Loyalty fraud detection that stops stolen miles before the award is flown, and never locks out an honest member
Stolen miles stopped before the award is flown, and honest members never locked out.
See one case, screen by screen ↓Loyalty fraud detection is the part of loyalty program fraud prevention that finds account takeover, mileage theft and redemption abuse in a frequent flyer program and stops it before miles or awards are lost. Loyalty Fraud Detection gives the fraud team seven agents that replay each risky session as a cited timeline, try the innocent explanation first and place a reversible hold on stolen awards — nothing canceled — for a loyalty fraud analyst to confirm or release and sign.
How to choose AI for airlines: a buyer's guide to agentic AI solutions →
Updated
Loyalty fraud detection today is three tools that don't talk. A bot-defense or login-risk tool scores the login, the loyalty platform runs velocity rules on redemptions and transfers, and a card-fraud tool scores the $5.60 in award taxes. The loyalty fraud analyst opens the alert, then the identity log, then the PNR and the ticket, then the card authorization, and copies it all into a spreadsheet to rebuild one timeline — while a thief with a password from another company's breach has already changed the email, deleted the phone and spent the member's miles on business seats for strangers, at 2 am.
Containment of frequent flyer fraud is blunt. Many programs can only cancel, so a false alarm strands an honest Gold member's trip, and a tightened velocity rule locks out the frequent flyers the program exists for. Verification goes wrong too: the "we noticed a change" email goes to the address the thief just added, and knowledge questions are weak against breached data. When the member complains, or an auditor asks why miles were frozen, there is rarely a case pack that shows what happened and who decided.
Estimated split of the analyst's working minutes on one suspected account takeover, by hand across separate tools and with the solution.
Seven agents replay every risky session, try the innocent explanation first and hold — never cancel; the analyst decides and signs.
At 2:14 am Chicago time, someone logs in to Gold member Helen Castellano's Corvane Waypoint account from Frankfurt. Nine minutes later two business seats to London are booked for strangers. Here is what the agents did overnight and how the loyalty fraud analyst decides the case the next morning, screen by screen, in the working solution.
The agents watched every login and redemption overnight: 2,412,880 logins scored, 41,306 redemptions and 1,862 transfers read, 64 cases built, 23 reversible holds placed, 31 cleared as honest. Nine cases need Jordan, clocks first. At the top: C-2207, Helen Castellano, 180,000 miles on two business awards, 97%, decide by 2:23 pm.
On Today: “The partner redemption feed arrived 26 minutes late; its 3,940 orders were read at 4:31 am.”
Eleven events from four systems, each tied to its log line. A credential stuffing wave from a hosting network in Frankfurt tried 1,318 logins on 1,204 accounts; Helen's worked first try, from a new Windows desktop, with a password on a 2024 breach list. Her email changed at 2:16 — the notice went only to the new address — and the phone on file since March 2023 was deleted. Then two awards on CV 950 ORD–LHR, Fri Oct 16, 5:55 pm: LANGE/TOBIAS and MOREAU/CELINE, 90,000 miles each, taxes on a German card ending 7731.
On the replay: “9 min · login to the second award.”
Before anything is held, the second-look agent tries to prove it is Helen. Is she traveling? No trip in October; her last login was Naperville, Oct 9. Are the passengers people she flies with? Her only award companion in 10 years is Robert Castellano. Is card 7731 hers? Her cards end 2290 and 4415. Did she change her own email? The new address was created today. Each is ruled out with its source.
Second-look agent: “I tried the innocent explanations first and none holds: no trip in October, no known companion, not her card.”
At 97% on a Gold account — above the 95% line in hold policy §2.1 — the hold keeper places H-5512: both award coupons suspended with the seats kept, 180,000 miles in a held balance, profile changes and redemptions frozen, the session ended. Nothing is canceled. The hold has a person and a 12-hour clock: decide by 2:23 pm.
On Holds: “A hold suspends — it never cancels a ticket or removes miles — and every hold has a person and a clock.”
Standing notice N1 goes by text to +1 630-555-0148, on file since March 2023. The new email added at 2:16 am is never used. At 7:58 am Helen replies from that phone, and her answer joins the case: confidence goes from 97% to 99%. The agent drafts a call script for Member Services and waits for approval.
Helen Castellano, 7:58 am: “No. I did not book anything. Please help.”
Jordan works the case in conversation with the agents beside the replay. She asks why the hold is safe for Helen, and the hold keeper answers with its sources: the coupons are suspended so no boarding pass can be issued, resuming restores the same seats, and the miles sit in a held balance.
Hold keeper: “Nothing was canceled. Both coupons are suspended: no boarding pass can be issued, and resuming restores the same seats.”
Cancel both awards and return 180,000 miles to Helen, with the two seats back on sale on CV 950 and the $11.20 in taxes refunded to card 7731 so no chargeback follows. Secure the account: restore her email and phone, reset the password, end the Frankfurt device, require two-step login. Block the device, the card and both passenger names for 180 days and link the case to wave W-1015. Member Services calls Helen today.
Each proposal names the agent behind it and carries Approve, Edit and Reject.
The confirmation lists exactly what will run: void the two award coupons and return 180,000 miles to Helen; restore her email and phone, reset the password and require two-step login; Member Services calls Helen today. Jordan picks ATO-CONFIRMED and signs as Loyalty Fraud Analyst. The case pack and her reason go into the audit trail.
After she signs: “Takeover confirmed · 180,000 miles returned · seats back on sale.”
Award fraud rarely stops at one account. Ring R-17 links 14 accounts that share 3 cards and 2 devices; in 60 days they booked 31 business awards for 22 passengers none of them know — brokering under program terms §9.3. Six awards worth 540,000 miles have not flown. They stay held, and because the ring is over 500,000 miles, the Fraud Operations Manager signs.
Award abuse agent: “Six awards have not flown; I hold them and Claire Whitcomb signs.”
Analysts released 41 holds under rule R2 with KNOWN-COMPANION or HOUSEHOLD: the award was for someone at the member's home address. The second-look agent proposes treating that passenger as a companion. Replayed on 90 days, takeovers caught stay at 388 and honest members held fall from 73 to 32. Nothing changes until Claire signs.
Second-look agent: “I cannot change a rule; Claire Whitcomb decides.”
The same takeover, seen by the four people who carry it — what their morning looked like, and what it looks like now.
Seven agents replay every risky session, try the innocent explanation first and hold — never cancel; the analyst decides and signs.
Reads every login and session event, links devices, IPs and networks, and joins bot-defense waves and leaked-password matches from the credential exposure feed — 2,412,880 logins scored overnight.
Builds the session replay and the plain reading of what happened from the identity, profile change and web session logs, and scores the loyalty account takeover.
Watches transfers, household pools, partner redemptions, gift cards and points purchases for mileage theft and points theft — like 64,000 miles moved to a two-day-old pool member and spent on $600 of gift cards.
Reads awards booked for other names, award ticket broker patterns and retro claims, and links accounts into rings by shared card, device and passengers.
Tries the innocent explanation first — a trip abroad, a spouse, a usual award companion, a known device — and, each week, proposes rule changes from analysts' reason codes with a 90-day replay.
Places reversible holds within policy — at 95% confidence on Gold and Platinum, 90% on Blue and Silver: suspends award coupons with the seats kept, holds miles, freezes profile changes and ends sessions, then watches every clock.
Sends the standing “Was this you?” notices only to a phone or email on file before the session, matches replies to cases, and drafts personal messages and call scripts for approval.
Decide every case, sign every rule. The agents propose; a named person decides.
On every screen the agent responsible leads with what it found and the next step it proposes. Ask back or tell it what to do; every answer cites its source, and anything that changes a record waits for your approval.
Why is the hold safe for Helen?
Nothing was canceled. Both coupons are suspended: no boarding pass can be issued, and resuming restores the same seats. Her 180,000 miles sit in a held balance, not removed. Policy §2.2 says a hold never cancels.
Could it really be Helen?
I tried that first. She has no trip in October, the passengers are not her companions, the card is not hers, and she replied "No" from her phone on file since 2023. I found no innocent explanation.
Is anyone honest being held?
Probably one: Megan Liu (C-2203). The hold went on at 91%, then the second-look agent found her own trip to Tokyo and her husband on the award, and she replied "Yes that was me". The agents propose release.
Were other members hit by the same wave?
Yes: 37 accounts logged in from the same network; 12 changed something and are held. That is case C-2198.
13 screens from the working solution, on its sample data. Pick one to see it large.
The fraud team owns the rules. Every setting below is signed by the Fraud Operations Manager, versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Hold at confidence · Gold and Platinum | 95% | Any percentage, set per tier |
| Hold at confidence · Blue and Silver | 90% | Any percentage, set per tier |
| Clock to a person | Platinum 6 hours · Gold 12 hours · Silver and Blue 24 hours | 6 hours · 12 hours · 24 hours, per tier |
| What a hold may do | Suspend award coupons, hold miles, freeze profile changes and redemptions, end sessions | Cancel a ticket or remove miles: only a person |
| At the clock | Goes to the Fraud Operations Manager | Never released on its own |
| Standing notices | N1 text and N2 email, to channels on file before the session | Wording approved by the manager · a channel added in the last 30 days is never trusted |
| Thresholds R1–R8 | e.g. new device and a contact change within 30 min; over 100,000 miles redeemed in 24 h on a new device | Each editable; a change is replayed on 90 days and goes to the manager to sign |
| Notifications | Platinum hold placed, 2 hours left on a clock, member replied, ring of 5 or more, feed late by 15 minutes | Each on or off · daily summary at 8:00 am, off by default |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Anchorage Daily News / Seattle Times, Nov 29, 2025 — 510,000 miles redeemed nine hours before departure, and account takeover attacks on travel companies up more than 50% in a year, per a fraud-prevention survey cited there; a bot-defense survey with the Loyalty Security Alliance — loyalty fraud costs victims up to $5,000 each; NIST SP 800-63B rev. 4 on notice through a channel on file). Corvane Airways, the Corvane Waypoint program, and the people, members, passengers and cases named on this page are fictional — characters and sample data in the working solution.
Loyalty fraud detection is the part of loyalty program fraud prevention that finds account takeover, mileage theft and redemption abuse in a frequent flyer program and stops it before miles or awards are lost. Loyalty Fraud Detection gives the fraud team seven agents that replay each risky session as a cited timeline, try the innocent explanation first and place a reversible hold on stolen awards — nothing canceled — for a loyalty fraud analyst to confirm or release and sign.
The agents read every login, profile change and redemption overnight, not the next morning. When a takeover is likely enough — 95% on Gold and Platinum, 90% on Blue and Silver by default — the hold keeper suspends the award coupons, holds the miles and freezes the profile. On the sample case the hold went on 39 seconds after the second award was booked, about a day and a half before the flight was due to leave.
The login watcher joins bot-defense waves with leaked-password matches from a credential exposure feed. On the sample night it tied 1,318 tries on 1,204 accounts from one hosting network to the 37 logins that worked, held the 12 accounts that changed something, and proposed password resets for the 25 that only looked.
Yes. The award abuse agent links accounts that share cards, devices and passengers into rings — on the sample, 14 accounts and 22 strangers flown — and the miles movement agent watches transfers, household pools, gift cards and points purchases. It also finds retro claim fraud, such as claims for flights with no boarding record, and enrollment farms built for sign-up bonuses.
The second-look agent tries the innocent explanation first — a trip abroad, a spouse, a usual award companion, a known device — and cleared 31 cases as honest on the sample night. A hold suspends rather than cancels, so a release restores the same seats. The target is under 7% of holds turning out honest, each released in a median under two hours.
The member contact agent sends its standing “Was this you?” notice only to a phone or email that was on file before the session; a channel added in the last 30 days is never trusted. The member's reply joins the case as evidence, and no message ever asks for a password.
Yes. The agents may only place a reversible hold within policy and send the two standing notices. People confirm, release, cancel and restore with a reason code and a signature; the Fraud Operations Manager signs insider cases, holds over 500,000 miles and every rule change after a 90-day replay.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your hold policy, rules, program terms and a sample of past cases — and it goes live once every quality gate has passed. First-time setup ends with a dry run on 30 days of your history, compared with what your team actually decided, and nothing goes live until the manager signs.
Missing miles credited in minutes, each one tied to the flown coupon and its record.
1-min demoLoyalty Partner Billing ReconciliationEvery partner statement tied out line by line, every missed mile billed or credited.
1-min demoAirline NPS Verbatim AnalysisEvery lost NPS point tied to its cause, the flights behind it and the team that fixes it.
1-min demoWe'll run Loyalty Fraud Detection on a sample of your own past login, redemption and award records.