loyalty rewards programs that you would not think would be a target are also repeatedly attacked.  

How are loyalty programs attacked?

The conventional method of the attack is through a user’s own credentials that have been exposed and are for sale on the dark web. And loyalty programs are a rich target.  They all have some form of value that sells on the dark web.  According to the New York Times, are a “Honey Pot for Hackers,” and TotalRetail states that loyalty programs are a gold mine for hackers. 

There are two important factors here:

  1. Most people use more secure passwords for their financial and banking accounts because the perceived risk is high if someone is able to access their account. Conversely, they tend to insecure credentials for their loyalty program accounts because there is less value associated with these accounts.  But because they use less secure passwords, their accounts are more vulnerable to attack.
  2. Loyalty program accounts are frequently penetrated by hackers using compromised credentials (username and password combinations).  Because most people reuse passwords across most of their online accounts, criminals can gain credentials from another site and use them on the loyalty program site. 

What can a consumer do to protect their loyalty accounts? 

  1. Stop reusing passwords across multiple sites. Use a password manager, like LastPass, if you have too many passwords to remember.
  2. Monitor your username and password for each online account you have to make sure they are not for sale on the dark web. An identity theft protection product like IDShield allows you to enter your username and password for all of your loyalty program accounts and your other online accounts.  You get an alert when your username and password are found on the dark web so that you can change your password on that account to a safer one.  

What can a company do to protect its loyalty accounts? 

  1. Encourage customers to be more security conscious as part of joining the loyalty program. Educate them on loyalty fraud and the importance of frequently tracking their points.
  2. Add credential screening to your loyalty program, so your customers can be notified if their loyalty account credentials have been compromised.  This informs your customers and enables them to take action before their points are fraudulently redeemed.

There is no single solution that can entirely protect a retailer from the threat of attack. However, it is critical that retailers take loyalty fraud seriously because it can cause them financial loss, customer attrition, and damage to their reputation. Credential screening is an affordable way for companies to take a proactive approach to their program’s security. 

Learn more: https://www.enzoic.com/account-takeover-prevention/

acccount takeover protectioncredential screeningLoyalty ProgramsRewards Accounts

Search

Browse blog categories

  • Account Takeover (19)
  • Active Directory (31)
  • all posts (79)
  • Continuous Password Protection (14)
  • COVID-19 (3)
  • Cracking Dictionaries (2)
  • Credential Screening (15)
  • Cybersecurity (28)
  • Data Breaches (9)
  • EdTech (1)
  • Enzoic Customer (2)
  • Enzoic News (7)
  • Enzoic Recognition and Awards (5)
  • Financial Services Cybersecurity (2)
  • Gaming Cybersecurity (1)
  • GDPR (1)
  • Healthcare Compliance (7)
  • Insider Threats (6)
  • Law Firm Cybersecurity (2)
  • Loyalty and Reward Programs Security (1)
  • NIST 800-63 (19)
  • Password Hygiene (4)
  • Password Tips (30)
  • Regulation and Compliance (3)
  • SMB Cybersecurity (2)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Password Strength Meter (Free)
  • Developer Documentation (APIs)

Recent blog posts

  • A Chronic Illness: Why Healthcare Industry Needs an Update
  • Pride and Passwords: Top Hacking Methods & How to Prevent Them
  • Cybersecurity and What’s Not Working from Home
  • From Paper to Passwords: Digitizing the Voting Process
  • [ Free Trial ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2020 | Privacy Policy | Acceptable Use

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website