Inside Australia’s loyalty industry: what the ACCC report revealed

22 July 2020
Scott Harrison

Loyalty programs offer a lot of benefits to members, whether in the form of points, discounts, or special benefits. While they have become a way for businesses to differentiate themselves, their growing significance means loyalty programs have become a target for exploitation and fraud.

What is loyalty program fraud?

Loyalty fraud is defined as where deception is used to intentionally secure unfair financial, personal, or third-party gains from loyalty programs. The biggest opportunity for fraudsters is monetisation of collected loyalty data and points.

Why is loyalty program fraud growing?

Loyalty fraud research estimates loyalty program related fraud has risen 89% year-on-year, with approximately $1 billion in rewards value lost to fraud every single year.

Cyber-attacks are a growing problem worldwide, but people are less aware of loyalty-specific fraud. It is this, and the inherent digital nature of loyalty programs, which make them so enticing to hackers and fraudsters. Loyalty points are a form of digital currency which can make them easier to access and move around with relatively little danger.

The other main issues which make loyalty programs a target is some programs rely on legacy systems which are more easily breached or are insecure due to inadequate authentication processes. Many programs protect loyalty accounts by an email and password which is easy to attack, especially if not protected by the far more secure method of two-factor authentication.

Types of loyalty program fraud

Loyalty program fraud is a not-often-recognised problem which can be perpetrated by external fraudsters, internal staff or the members themselves. While loyalty fraud is an evolving space, being aware of different types of loyalty program fraud can be the first step towards mitigating the risks.

Here’s five of the most common type of loyalty program fraud (with examples):

Account Takeover (ATO)

Account takeover is where fraudsters hack into member or staff accounts and exploit points balances and payment details attached to the account. It may also involve hackers gaining access to and exploiting highly secure and lucrative databases.

Marriot’s Mass Data Breach

Marriot’s loyalty program became victim to one of the largest mass data breaches in history. In 2018, it was discovered that information (including personal, passport and payment card details) on up to 500 million guests had been compromised. Triggered by a hacker executing a staff account take-over, further investigations revealed unauthorised access as early as 2014. It turns out that when Marriott acquired Starwood in 2016, they inherited thousands of new hotels and adopted an old reservation system unknowingly compromised by hackers.

Brute Force

A brute force attack is a process of trial-and-error where fraudsters submit passwords, guess encryption keys, or uncover unsecure website pages to gain aunthorised access. Another common form of brute force attack is ‘credentials stuffing’ where a hacker will use the same uncovered username-password combo across multiple websites.

Hilton Honors Brute Force Attack

In 2014, multiple hackers gained access to Hilton Honors loyalty program member accounts through a brute force attack. The attack was not uncovered until members reported receiving emails for unauthorised reward redemptions and depleted points balances. Many of these points later appeared for sale online at a fraction of their value. It was uncovered that weak security protocols permitted the attack, and so Hilton introduced a more robust sign-in process (including more complex passwords and CAPTCHA codes) as a measure to stop a recurrence of such breaches.

Policy Abuse

Policy abuse occurs when fraudsters identify a way to earn large amounts of points or rewards by exploiting the platform, or the program terms and conditions. Technical or policy-related loopholes are not always violated nefariously, but news can spread quickly due to social media. 

The Most Expensive Starbucks Drink Ever

Back in 2014, a member of ‘My Starbucks Rewards’ found a loophole in the terms and conditions of the birthday free item promotion. This minor loophole allowed the mischievous member to create the most expensive Starbucks drink ever, which included 60 espresso shots, protein powder and syrups in a giant Slurpee cup totalling US$54.75, all for free. Restrictions were quickly implemented into the program terms and conditions to prevent other members from replicating the behaviour.

New Account Fraud or Pooling Fraud

New account fraud or pooling fraud is where fraudsters create new ‘fake’ accounts, sometimes with stolen personal details, and then use these accounts to consolidate, sell and redeem stolen points. This occurs when a loyalty program allows the ability to transfer points from one account to another, which is a useful feature for members, but can provide the environment for loyalty points laundering. This is observed in airline and hotel programs, where third-party agents exploit traveller transactions to earn points for themselves.

The Nefarious Travel Agent

A former agent of an American travel company was charged for stealing nearly 3.7 million airline miles from high-end clients, and then using them to buy flight tickets for herself and her family. It turns out the travel agent misled clients about airline restrictions on generating loyalty bonuses and misappropriated the airlines’ miles for their own benefit. Some 135 flights worth more than $109,000 were booked for the agent and their family before the fraud was discovered.

Staff Fraud

Staff can be the frontline resource to detect and prevent fraud, but they can also be the weakest link. Staff fraud occurs when employees claim unused member benefits or take advantage of special privileges to benefit themselves or people they know. 

Airline Agent Corruption

An airline agent accumulated loyalty points from thousands of passengers. The agent put in accurate passenger details, but then used his email instead of the passengers, which allowed him to accumulate approximately 2.6 million air miles before anyone noticed.

Mitigation strategies for loyalty program fraud

It is essential to have protection across all touchpoints, as loyalty fraud and security exploitation can occur at any step in the overall experience. Here are a several strategies to be aware of to mitigate loyalty program fraud:

Security and fraud review: A comprehensive security and fraud review of an existing or potential loyalty platform can help uncover any vulnerabilities which can be identified prior. This is most pertinent for older legacy platforms (as seen in the Marriot example).

Security and fraud monitoring: Any good loyalty platform should have some level of in-built software to monitor account activity, flag abnormal behaviour, and set up access rules and privileges. For larger programs, this may require a dedicated monitoring and auditing team.

Improve security process: Requiring users to sign up with complex passwords, or including things as simple as a CAPTCHA, can significantly improve the security of the user experience. The next best approach would be to enable two-factor authentication (2FA). More secure processes can help to avoid both member account takeover, as well as staff account takeover which can have more damaging effects.

Terms and conditions: Program operators should always ensure the terms and conditions of the program and any associated promotions are structured in a way that protects the brand and loyalty program while remaining rewarding for members.

Fraud education: Training employees with theknowledge of loyalty fraud schemes, red flags, and prevention methods is a powerful tool to minimise risk.

In summary

Loyalty programs are an ideal target for fraudsters as they hold tremendous amounts of data and value. Despite this, awareness of loyalty fraud is relatively low among businesses and members.

Given trends of rising loyalty fraud alongside loyalty program proliferation (and digitalisation), program operators need to be aware of evolving risks and preventative solutions to protect the loyalty accounts of their members. 

ACCC logo

Drawn from the report Loyalty & Reward Co produced for the Australian Competition and Consumer Commission, June 2019.

Almost 80 per cent of Australians belong to at least one loyalty program. That figure, from Mastercard research,1 shows how deeply loyalty programs are woven into Australian consumer life. It does not tell you how much value members actually receive, how the largest programs earn their profits, or what the design choices behind the points mean for competition. Those questions are harder to answer, and until 2019 no one had answered them in public.

In 2019, the Australian Competition and Consumer Commission (ACCC) commissioned Loyalty & Reward Co to produce the first comprehensive, publicly available report on the Australian loyalty industry. The report examined the major programs with more than one million active members, most of them coalition programs, and set out how they are designed, how they are monetised, how they use member data, and what effect they have on competition and on consumers. You can read the full report on the ACCC website. The findings remain a useful reference for anyone designing or operating a program today.

This article summarises what the report found, and what each finding means for program operators.

A market that reaches into almost every industry

Loyalty programs have operated in Australia for several decades and now appear across almost every consumer industry. Estimates of how many programs the average Australian belongs to range from four (Adam Posner, For Love or Money 2018)2 to 6.1 (Mastercard).1 The report concentrated on the four largest coalition programs, Qantas Frequent Flyer, Woolworths Rewards, Velocity Frequent Flyer, and flybuys, because their scale and partner networks give them influence over a large share of Australian spending. A coalition program is one run by a central operator, where a network of partners rewards members with a common currency such as points.

The modern coalition program traces back to 1980, when American Airlines launched AAdvantage, the first frequent flyer program built on a reward currency of miles. Qantas Frequent Flyer followed in 1987 using points. Over the following decades, hotels, banks, supermarkets, and retailers built or joined coalition networks of their own.

Much of the recent history is a contest between two competing partnerships. In 2009, Woolworths partnered with Qantas Frequent Flyer, which grew the supermarket’s member base and gave Qantas a large population of members who rarely flew. Coles took full control of flybuys in 2011 and relaunched it, using cheaper points and supplier-funded bonus offers to compete. When Woolworths relaunched as Woolworths Rewards in October 2015 and replaced Qantas Points with a new currency earned only on selected products, members responded with sustained criticism, and the supermarket reversed much of the change within a year. By 2016, the industry had settled into two camps, Woolworths Rewards with Qantas Frequent Flyer, and flybuys with Velocity.

For operators: a currency change removes something members already value, and members tend to feel that loss more sharply than the gain meant to replace it. The Woolworths experience shows how quickly members react when a redesign reduces perceived value.

The psychology built into program design

The report set out the behavioural research that underpins program design. Several findings are worth knowing.

Operant conditioning (Skinner, 1948)3 holds that behaviour which is reinforced tends to be repeated. Bonus points for a specific action encourage members to repeat it. A related insight is that not all points are equal: the large airline, bank, supermarket, and hotel currencies are desirable enough to change where members choose to shop.

Social identity theory (Tajfel, 1978;4 Bhattacharya and Sen, 2003)5 holds that people fold the brands they identify with into their sense of self. Status tiers apply this directly. A Platinum frequent flyer receives lounge access, priority boarding, and upgrades, and that recognition can build an emotional connection to the airline. Status also raises switching costs, which can keep a member spending even when a competitor charges less for the same product.

The endowed progress effect (Nunes and Drèze, 2006)6 was demonstrated in a car wash study. Members given a card with two of ten stamps already filled redeemed at 34 per cent, against 19 per cent for members given a blank eight-stamp card, even though both groups needed eight stamps. Artificial early progress increased persistence toward the goal.

The goal-gradient effect (Hull, 1934;7 Kivetz, Urminsky, and Zheng, 2006)8 holds that effort increases as a goal comes closer. Members have been observed to accelerate their spending as they approach a status threshold.

Size heuristics describe how one hundred points can feel more rewarding than the one dollar of value it represents. Points let a program present value at a low cost to itself.

Surprise and delight can lift satisfaction well beyond what met expectations achieve. Berman (2005)9 reported that a delighted Mercedes-Benz customer had an 86 per cent likelihood of buying again, against 29 per cent for a merely satisfied one.

For operators: these mechanics work, and that is why they carry a duty of care. Design that manufactures progress or leans heavily on status can drive engagement, and it can also erode trust if members later feel the value was overstated.

How the largest programs earn their profit

A small number of coalition programs are highly profitable. Qantas Loyalty reported revenue of $1,546 million and earnings before interest and tax of $372 million in 2018.10

The report set out the standard coalition model with a worked example. A member spends $1,000 and earns 1,000 points. The program invoices the retailer at around 1.5 cents per point, so the retailer pays $15. When the member later redeems, the program values each point closer to one cent, or $10 for the 1,000 points. The program keeps the difference, roughly $5, a margin of about 33 per cent on that transaction. Across the hundreds of billions of points a large program can sell each year, those half-cents accumulate.

Two further mechanics matter. The first is breakage, the industry term for points that expire unused. Programs set expiry rules, for example 18 months of inactivity for Qantas Frequent Flyer, 24 months for Velocity, and 12 months for flybuys, and higher breakage translates directly into higher profitability. This is why some programs employ actuaries to model it. The second is deferred revenue. A program sets aside enough to cover future redemptions, and a holding of several billion dollars is not unusual for a large Australian coalition program, earning interest in the meantime.

Redemption value also varies by reward. A point redeemed on a flight might be worth one cent, on a gift card half a cent, and on a toaster around 0.25 to 0.35 cents. Pricing steers members toward redemptions that keep cash inside the business.

For operators: breakage and value-steering improve margins, and they sit in tension with member value. A program that optimises breakage too aggressively risks the disengagement that produces breakage in the first place.

The data behind the points

A loyalty program is one of the most effective ways to build a marketing database, because it links transactions to an identified individual over time. The report traced how far that data capability now extends.

Woolworths bought a half-share in analytics firm Quantium in 2013, gaining the ability to turn data from around 8 million loyalty cards into personalised offers. Data exchanges such as Data Republic, backed by Qantas Loyalty, Westpac, NAB, and ANZ, connect a broad network of organisations for secure data sharing. Data brokers can match a single member against tens or hundreds of external datasets, and one broker cited in the report, Rokt, described using billions of user records to personalise offers in real time.

For operators: members increasingly expect transparency and control over their data, a point the report emphasised. A program that collects widely without explaining clearly risks the trust that makes personalisation acceptable in the first place.

The competition question

The report examined whether loyalty programs affect competition, and the evidence points in more than one direction.

Consumer behaviour shows the effect is real. A 2018 Canstar Blue survey found that 21 per cent of shoppers who switched supermarkets did so to earn reward points, and 54 per cent of those who did all their shopping at one supermarket did so because of points.11 International research reaches similar conclusions. Lederman (2003)12 linked frequent flyer enhancements to gains in airline market share, with larger effects at hub airports. Cairns and Galbraith (1990)13 argued that programs raise switching costs and act as a sunk cost that a new entrant must match to compete. McCaughey and Behrens (2011)14 found frequent flyer members in the Netherlands willing to pay a premium of up to 6 per cent. Reichheld (1996)15 found that programs can reduce a member’s sensitivity to competing prices.

The concern is sharpest for smaller companies and new entrants. In a market of dominant duopolies, when the leading players both run large, engaged programs, the competitive tension between them can be neutralised while the barrier facing a new entrant without a comparable program rises. Norway took this seriously enough to ban the earning of points on domestic routes for a period, lifting the ban only in 2013 once domestic competition was judged robust.16

The evidence is not one-sided. Caminal and Claici argued that loyalty pricing can enhance competition by steering business between firms and lowering average transaction prices.17 Aldi, meanwhile, has campaigned directly against points-based programs, arguing that members who chase points routinely spend more, which suggests competitors view those programs as effective.

For operators: a program is a genuine competitive asset, and that same strength invites scrutiny where it raises switching costs or dampens price competition. Designing for real member value, rather than lock-in alone, is the more durable position.

Are members getting what they are promised?

The report closed on the question that matters most to members: the value they actually receive.

Value varies widely. Members of some programs receive as little as half a cent for every dollar spent, while others return 10 per cent or more. Some programs have also reduced value quietly over time. A $100 Barbeques Galore gift card that cost 13,500 points on the Velocity store in 2009 later cost 18,000 points, a 33 per cent increase. A $100 Myer gift card on the Qantas Store rose from 13,500 to 17,770 points, a 31 per cent increase, for a product whose value had not changed. Those increases outpaced the roughly 9.5 per cent inflation over the same five years, and members were not notified.

Some advertising also risks over-promising. The report noted a Qantas credit card campaign using the line “Latte, Latte, Latte, London”. Taken literally, a member would need to buy 20,000 to 40,000 cups of coffee to earn a flight to London, which at one or two cups a day could take up to 55 years. No reasonable consumer would read it literally, and that is the point: broad promotional claims can imply that value is more accessible than it is.

For operators: transparency around expiry, devaluation, and realistic earn rates protects the trust a program depends on. Members forgive a modest return far more readily than a value promise that does not hold up.

What the report means today

Australia’s loyalty industry is sophisticated, profitable, and built on well-understood behavioural science. The ACCC report showed that the same features which make programs effective, the psychology, the data, the coalition scale, and the points economics, are also the features that deserve the most care. A program earns durable loyalty when its design, its data practices, and its promises all hold up to a member reading them closely.

Loyalty & Reward Co produced this report as the loyalty consulting experts, and have since delivered more than 160 loyalty projects for leading brands worldwide. For the full detail, figures, and sources, read the complete report on the ACCC website.

References

Primary source: Shelper, P., Lyons, S., & Savransky, M. (2019). Australian Loyalty Schemes: A Loyalty & Reward Co report for the ACCC. Loyalty & Reward Co. Available at: accc.gov.au

The numbered sources below are cited in the article above. Full footnotes for every industry, media, and program source referenced throughout the report are provided in the ACCC report itself.

  1. Mastercard (2018). Achieving Advocacy and Influence in a Changing Loyalty Landscape.
  2. Posner, A. (2018). For Love or Money 2018, edition 6.
  3. Skinner, B. F. (1948). “Superstition in the pigeon”, Journal of Experimental Psychology, Vol. 38, pp. 168-172.
  4. Tajfel, H., & Turner, J. C. (1978). “An integrative theory of intergroup conflict”, in The Social Psychology of Intergroup Relations, pp. 33-47.
  5. Bhattacharya, C. B., & Sen, S. (2003). “Consumer-company identification: a framework for understanding consumers’ relationships with companies”, Journal of Marketing, Vol. 67, pp. 76-88.
  6. Nunes, J., & Drèze, X. (2006). “The endowed progress effect: how artificial advancement increases effort”, Journal of Consumer Research, Vol. 32, No. 4, pp. 504-512.
  7. Hull, C. L. (1934). “The rat’s speed of locomotion gradient in the approach to food”, Journal of Comparative Psychology, Vol. 17, pp. 393-422.
  8. Kivetz, R., Urminsky, O., & Zheng, Y. (2006). “The goal-gradient hypothesis resurrected: purchase acceleration, illusionary goal progress, and customer retention”, Journal of Marketing Research, Vol. 43, pp. 39-58.
  9. Berman, B. (2005). “How to delight your customers”, California Management Review, Vol. 61, No. 1, pp. 129-151.
  10. Qantas (2018). Qantas Annual Report 2018.
  11. Canstar Blue (2018). Consumer survey on supermarket switching and reward points, as cited in the ACCC report.
  12. Lederman, M. (2003). Do enhancements to loyalty programs affect demand? The impact of international frequent flyer partnerships on domestic airline demand, mimeo, MIT.
  13. Cairns, R., & Galbraith, J. (1990). “Artificial compatibility, barriers to entry, and frequent-flyer programs”, Canadian Journal of Economics, Vol. 23, pp. 807-816.
  14. McCaughey, N., & Behrens, C. (2011). Paying for status? The effect of frequent flyer program member status on airfare choice, Monash University Department of Economics.
  15. Reichheld, F. (1996). The Loyalty Effect: The Hidden Force Behind Growth, Profits and Lasting Value, Harvard Business School Press.
  16. OECD (2014). Airline competition: note by Norway, Directorate for Financial and Enterprise Affairs, Competition Committee.
  17. Caminal, R., & Claici, A. (2007). “Are loyalty-rewarding pricing schemes anti-competitive?”, International Journal of Industrial Organization, Vol. 25, pp. 657-674.
<a href="https://loyaltyrewardco.com/author/scott/" target="_self">Scott Harrison</a>

Scott Harrison

Based in New York, Scott Harrison is a Principal Consultant at Loyalty & Reward Co, the leading loyalty consulting firm. Loyalty & Reward Co design, implement, and operate loyalty programs for global brands. Scott is a customer experience and digital marketing specialist with extensive experience in loyalty, CX, member engagement and lifecycle marketing. He has worked with world leading brands including Australian Venue Co, McDonald’s, Schneider Electric, UEFA and Visa. Scott co-created the book Loyalty Programs: The Complete Guide, the most comprehensive book on loyalty program theory and practice available. He also regularly writes and presents on loyalty, gamification and the application of Web3 on engagement.

Read our latest expert insights

The Ultimate Guide to adidas adiClub

Since rebranding from the Creators Club in early 2022, adidas' adiClub has grown into one of the most recognised and awarded loyalty programs in global sportswear....

HeyMax First “fly now, earn later” review

Most loyalty programs are built on deferred gratification. Members spend over a period of time, watch a balance accumulate, and aim for a desired, future reward....

Let's talk

Need to level up your loyalty program? Want to tap into our expertise? Let's talk!